Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
tack for Xen PV again for doing an iret just use the iret exit from the beginning. This can easily be done via an ALTERNATIVE like it is done for the sysenter compat case already. It should be noted that this drops the optimization in Xen for not restoring a few registers when returning to user mode, but it seems as if the saved instructions in the kernel more than compensate for this drop (a kernel build in a Xen PV guest was slightly faster with this patch applied). While at it remove the stale sysret32 remnants. [ pawan: Brad Spengler and Salvatore Bonaccorso <carnil@debian.org> reported a problem with the 5.10 backport commit edc702b4a820 ("x86/entry_64: Add VERW just before userspace tr
ian.org> reported a problem with the 5.10 backport commit edc702b4a820 ("x86/entry_64: Add VERW just before userspace transition"). When CONFIG_PARAVIRT_XXL=y, CLEAR_CPU_BUFFERS is not executed in syscall_return_via_sysret path as USERGS_SYSRET64 is runtime patched to: .cpu_usergs_sysret64 = { 0x0f, 0x01, 0xf8, 0x48, 0x0f, 0x07 }, // swapgs; sysretq which is missing CLEAR_CPU_BUFFERS. It turns out dropping USERGS_SYSRET64 simplifies the code, allowing CLEAR_CPU_BUFFERS to be explicitly added to syscall_return_via_sysret path. Below is with CONFIG_PARAVIRT_XXL=y and this patch applied: syscall_return_via_sysret: ... <+342>: swapgs <+345>: xchg %ax,%ax <+347>: verw -0x1a2(%rip) <------ <+354>:
ch applied: syscall_return_via_sysret: ... <+342>: swapgs <+345>: xchg %ax,%ax <+347>: verw -0x1a2(%rip) <------ <+354>: sysretq ] Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/1424ab4bb386df9cc590c73afa55f13e9b00dea2 - https://grsecurity.net/cve-2021-4440_linux_cna_case_study
CVE ID: CVE-2021-4441 State: PUBLISHED Published: 2024-08-22T01:30:04.687Z Last Updated: 2025-05-04T06:59:55.248Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: spi: spi-zynq-qspi: Fix a NULL pointer dereference in zynq_qspi_exec_mem_op() In zynq_qspi_exec_mem_op(), kzalloc() is directly used in memset(), which could lead to a NULL pointer dereference on failure of kzalloc(). Fix this bug by adding a check of tmpbuf. This bug was found by a static analyzer. The analysis employs differential checking to identify inconsistent security operations (e.g., checks or kfrees) between two code paths and confirms that the inconsistent op
y inconsistent security operations (e.g., checks or kfrees) between two code paths and confirms that the inconsistent operations are not recovered in the current function or the callers, so they constitute bugs. Note that, as a bug found by static analysis, it can be a false positive or hard to trigger. Multiple researchers have cross-reviewed the bug. Builds with CONFIG_SPI_ZYNQ_QSPI=m show no new warnings, and our static analyzer no longer warns about this code. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/df14d2bed8e2455878e046e67123d9ecb2e79056 - https://git.kernel.org/stable/c/2efece1368aeee2d2552c7ec36aeb676c4d4c95f - https://git.kern
5878e046e67123d9ecb2e79056 - https://git.kernel.org/stable/c/2efece1368aeee2d2552c7ec36aeb676c4d4c95f - https://git.kernel.org/stable/c/3c32405d6474a21f7d742828e73c13e326dcae82 - https://git.kernel.org/stable/c/b9dd08cbebe0c593c49bf86d2012a431494e54cb - https://git.kernel.org/stable/c/ab3824427b848da10e9fe2727f035bbeecae6ff4
CVE ID: CVE-2021-4442 State: PUBLISHED Published: 2024-08-29T09:05:37.288Z Last Updated: 2025-05-04T06:59:56.297Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: tcp: add sanity tests to TCP_QUEUE_SEQ Qingyu Li reported a syzkaller bug where the repro changes RCV SEQ _after_ restoring data in the receive queue. mprotect(0x4aa000, 12288, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1,
MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 socket(AF_INET6, SOCK_STREAM, IPPROTO_IP) = 3 setsockopt(3, SOL_TCP, TCP_REPAIR, [1], 4) = 0 connect(3, {sa_family=AF_INET6, sin6_port=htons(0), sin6_flowinfo=htonl(0), inet_pton(AF_INET6, "::1", &sin6_addr), sin6_scope_id=0}, 28) = 0 setsockopt(3, SOL_TCP, TCP_REPAIR_QUEUE, [1], 4) = 0 sendmsg(3, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base="0x0000000000000003\0\0", iov_len=20}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 20 setsockopt(3, SOL_TCP, TCP_REPAIR, [0], 4) = 0 setsockopt(3, SOL_TCP, TCP_QUEUE_SEQ, [128], 4) = 0 recvfrom(3, NULL, 20,
etsockopt(3, SOL_TCP, TCP_REPAIR, [0], 4) = 0 setsockopt(3, SOL_TCP, TCP_QUEUE_SEQ, [128], 4) = 0 recvfrom(3, NULL, 20, 0, NULL, NULL) = -1 ECONNRESET (Connection reset by peer) syslog shows: [ 111.205099] TCP recvmsg seq # bug 2: copied 80, seq 0, rcvnxt 80, fl 0 [ 111.207894] WARNING: CPU: 1 PID: 356 at net/ipv4/tcp.c:2343 tcp_recvmsg_locked+0x90e/0x29a0 This should not be allowed. TCP_QUEUE_SEQ should only be used when queues are empty. This patch fixes this case, and the tx path as well. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/319f460237fc2965a80aa9a055044e1da7b3692a - https://git.kernel.org/stable/c/3bf899438c123c444f6b644a57784df
.org/stable/c/319f460237fc2965a80aa9a055044e1da7b3692a - https://git.kernel.org/stable/c/3bf899438c123c444f6b644a57784dfbb6b15ad6 - https://git.kernel.org/stable/c/046f3c1c2ff450fb7ae53650e9a95e0074a61f3e - https://git.kernel.org/stable/c/3b72d5a703842f582502d97906f17d6ee122dac2 - https://git.kernel.org/stable/c/8811f4a9836e31c14ecdf79d9f3cb7c5d463265d
CVE ID: CVE-2021-4443 State: PUBLISHED Published: 2024-10-16T06:43:23.798Z Last Updated: 2024-10-16T18:22:21.423Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: quadlayers Products: WordPress Mega Menu – QuadMenu Problem Types: CWE-434 Description: The WordPress Mega Menu plugin for WordPress is vulnerable to Arbitrary File Creation in versions up to, and including, 2.0.6 via the compiler_save AJAX action. This makes it possible for unauthenticated attackers to create arbitrary PHP files that can be used to execute malicious code. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/040
onal Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/04003542-fd62-4587-9834-70e7fe8f08ef?source=cve - https://sh3llcon.org/la-debilidad-de-wordpress/ - https://www.acunetix.com/vulnerabilities/web/wordpress-plugin-wordpress-mega-menu-quadmenu-remote-code-execution-2-0-6/
CVE ID: CVE-2021-4444 State: PUBLISHED Published: 2024-10-16T06:43:26.711Z Last Updated: 2024-10-16T19:11:36.042Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: woobewoo Products: Product Filter by WBW Problem Types: CWE-862 Description: The Product Filter by WooBeWoo plugin for WordPress is vulnerable to authorization bypass in versions up to, and including 1.4.9 due to missing authorization checks on various functions. This makes it possible for unauthenticated attackers to perform unauthorized actions such as creating new filters and injecting malicious javascript into a vulnerable site. This was actively exploited at the time of discovery. Additional Anal
cting malicious javascript into a vulnerable site. This was actively exploited at the time of discovery. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/30b6b0bf-e632-4e83-89ee-a424382534da?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2527958%40woo-product-filter&new=2527958%40woo-product-filter&sfp_email=&sfph_mail=
CVE ID: CVE-2021-4445 State: PUBLISHED Published: 2024-10-16T06:43:42.668Z Last Updated: 2024-10-16T18:03:13.386Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: leap13 Products: Premium Addons for Elementor Problem Types: CWE-862 Description: The Premium Addons for Elementor plugin for WordPress is vulnerable to Arbitrary Option Updates in versions up to, and including, 4.5.1. This is due to missing capability and nonce checks in the pa_dismiss_admin_notice AJAX action. This makes it possible for authenticated subscriber+ attackers to change arbitrary options with a restricted value of 1 on vulnerable WordPress sites. Additional Analyst Notes: - CISA ADP Vu
ge arbitrary options with a restricted value of 1 on vulnerable WordPress sites. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/cffb26bc-3d3f-4593-bb36-d2abcd67861e?source=cve - https://ithemes.com/blog/wordpress-vulnerability-report-september-2021-part-2/#ib-toc-anchor-2 - https://wpscan.com/vulnerability/2e5b3608-1dfc-468f-b3ae-12ce7c25ee6c - https://wordpress.org/plugins/premium-addons-for-elementor/ - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2590819%40premium-addons-for-elementor&new=2590819%40premium-addons-for-elementor&sfp_email=&sfph_mail=
CVE ID: CVE-2021-4446 State: PUBLISHED Published: 2024-10-16T06:43:25.787Z Last Updated: 2024-10-16T15:34:14.629Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: wpdevteam Products: Essential Addons for Elementor – Best Elementor Addon, Templates, Widgets, Kits & WooCommerce Builders Problem Types: CWE-862 Description: The Essential Addons for Elementor plugin for WordPress is vulnerable to authorization bypass in versions up to and including 4.6.4 due to missing capability checks and nonce disclosure. This makes it possible for authenticated attackers, with minimal permissions such as a subscriber, to perform many unauthorized actions such as changing setti
ed attackers, with minimal permissions such as a subscriber, to perform many unauthorized actions such as changing settings and installing arbitrary plugins. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/283fb581-8b61-4008-a5c4-2e1490fab33e?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2526471%40essential-addons-for-elementor-lite&new=2526471%40essential-addons-for-elementor-lite&sfp_email=&sfph_mail=
CVE ID: CVE-2021-4447 State: PUBLISHED Published: 2024-10-16T06:43:42.210Z Last Updated: 2024-10-16T19:36:14.328Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: wpdevteam Products: Essential Addons for Elementor – Best Elementor Addon, Templates, Widgets, Kits & WooCommerce Builders Problem Types: CWE-862 Description: The Essential Addons for Elementor plugin for WordPress is vulnerable to privilege escalation in versions up to and including 4.6.4 due to a lack of restrictions on who can add a registration form and a custom registration role to an Elementor created page. This makes it possible for attackers with access to the Elementor page builder to create
to an Elementor created page. This makes it possible for attackers with access to the Elementor page builder to create a new registration form that defaults to the user role being set to administrator and subsequently register as an administrative user. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/be098ee9-b749-4908-85e8-e717d019609a?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2526471%40essential-addons-for-elementor-lite&new=2526471%40essential-addons-for-elementor-lite&sfp_email=&sfph_mail=
CVE ID: CVE-2021-4448 State: PUBLISHED Published: 2024-10-16T06:43:31.059Z Last Updated: 2024-10-16T18:06:05.354Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: SayenThemes Products: Kaswara Modern VC Addons Problem Types: CWE-862 Description: The Kaswara Modern VC Addons plugin for WordPress is vulnerable to authorization bypass in versions up to, and including, 3.0.1 due to insufficient capability checking on various AJAX actions. This makes it possible for unauthenticated attackers to perform a wide variety of unauthorized actions such as importing data, uploading arbitrary files, deleting arbitrary files, and more. Additional Analyst Notes: - CISA ADP Vul
importing data, uploading arbitrary files, deleting arbitrary files, and more. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/3bf76527-9a11-4755-992c-02fbc1a79bae?source=cve - https://codecanyon.net/item/kaswara-modern-visual-composer-addons/19341477
CVE ID: CVE-2021-4449 State: PUBLISHED Published: 2024-10-16T06:43:25.290Z Last Updated: 2024-10-16T19:09:26.046Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: ZoomIt Products: ZoomSounds - WordPress Wave Audio Player with Playlist Problem Types: CWE-434 Description: The ZoomSounds plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'savepng.php' file in versions up to, and including, 5.96. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. Additional Analyst Notes: - CISA ADP Vulnrichment: Reference
ite's server which may make remote code execution possible. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/262e3bb3-bc83-4d0b-8056-9f94ec141b8f?source=cve - https://ithemes.com/blog/wordpress-vulnerability-report-june-2021-part-5/#ib-toc-anchor-2 - https://wpscan.com/vulnerability/07259a61-8ba9-4dd0-8d52-cc1df389c0ad - https://sploitus.com/exploit?id=WPEX-ID:07259A61-8BA9-4DD0-8D52-CC1DF389C0AD - https://github.com/0xAgun/Arbitrary-File-Upload-ZoomSounds - https://codecanyon.net/item/zoomsounds-wordpress-wave-audio-player-with-playlist/6181433
CVE ID: CVE-2021-4450 State: PUBLISHED Published: 2024-10-16T06:43:37.936Z Last Updated: 2024-10-16T18:03:29.300Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: pickplugins Products: Post Grid and Gutenberg Blocks Problem Types: CWE-89 Description: The Post Grid plugin for WordPress is vulnerable to blind SQL Injection via post metadata in versions up to, and including, 2.1.12 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with contributor-level permissions and above to append additional SQL queries into already existing queries that c
ckers with contributor-level permissions and above to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a321b112-ce37-4a0e-800f-f3feef6ac799?source=cve - https://plugins.trac.wordpress.org/changeset/2644269
CVE ID: CVE-2021-4451 State: PUBLISHED Published: 2024-10-16T06:43:24.799Z Last Updated: 2024-10-16T19:07:11.134Z Severity: MEDIUM (CVSS 6.6 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: nintechnet Products: NinjaFirewall (WP Edition) – Advanced Security Plugin and Firewall Problem Types: CWE-502 Description: The NinjaFirewall plugin for WordPress is vulnerable to Authenticated PHAR Deserialization in versions up to, and including, 4.3.3. This allows authenticated attackers to perform phar deserialization on the server. This deserialization can allow other plugin or theme exploits if vulnerable software is present (WordPress, and NinjaFirewall). Additional Analyst Notes: - CISA ADP
r theme exploits if vulnerable software is present (WordPress, and NinjaFirewall). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/1a1fc6c9-50cd-40fd-a777-9eed98aab797?source=cve - https://blog.nintechnet.com/security-issue-fixed-in-ninjafirewall-wp-edition/
CVE ID: CVE-2021-4452 State: PUBLISHED Published: 2024-10-16T07:31:51.635Z Last Updated: 2024-10-16T12:58:35.587Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: edo888 Products: Translate WordPress – Google Language Translator Problem Types: CWE-79 Description: The Google Language Translator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via multiple parameters in versions up to, and including, 6.0.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clic
arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Specifically affects users with older browsers that lack proper URL encoding support. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/aa2bd74a-563a-4a2d-b1d7-b3678db82b00?source=cve - https://plugins.trac.wordpress.org/changeset/2567706 - https://plugins.trac.wordpress.org/changeset/2567703 - https://wpscan.com/vulnerability/1bd8bc19-5a6f-410b-897e-4887c05378ea
CVE ID: CVE-2021-4453 State: PUBLISHED Published: 2025-02-26T02:19:34.893Z Last Updated: 2025-10-01T19:46:38.846Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm/amd/pm: fix a potential gpu_metrics_table memory leak Memory is allocated for gpu_metrics_table in renoir_init_smc_tables(), but not freed in int smu_v12_0_fini_smc_tables(). Free it! Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/222cebd995cdf11fe0d502749560f65e64990e55 - https://git.kernel.org/stable/c/257b3bb16634fd936129fe2f57a91594a75b8751 - https://git.kernel.org/stable/c/aa464957f7e660abd554f2546a588f6533720e2
ble/c/257b3bb16634fd936129fe2f57a91594a75b8751 - https://git.kernel.org/stable/c/aa464957f7e660abd554f2546a588f6533720e21
CVE ID: CVE-2021-4454 State: PUBLISHED Published: 2025-03-27T16:37:09.381Z Last Updated: 2025-05-04T12:40:33.467Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: can: j1939: fix errant WARN_ON_ONCE in j1939_session_deactivate The conclusion "j1939_session_deactivate() should be called with a session ref-count of at least 2" is incorrect. In some concurrent scenarios, j1939_session_deactivate can be called with the session ref-count less than 2. But there is not any problem because it will check the session active state before session putting in j1939_session_deactivate_locked(). Here is the concurrent scenario of the problem rep
ve state before session putting in j1939_session_deactivate_locked(). Here is the concurrent scenario of the problem reported by syzbot and my reproduction log. cpu0 cpu1 j1939_xtp_rx_eoma j1939_xtp_rx_abort_one j1939_session_get_by_addr [kref == 2] j1939_session_get_by_addr [kref == 3] j1939_session_deactivate [kref == 2] j1939_session_put [kref == 1] j1939_session_completed j1939_session_deactivate WARN_ON_ONCE(kref < 2) ===================================================== WARNING: CPU: 1 PID: 21 at net/can/j1939/transport.c:1088 j1939_session_deactivate+0x5f/0x70 CPU: 1 PID: 21 Comm: ksoftirqd/1 Not tainted 5.14.0-rc7+ #32 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.
PID: 21 Comm: ksoftirqd/1 Not tainted 5.14.0-rc7+ #32 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1 04/01/2014 RIP: 0010:j1939_session_deactivate+0x5f/0x70 Call Trace: j1939_session_deactivate_activate_next+0x11/0x28 j1939_xtp_rx_eoma+0x12a/0x180 j1939_tp_recv+0x4a2/0x510 j1939_can_recv+0x226/0x380 can_rcv_filter+0xf8/0x220 can_receive+0x102/0x220 ? process_backlog+0xf0/0x2c0 can_rcv+0x53/0xf0 __netif_receive_skb_one_core+0x67/0x90 ? process_backlog+0x97/0x2c0 __netif_receive_skb+0x22/0x80 References: - https://git.kernel.org/stable/c/6950df42a03c9ac9290503ced3f371199cb68fa9 - https://git.kernel.org/stable/c/b6d44072117bba057d50f7a2f96e5d070c65926d - https://gi
a03c9ac9290503ced3f371199cb68fa9 - https://git.kernel.org/stable/c/b6d44072117bba057d50f7a2f96e5d070c65926d - https://git.kernel.org/stable/c/9ab896775f98ff54b68512f345eed178bf961084 - https://git.kernel.org/stable/c/1740a1e45eee65099a92fb502e1e67e63aad277d - https://git.kernel.org/stable/c/d0553680f94c49bbe0e39eb50d033ba563b4212d
CVE ID: CVE-2021-4455 State: PUBLISHED Published: 2025-04-19T07:23:39.405Z Last Updated: 2025-04-21T14:14:38.135Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Codeflist Products: Wordpress Plugin Smart Product Review Problem Types: CWE-434 Description: The Wordpress Plugin Smart Product Review plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in all versions up to, and including, 1.0.4. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - htt
rver which may make remote code execution possible. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/1de9183c-95b9-4500-85e2-08dcee956360?source=cve - https://www.exploit-db.com/exploits/50533
CVE ID: CVE-2021-4457 State: PUBLISHED Published: 2025-06-25T14:45:58.227Z Last Updated: 2025-07-01T19:09:26.039Z Vendors: Unknown Products: ZoomSounds Problem Types: CWE-434 Unrestricted Upload of File with Dangerous Type Description: The ZoomSounds plugin before 6.05 contains a PHP file allowing unauthenticated users to upload an arbitrary file anywhere on the web server. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/07259a61-8ba9-4dd0-8d52-cc1df389c0ad
CVE ID: CVE-2021-4458 State: PUBLISHED Published: 2025-07-12T11:23:39.379Z Last Updated: 2025-07-14T20:11:27.024Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: webnus/ Products: Modern Events Calendar Lite Problem Types: CWE-89 Description: The Modern Events Calendar Lite plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter of the 'wp_ajax_mec_load_single_page' AJAX action in all versions up to, and including, 6.3.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already e
existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This is only exploitable on sites with addslashes disabled. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/703ba736-5834-40f2-9cf6-a6a70a73e4d6?source=cve - https://plugins.trac.wordpress.org/changeset/2683727/modern-events-calendar-lite/trunk/app/libraries/render.php
CVE ID: CVE-2021-4459 State: PUBLISHED Published: 2025-08-27T08:00:35.837Z Last Updated: 2025-08-27T16:18:45.427Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: SMA Products: Boy 3.0, Boy 3.6, Boy 4.0, Boy 5.0, Boy 6.0 Problem Types: CWE-23 Description: An authorized remote attacker can access files and directories outside the intended web root, potentially exposing sensitive system information of the affected Sunny Boy devices. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://certvde.com/en/advisories/VDE-2025-066