Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-6758 State: PUBLISHED Published: 2025-08-19T06:45:27.412Z Last Updated: 2025-08-19T13:20:55.129Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: imithemes Products: Real Spaces - WordPress Properties Directory Theme Problem Types: CWE-269 Description: The Real Spaces - WordPress Properties Directory Theme theme for WordPress is vulnerable to privilege escalation via the 'imic_agent_register' function in all versions up to, and including, 3.6. This is due to a lack of restriction in the registration role. This makes it possible for unauthenticated attackers to arbitrarily choose their role, including the Administrator role, during user regi
sible for unauthenticated attackers to arbitrarily choose their role, including the Administrator role, during user registration. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e2b24858-dfcd-46f3-9552-c7acc63a1ee7?source=cve - https://themeforest.net/item/real-spaces-wordpress-real-estate-theme/8219779
CVE ID: CVE-2025-6759 State: PUBLISHED Published: 2025-07-08T21:41:21.902Z Last Updated: 2025-07-10T03:55:59.944Z Vendors: Citrix Products: Windows Virtual Delivery Agent for CVAD and Citrix DaaS Problem Types: CWE-269 Description: Local Privilege escalation allows a low-privileged user to gain SYSTEM privileges in Windows Virtual Delivery Agent for CVAD and Citrix DaaS Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX694820
CVE ID: CVE-2025-6761 State: PUBLISHED Published: 2025-06-27T10:31:09.400Z Last Updated: 2025-06-27T13:27:41.726Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:OF/RC:C) Vendors: Kingdee Products: Cloud-Starry-Sky Enterprise Edition Problem Types: CWE-1336, CWE-791 Description: A vulnerability was found in Kingdee Cloud-Starry-Sky Enterprise Edition 6.x/7.x/8.x/9.0. It has been rated as critical. Affected by this issue is the function plugin.buildMobilePopHtml of the file \k3\o2o\bos\webapp\action\DynamicForm 4 Action.class of the component Freemarker Engine. The manipulation leads to improper neutralization of special elements used in a template engine. The attack may be launch
he manipulation leads to improper neutralization of special elements used in a template engine. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component. The vendor explains, that in the fixed release "Freemarker is set to 'ALLOWS_NOTHING_RESOLVER' to not parse any classes." Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.314072 - https://vuldb.com/?ctiid.314072 - https://vuldb.com/?submit.601207 - https://vip.kingdee.com/link/s/ZlWX7 - https://vip.kingdee.com/school/detail/713028702245944320
CVE ID: CVE-2025-6762 State: PUBLISHED Published: 2025-06-27T11:31:05.144Z Last Updated: 2025-06-27T13:17:32.610Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: diyhi Products: bbs Problem Types: CWE-918 Description: A vulnerability classified as critical has been found in diyhi bbs up to 6.8. This affects the function getUrl of the file /admin/login of the component HTTP Header Handler. The manipulation of the argument Host leads to server-side request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.3140
the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.314073 - https://vuldb.com/?ctiid.314073 - https://vuldb.com/?submit.598896 - https://github.com/ShenxiuSec/cve-proofs/blob/main/POC-20250618-02.md - https://github.com/ShenxiuSec/cve-proofs/blob/main/POC-20250618-02.md#steps-to-reproduce
CVE ID: CVE-2025-6763 State: PUBLISHED Published: 2025-06-27T11:31:06.813Z Last Updated: 2025-10-08T18:53:18.593Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:W/RC:C) Vendors: Comet System Products: T0510, T3510, T3511, T4511, T6640, T7511, T7611, P8510, P8552, H3531 Problem Types: CWE-306, CWE-287 Description: A vulnerability was found in Comet System T0510, T3510, T3511, T4511, T6640, T7511, T7611, P8510, P8552 and H3531 1.60. Affected by this issue is some unknown functionality of the file /setupA.cfg of the component Web-based Management Interface. Performing manipulation results in missing authentication. The attack may be initiated remotely. A high degre
Interface. Performing manipulation results in missing authentication. The attack may be initiated remotely. A high degree of complexity is needed for the attack. The exploitation is known to be difficult. The exploit has been made public and could be used. There are still doubts about whether this vulnerability truly exists. The vendor explains, that "[d]evices described at CVE are not intended to be exposed into internet and proper security of devices is to end-users." Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.314074 - https://vuldb.com/?ctiid.314074 - https://vuldb.com/?submit.599848 - https://github.com/zeke2997/CVE_request_comet_system - https
uldb.com/?ctiid.314074 - https://vuldb.com/?submit.599848 - https://github.com/zeke2997/CVE_request_comet_system - https://github.com/zeke2997/CVE_request_comet_system#poc
CVE ID: CVE-2025-6765 State: PUBLISHED Published: 2025-06-27T12:00:15.432Z Last Updated: 2025-06-27T13:00:14.193Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: Intelbras Products: InControl Problem Types: CWE-275, CWE-266 Description: A vulnerability, which was classified as critical, has been found in Intelbras InControl 2.21.60.9. This issue affects some unknown processing of the file /v1/operador/ of the component HTTP PUT Request Handler. The manipulation leads to permission issues. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in
een disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.314075 - https://vuldb.com/?ctiid.314075 - https://vuldb.com/?submit.599873 - https://vuldb.com/?submit.599880
CVE ID: CVE-2025-6766 State: PUBLISHED Published: 2025-06-27T12:31:05.726Z Last Updated: 2025-06-27T12:58:38.758Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: sfturing Products: hosp_order Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8. It has been declared as critical. This vulnerability affects the function getOfficeName of the file OfficeServiceImpl.java. The manipulation of the argument officesName leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. This product is using a rolling release to p
ted remotely. The exploit has been disclosed to the public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.314080 - https://vuldb.com/?ctiid.314080 - https://vuldb.com/?submit.600529 - https://github.com/sfturing/hosp_order/issues/108
CVE ID: CVE-2025-6767 State: PUBLISHED Published: 2025-06-27T13:00:17.084Z Last Updated: 2025-06-27T13:36:03.167Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: sfturing Products: hosp_order Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8. It has been rated as critical. This issue affects the function findDoctorByCondition of the file DoctorServiceImpl.java. The manipulation of the argument hospitalName leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. This product takes the approach of rolling rel
d remotely. The exploit has been disclosed to the public and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.314081 - https://vuldb.com/?ctiid.314081 - https://vuldb.com/?submit.600547 - https://github.com/sfturing/hosp_order/issues/109
CVE ID: CVE-2025-6768 State: PUBLISHED Published: 2025-06-27T13:31:05.138Z Last Updated: 2025-06-27T13:40:51.989Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: sfturing Products: hosp_order Problem Types: CWE-89, CWE-74 Description: A vulnerability classified as critical has been found in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8. Affected is the function findAllHosByCondition of the file HospitalServiceImpl.java. The manipulation of the argument hospitalName leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is u
k remotely. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.314082 - https://vuldb.com/?ctiid.314082 - https://vuldb.com/?submit.601081 - https://github.com/sfturing/hosp_order/issues/110
CVE ID: CVE-2025-6769 State: PUBLISHED Published: 2025-09-12T06:05:44.797Z Last Updated: 2025-09-12T17:18:18.621Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: GitLab Products: GitLab Problem Types: CWE-497 Description: An issue has been discovered in GitLab CE/EE affecting all versions from 15.1 before 18.1.6, 18.2 before 18.2.6, and 18.3 before 18.3.2 that could have allowed authenticated users to view administrator-only maintenance notes by accessing runner details through specific interfaces. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://about.gitlab.com/releases/2025/09/10/patch-release-gitlab-18-3-2-released/ - https://gitl
ichment: References: - https://about.gitlab.com/releases/2025/09/10/patch-release-gitlab-18-3-2-released/ - https://gitlab.com/gitlab-org/gitlab/-/issues/551957 - https://hackerone.com/reports/3173328
CVE ID: CVE-2025-6770 State: PUBLISHED Published: 2025-07-08T15:02:57.754Z Last Updated: 2025-07-08T20:38:57.238Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Ivanti Products: Endpoint Manager Mobile Problem Types: CWE-78 Description: OS command injection in Ivanti Endpoint Manager Mobile (EPMM) before version 12.5.0.2 allows a remote authenticated attacker with high privileges to achieve remote code execution Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Endpoint-Manager-Mobile-EPMM-CVE-2025-6770-CVE-2025-6771?language=en_US
CVE ID: CVE-2025-6771 State: PUBLISHED Published: 2025-07-08T15:38:48.637Z Last Updated: 2025-07-09T14:14:49.148Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Ivanti Products: Endpoint Manager Mobile Problem Types: CWE-78 Description: OS command injection in Ivanti Endpoint Manager Mobile (EPMM) before version 12.5.0.2,12.4.0.3 and 12.3.0.3 allows a remote authenticated attacker with high privileges to achieve remote code execution Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Endpoint-Manager-Mobile-EPMM-CVE-2025-6770-CVE-2025-6771?language=en_US
CVE ID: CVE-2025-6772 State: PUBLISHED Published: 2025-06-27T18:31:05.585Z Last Updated: 2025-06-27T19:06:42.576Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: eosphoros-ai Products: db-gpt Problem Types: CWE-22 Description: A vulnerability was found in eosphoros-ai db-gpt up to 0.7.2. It has been classified as critical. Affected is the function import_flow of the file /api/v2/serve/awel/flow/import. The manipulation of the argument File leads to path traversal. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.31408
the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.314088 - https://vuldb.com/?ctiid.314088 - https://vuldb.com/?submit.601028 - https://github.com/eosphoros-ai/DB-GPT/issues/2774
CVE ID: CVE-2025-6773 State: PUBLISHED Published: 2025-06-27T19:00:17.695Z Last Updated: 2025-06-27T19:21:27.100Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C) Vendors: HKUDS Products: LightRAG Problem Types: CWE-22 Description: A vulnerability was found in HKUDS LightRAG up to 1.3.8. It has been declared as critical. Affected by this vulnerability is the function upload_to_input_dir of the file lightrag/api/routers/document_routes.py of the component File Upload. The manipulation of the argument file.filename leads to path traversal. It is possible to launch the attack on the local host. The identifier of the patch is 60777d535b719631680bcf5d0969bdef
. It is possible to launch the attack on the local host. The identifier of the patch is 60777d535b719631680bcf5d0969bdef79ca4eaf. It is recommended to apply a patch to fix this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.314089 - https://vuldb.com/?ctiid.314089 - https://vuldb.com/?submit.601276 - https://github.com/HKUDS/LightRAG/issues/1692 - https://github.com/HKUDS/LightRAG/issues/1692#issuecomment-3009368235 - https://github.com/HKUDS/LightRAG/commit/60777d535b719631680bcf5d0969bdef79ca4eaf
CVE ID: CVE-2025-6774 State: PUBLISHED Published: 2025-06-27T19:31:06.848Z Last Updated: 2025-06-27T19:40:48.771Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C) Vendors: gooaclok819 Products: sublinkX Problem Types: CWE-22 Description: A vulnerability was found in gooaclok819 sublinkX up to 1.8. It has been rated as critical. Affected by this issue is the function AddTemp of the file api/template.go. The manipulation of the argument filename leads to path traversal. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.9 is able to address this issue. The patch is identified as 778d26aef723daa58df98c806
ay be used. Upgrading to version 1.9 is able to address this issue. The patch is identified as 778d26aef723daa58df98c8060c43f5bf5d1b10b. It is recommended to upgrade the affected component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.314090 - https://vuldb.com/?ctiid.314090 - https://vuldb.com/?submit.602369 - https://github.com/gooaclok819/sublinkX/issues/69 - https://github.com/gooaclok819/sublinkX/issues/68#issuecomment-2957290524 - https://github.com/gooaclok819/sublinkX/commit/778d26aef723daa58df98c8060c43f5bf5d1b10b - https://github.com/gooaclok819/sublinkX/releases/tag/1.9
CVE ID: CVE-2025-6775 State: PUBLISHED Published: 2025-06-27T20:00:20.538Z Last Updated: 2025-06-27T20:15:17.511Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C) Vendors: xiaoyunjie Products: openvpn-cms-flask Problem Types: CWE-77, CWE-74 Description: A vulnerability classified as critical has been found in xiaoyunjie openvpn-cms-flask up to 1.2.7. This affects the function create_user of the file /app/api/v1/openvpn.py of the component User Creation Endpoint. The manipulation of the argument Username leads to command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.2.8 is abl
ate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.2.8 is able to address this issue. The patch is named e23559b98c8ea2957f09978c29f4e512ba789eb6. It is recommended to upgrade the affected component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.314091 - https://vuldb.com/?ctiid.314091 - https://vuldb.com/?submit.602373 - https://github.com/xiaoyunjie/openvpn-cms-flask/issues/24 - https://github.com/xiaoyunjie/openvpn-cms-flask/issues/24#issuecomment-2948563464 - https://github.com/xiaoyunjie/openvpn-cms-flask/commit/e23559b98c8ea2957f09978c29f4e512ba789eb6 - https://github.com/xiaoyunjie/open
ub.com/xiaoyunjie/openvpn-cms-flask/commit/e23559b98c8ea2957f09978c29f4e512ba789eb6 - https://github.com/xiaoyunjie/openvpn-cms-flask/releases/tag/v1.2.8
CVE ID: CVE-2025-6776 State: PUBLISHED Published: 2025-06-27T20:00:22.320Z Last Updated: 2025-06-27T20:11:41.582Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:OF/RC:C) Vendors: xiaoyunjie Products: openvpn-cms-flask Problem Types: CWE-22 Description: A vulnerability classified as critical was found in xiaoyunjie openvpn-cms-flask up to 1.2.7. This vulnerability affects the function Upload of the file app/plugins/oss/app/controller.py of the component File Upload. The manipulation of the argument image leads to path traversal. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.2.8 is able to address this is
ely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.2.8 is able to address this issue. The name of the patch is e23559b98c8ea2957f09978c29f4e512ba789eb6. It is recommended to upgrade the affected component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.314092 - https://vuldb.com/?ctiid.314092 - https://vuldb.com/?submit.602374 - https://github.com/xiaoyunjie/openvpn-cms-flask/issues/23 - https://github.com/xiaoyunjie/openvpn-cms-flask/commit/e23559b98c8ea2957f09978c29f4e512ba789eb6 - https://github.com/xiaoyunjie/openvpn-cms-flask/releases/tag/v1.2.8
CVE ID: CVE-2025-6777 State: PUBLISHED Published: 2025-06-27T20:31:05.431Z Last Updated: 2025-06-27T20:46:34.445Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: Food Distributor Site Problem Types: CWE-89, CWE-74 Description: A vulnerability, which was classified as critical, has been found in code-projects Food Distributor Site 1.0. This issue affects some unknown processing of the file /admin/process_login.php. The manipulation of the argument username/password leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: R
tely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.314093 - https://vuldb.com/?ctiid.314093 - https://vuldb.com/?submit.602598 - https://github.com/fubxx/CVE/blob/main/Food%20Distributor%20system%20SQL1.md - https://code-projects.org/
CVE ID: CVE-2025-6778 State: PUBLISHED Published: 2025-06-27T20:31:07.532Z Last Updated: 2025-06-27T20:42:27.350Z Severity: N/A (CVSS 3.3 AV:N/AC:L/Au:M/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: Food Distributor Site Problem Types: CWE-79, CWE-94 Description: A vulnerability, which was classified as problematic, was found in code-projects Food Distributor Site 1.0. Affected is an unknown function of the file /admin/save_settings.php. The manipulation of the argument site_phone/site_email/address leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP V
he attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.314094 - https://vuldb.com/?ctiid.314094 - https://vuldb.com/?submit.602600 - https://vuldb.com/?submit.602601 - https://vuldb.com/?submit.602602 - https://github.com/fubxx/CVE/blob/main/Food%20Distributor%20system%20XSS%202.md - https://github.com/fubxx/CVE/blob/main/Food%20Distributor%20system%20XSS%203.md - https://code-projects.org/
CVE ID: CVE-2025-6779 State: PUBLISHED Published: 2025-11-11T07:05:51.357Z Last Updated: 2025-11-12T04:57:47.240Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Axis Communications AB Products: AXIS OS Problem Types: CWE-732 Description: An ACAP configuration file has improper permissions, which could allow command injection and potentially lead to privilege escalation. This vulnerability can only be exploited if the Axis device is configured to allow the installation of unsigned ACAP applications, and if an attacker convinces the victim to install a malicious ACAP application. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.axi
o install a malicious ACAP application. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.axis.com/dam/public/92/9a/13/cve-2025-6779pdf-en-US-504217.pdf
CVE ID: CVE-2025-6781 State: PUBLISHED Published: 2025-07-18T04:23:03.205Z Last Updated: 2025-07-18T14:56:32.945Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: ryanfaber Products: Copymatic – AI Content Writer & Generator Problem Types: CWE-352 Description: The Copymatic – AI Content Writer & Generator plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1. This is due to missing or incorrect nonce validation on the 'copymatic-menu' page. This makes it possible for unauthenticated attackers to update the copymatic_apikey option via a forged request granted they can trick a site administrator into performi
ers to update the copymatic_apikey option via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f18b1276-3f43-447d-8251-095c2dd57938?source=cve - https://wordpress.org/plugins/copymatic/
CVE ID: CVE-2025-6782 State: PUBLISHED Published: 2025-07-04T01:44:05.670Z Last Updated: 2025-07-07T15:02:04.183Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: optinlyhq Products: GoZen Forms Problem Types: CWE-89 Description: The GoZen Forms plugin for WordPress is vulnerable to SQL Injection via the 'forms-id' parameter of the dirGZActiveForm() function in all versions up to, and including, 1.1.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extrac
for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d874a041-1cd4-4ca1-85bd-4050630d8502?source=cve - https://wordpress.org/plugins/gozen-forms/