Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
ient by sending a LOAD_LOCAL instruction packet. This issue has been patched in version 0.3.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/aio-libs/aiomysql/security/advisories/GHSA-r397-ff8c-wv2g - https://github.com/aio-libs/aiomysql/pull/1044 - https://github.com/aio-libs/aiomysql/commit/32c4520dae3711367ded74a4726dcb8bb8919538
CVE ID: CVE-2025-62612 State: PUBLISHED Published: 2025-10-22T20:45:17.363Z Last Updated: 2025-10-23T17:34:38.855Z Vendors: labring Products: FastGPT Problem Types: CWE-918 Description: FastGPT is an AI Agent building platform. Prior to version 4.11.1, in the workflow file reading node, the network link is not security-verified, posing a risk of SSRF attacks. This issue has been patched in version 4.11.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/labring/FastGPT/security/advisories/GHSA-573g-3567-8phg
CVE ID: CVE-2025-62613 State: PUBLISHED Published: 2025-10-22T20:52:57.758Z Last Updated: 2025-10-23T17:28:12.445Z Vendors: steveseguin Products: vdo.ninja Problem Types: CWE-79 Description: VDO.Ninja is a tool that brings remote video feeds into OBS or other studio software via WebRTC. From versions 28.0 to before 28.4, a reflected Cross-Site Scripting (XSS) vulnerability exists on examples/control.html through the room parameter, which is improperly sanitized before being rendered in the DOM. The application fails to validate and encode user input, allowing malicious scripts to be injected and executed. This issue has been patched in version 28.4. Additional Analyst Notes: - CISA ADP Vulnr
pts to be injected and executed. This issue has been patched in version 28.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/steveseguin/vdo.ninja/security/advisories/GHSA-mp9c-cpch-x73c - https://github.com/steveseguin/vdo.ninja/commit/83c0ac753ad60c7a086daced3244688cabd4f6b8 - https://github.com/steveseguin/vdo.ninja/releases/tag/v28.4
CVE ID: CVE-2025-62614 State: PUBLISHED Published: 2025-10-22T20:58:45.920Z Last Updated: 2025-10-23T16:32:27.787Z Vendors: booklore-app Products: booklore Problem Types: CWE-862 Description: BookLore is a self-hosted web app for organizing and managing personal book collections. In versions 1.8.1 and prior, an authentication bypass vulnerability in the BookMediaController allows any unauthenticated user to access and download book covers, thumbnails, and complete PDF/CBX page content without authorization. The vulnerability exists because multiple media endpoints lack proper access control annotations, and the CoverJwtFilter continues request processing even when no authentication token is
er access control annotations, and the CoverJwtFilter continues request processing even when no authentication token is provided. This enables attackers to enumerate and exfiltrate all book content from the system, bypassing the intended download permissions (canDownload) entirely. This issue has been patched via commit b226c43. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/booklore-app/booklore/security/advisories/GHSA-363g-fhcq-hvqp - https://github.com/booklore-app/booklore/commit/b226c43343cd0cef4c1cd54bc3dcdef90b147133
CVE ID: CVE-2025-62617 State: PUBLISHED Published: 2025-10-22T21:19:00.940Z Last Updated: 2025-10-23T16:17:28.926Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Admidio Products: admidio Problem Types: CWE-89 Description: Admidio is an open-source user management solution. Prior to version 4.3.17, an authenticated SQL injection vulnerability exists in the member assignment data retrieval functionality of Admidio. Any authenticated user with permissions to assign members to a role (such as an administrator) can exploit this vulnerability to execute arbitrary SQL commands. This can lead to a full compromise of the application's database, including reading, mod
execute arbitrary SQL commands. This can lead to a full compromise of the application's database, including reading, modifying, or deleting all data. This issue has been patched in version 4.3.17. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Admidio/admidio/security/advisories/GHSA-2v5m-cq9w-fc33 - https://github.com/Admidio/admidio/commit/fde81ae869e88a3cf42201f2548d57df785a37cb
CVE ID: CVE-2025-62618 State: PUBLISHED Published: 2025-10-31T18:31:06.652Z Last Updated: 2025-11-04T15:58:06.636Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: ELOG Products: ELOG Problem Types: CWE-434, CWE-79, CWE-836 Description: ELOG allows an authenticated user to upload arbitrary HTML files. The HTML content is executed in the context of other users when they open the file. Because ELOG includes usernames and password hashes in certain HTTP requests, an attacker can obtain the target's credentials and replay them or crack the password hash offline. In ELOG 3.1.5-20251014 release, HTML files are rendered as plain text. Additional Analyst Notes: - CISA AD
hash offline. In ELOG 3.1.5-20251014 release, HTML files are rendered as plain text. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bitbucket.org/ritt/elog/commits/f81e5695c40997322fe2713bfdeba459d9de09dc - https://elog.psi.ch/elog/download/RPMS/?C=M;O=D - https://bitbucket.org/ritt/elog/commits/7092ff64f6eb9521f8cc8c52272a020bf3730946 - https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-304-01.json - https://www.cve.org/CVERecord?id=CVE-2025-62618
CVE ID: CVE-2025-62626 State: PUBLISHED Published: 2025-11-21T18:52:57.206Z Last Updated: 2025-11-23T16:49:35.748Z Vendors: AMD Products: AMD Ryzen™ 9000HX Series Processors, AMD EPYC™ 9005 Series Processors Problem Types: CWE-333 Description: Improper handling of insufficient entropy in the AMD CPUs could allow a local attacker to influence the values returned by the RDSEED instruction, potentially resulting in the consumption of insufficiently random values. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-7055.html
CVE ID: CVE-2025-62630 State: PUBLISHED Published: 2025-11-06T22:27:14.439Z Last Updated: 2025-11-07T14:03:30.791Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Advantech Products: DeviceOn/iEdge Problem Types: CWE-22 Description: Due to insufficient sanitization, an attacker can upload a specially crafted configuration file to traverse directories and achieve remote code execution with system-level permissions. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-25-310-01 - https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2025/icsa-25-310-01.json - https://www.advantech.com/em
CVE ID: CVE-2025-62632 State: REJECTED Published: N/A Last Updated: 2025-10-18T02:55:09.135Z Description: No description available.
CVE ID: CVE-2025-62633 State: REJECTED Published: N/A Last Updated: 2025-10-18T02:55:08.659Z Description: No description available.
CVE ID: CVE-2025-62634 State: REJECTED Published: N/A Last Updated: 2025-10-18T02:55:08.164Z Description: No description available.
CVE ID: CVE-2025-62635 State: REJECTED Published: N/A Last Updated: 2025-10-18T02:55:07.657Z Description: No description available.
CVE ID: CVE-2025-62636 State: REJECTED Published: N/A Last Updated: 2025-10-18T02:55:07.190Z Description: No description available.
CVE ID: CVE-2025-62637 State: REJECTED Published: N/A Last Updated: 2025-10-18T02:55:06.692Z Description: No description available.
CVE ID: CVE-2025-62638 State: REJECTED Published: N/A Last Updated: 2025-10-18T02:55:06.109Z Description: No description available.
CVE ID: CVE-2025-62639 State: REJECTED Published: N/A Last Updated: 2025-10-18T02:55:05.578Z Description: No description available.
CVE ID: CVE-2025-62640 State: REJECTED Published: N/A Last Updated: 2025-10-18T02:55:05.038Z Description: No description available.
CVE ID: CVE-2025-62641 State: PUBLISHED Published: 2025-10-21T20:03:21.492Z Last Updated: 2025-10-23T03:55:32.652Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Oracle Corporation Products: Oracle VM VirtualBox Problem Types: Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. Description: Vulnerability in the Oracle VM VirtualBox produ
CVE ID: CVE-2025-62642 State: PUBLISHED Published: 2025-10-17T00:00:00.000Z Last Updated: 2025-10-29T15:10:42.934Z Severity: MEDIUM (CVSS 5.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N) Vendors: Restaurant Brands International Products: assistant platform Problem Types: CWE-862 Description: The Restaurant Brands International (RBI) assistant platform through 2025-09-06 has an "Anyone Can Join This Party" signup API that does not verify user account creation, allowing a remote unauthenticated attacker to create a user account. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.yahoo.com/news/articles/burger-king-hacked-attackers-impressed-124154038.html - https://w
ent: References: - https://www.yahoo.com/news/articles/burger-king-hacked-attackers-impressed-124154038.html - https://www.malwarebytes.com/blog/news/2025/09/popeyes-tim-hortons-burger-king-platforms-have-catastrophic-vulnerabilities-say-hackers - https://web.archive.org/web/20250906134240/https:/bobdahacker.com/blog/rbi-hacked-drive-thrus - https://bobdahacker.com/blog/rbi-hacked-drive-thrus/ - https://archive.today/fMYQp
CVE ID: CVE-2025-62643 State: PUBLISHED Published: 2025-10-17T00:00:00.000Z Last Updated: 2025-10-29T15:10:25.007Z Severity: LOW (CVSS 3.4 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N) Vendors: Restaurant Brands International Products: assistant platform Problem Types: CWE-319 Description: The Restaurant Brands International (RBI) assistant platform through 2025-09-06 transmits passwords of user accounts in cleartext e-mail messages. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.yahoo.com/news/articles/burger-king-hacked-attackers-impressed-124154038.html - https://www.malwarebytes.com/blog/news/2025/09/popeyes-tim-hortons-burger-king-platforms-have-catastrophi
4154038.html - https://www.malwarebytes.com/blog/news/2025/09/popeyes-tim-hortons-burger-king-platforms-have-catastrophic-vulnerabilities-say-hackers - https://web.archive.org/web/20250906134240/https:/bobdahacker.com/blog/rbi-hacked-drive-thrus - https://bobdahacker.com/blog/rbi-hacked-drive-thrus/ - https://archive.today/fMYQp
CVE ID: CVE-2025-62644 State: PUBLISHED Published: 2025-10-17T00:00:00.000Z Last Updated: 2025-10-29T15:06:50.943Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N) Vendors: Restaurant Brands International Products: assistant platform Problem Types: CWE-359 Description: The Restaurant Brands International (RBI) assistant platform through 2025-09-06 has a Global Store Directory that shares personal information among authenticated users. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.yahoo.com/news/articles/burger-king-hacked-attackers-impressed-124154038.html - https://www.malwarebytes.com/blog/news/2025/09/popeyes-tim-hortons-burger-king-pla
-attackers-impressed-124154038.html - https://www.malwarebytes.com/blog/news/2025/09/popeyes-tim-hortons-burger-king-platforms-have-catastrophic-vulnerabilities-say-hackers - https://web.archive.org/web/20250906134240/https:/bobdahacker.com/blog/rbi-hacked-drive-thrus - https://bobdahacker.com/blog/rbi-hacked-drive-thrus/ - https://archive.today/fMYQp
CVE ID: CVE-2025-62645 State: PUBLISHED Published: 2025-10-17T00:00:00.000Z Last Updated: 2025-10-29T15:06:31.954Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Restaurant Brands International Products: assistant platform Problem Types: CWE-266 Description: The Restaurant Brands International (RBI) assistant platform through 2025-09-06 allows a remote authenticated attacker to obtain a token with administrative privileges for the entire platform via the createToken GraphQL mutation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.yahoo.com/news/articles/burger-king-hacked-attackers-impressed-124154038.html - https://www.malwa
erences: - https://www.yahoo.com/news/articles/burger-king-hacked-attackers-impressed-124154038.html - https://www.malwarebytes.com/blog/news/2025/09/popeyes-tim-hortons-burger-king-platforms-have-catastrophic-vulnerabilities-say-hackers - https://web.archive.org/web/20250906134240/https:/bobdahacker.com/blog/rbi-hacked-drive-thrus - https://bobdahacker.com/blog/rbi-hacked-drive-thrus/ - https://archive.today/fMYQp
CVE ID: CVE-2025-62646 State: PUBLISHED Published: 2025-10-17T00:00:00.000Z Last Updated: 2025-10-29T15:06:11.229Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N) Vendors: Restaurant Brands International Products: assistant platform Problem Types: CWE-669 Description: The Restaurant Brands International (RBI) assistant platform through 2025-09-06 allows remote attackers to review the stored audio of conversations between associates and Drive Thru customers. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.yahoo.com/news/articles/burger-king-hacked-attackers-impressed-124154038.html - https://www.malwarebytes.com/blog/news/2025/09/popeyes-tim
icles/burger-king-hacked-attackers-impressed-124154038.html - https://www.malwarebytes.com/blog/news/2025/09/popeyes-tim-hortons-burger-king-platforms-have-catastrophic-vulnerabilities-say-hackers - https://web.archive.org/web/20250906134240/https:/bobdahacker.com/blog/rbi-hacked-drive-thrus - https://bobdahacker.com/blog/rbi-hacked-drive-thrus/ - https://archive.today/fMYQp
CVE ID: CVE-2025-62647 State: PUBLISHED Published: 2025-10-17T00:00:00.000Z Last Updated: 2025-10-29T15:05:52.777Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N) Vendors: Restaurant Brands International Products: assistant platform Problem Types: CWE-863 Description: The Restaurant Brands International (RBI) assistant platform through 2025-09-06 provides the functionality of returning a JWT that can be used to call an API to return a signed AWS upload URL, for any store's path. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.yahoo.com/news/articles/burger-king-hacked-attackers-impressed-124154038.html - https://www.malwarebytes.com/blog/ne
www.yahoo.com/news/articles/burger-king-hacked-attackers-impressed-124154038.html - https://www.malwarebytes.com/blog/news/2025/09/popeyes-tim-hortons-burger-king-platforms-have-catastrophic-vulnerabilities-say-hackers - https://web.archive.org/web/20250906134240/https:/bobdahacker.com/blog/rbi-hacked-drive-thrus - https://bobdahacker.com/blog/rbi-hacked-drive-thrus/ - https://archive.today/fMYQp
CVE ID: CVE-2025-62648 State: PUBLISHED Published: 2025-10-17T00:00:00.000Z Last Updated: 2025-10-29T15:05:19.028Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:L) Vendors: Restaurant Brands International Products: assistant platform Problem Types: CWE-863 Description: The Restaurant Brands International (RBI) assistant platform through 2025-09-06 allows remote attackers to adjust Drive Thru speaker audio volume. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.yahoo.com/news/articles/burger-king-hacked-attackers-impressed-124154038.html - https://www.malwarebytes.com/blog/news/2025/09/popeyes-tim-hortons-burger-king-platforms-have-catastro
-124154038.html - https://www.malwarebytes.com/blog/news/2025/09/popeyes-tim-hortons-burger-king-platforms-have-catastrophic-vulnerabilities-say-hackers - https://web.archive.org/web/20250906134240/https:/bobdahacker.com/blog/rbi-hacked-drive-thrus - https://bobdahacker.com/blog/rbi-hacked-drive-thrus/ - https://archive.today/fMYQp
CVE ID: CVE-2025-62649 State: PUBLISHED Published: 2025-10-17T00:00:00.000Z Last Updated: 2025-10-29T15:05:00.967Z Severity: MEDIUM (CVSS 5.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N) Vendors: Restaurant Brands International Products: assistant platform Problem Types: CWE-603 Description: The Restaurant Brands International (RBI) assistant platform through 2025-09-06 relies on client-side authentication for submission of equipment orders. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.yahoo.com/news/articles/burger-king-hacked-attackers-impressed-124154038.html - https://www.malwarebytes.com/blog/news/2025/09/popeyes-tim-hortons-burger-king-platforms-have-ca
ressed-124154038.html - https://www.malwarebytes.com/blog/news/2025/09/popeyes-tim-hortons-burger-king-platforms-have-catastrophic-vulnerabilities-say-hackers - https://web.archive.org/web/20250906134240/https:/bobdahacker.com/blog/rbi-hacked-drive-thrus - https://bobdahacker.com/blog/rbi-hacked-drive-thrus/ - https://archive.today/fMYQp
CVE ID: CVE-2025-62650 State: PUBLISHED Published: 2025-10-17T00:00:00.000Z Last Updated: 2025-10-29T15:04:44.015Z Severity: HIGH (CVSS 8.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L) Vendors: Restaurant Brands International Products: assistant platform Problem Types: CWE-603 Description: The Restaurant Brands International (RBI) assistant platform through 2025-09-06 relies on client-side authentication for use of the diagnostic screen. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.yahoo.com/news/articles/burger-king-hacked-attackers-impressed-124154038.html - https://www.malwarebytes.com/blog/news/2025/09/popeyes-tim-hortons-burger-king-platforms-have-catast
ed-124154038.html - https://www.malwarebytes.com/blog/news/2025/09/popeyes-tim-hortons-burger-king-platforms-have-catastrophic-vulnerabilities-say-hackers - https://web.archive.org/web/20250906134240/https:/bobdahacker.com/blog/rbi-hacked-drive-thrus - https://bobdahacker.com/blog/rbi-hacked-drive-thrus/ - https://archive.today/fMYQp
CVE ID: CVE-2025-62651 State: PUBLISHED Published: 2025-10-17T00:00:00.000Z Last Updated: 2025-10-29T15:04:30.228Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: Restaurant Brands International Products: assistant platform Problem Types: CWE-863 Description: The Restaurant Brands International (RBI) assistant platform through 2025-09-06 does not implement access control for the bathroom rating interface. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.yahoo.com/news/articles/burger-king-hacked-attackers-impressed-124154038.html - https://www.malwarebytes.com/blog/news/2025/09/popeyes-tim-hortons-burger-king-platforms-have-catast
CVE ID: CVE-2025-62652 State: PUBLISHED Published: 2025-10-17T22:15:26.903Z Last Updated: 2025-10-20T15:42:49.291Z Vendors: The Wikimedia Foundation Products: MediaWiki WebAuthn extension Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation MediaWiki WebAuthn extension allows Stored XSS.This issue affects MediaWiki WebAuthn extension: 1.39, 1.43, 1.44. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://phabricator.wikimedia.org/T403093
CVE ID: CVE-2025-62653 State: PUBLISHED Published: 2025-10-17T22:23:05.370Z Last Updated: 2025-10-20T15:31:14.332Z Vendors: The Wikimedia Foundation Products: MediaWiki PollNY extension Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation MediaWiki PollNY extension allows Stored XSS.This issue affects MediaWiki PollNY extension: 1.39, 1.43, 1.44. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://phabricator.wikimedia.org/T403923
CVE ID: CVE-2025-62654 State: PUBLISHED Published: 2025-10-17T22:38:54.033Z Last Updated: 2025-10-20T15:17:57.874Z Vendors: The Wikimedia Foundation Products: MediaWiki QuizGame extension Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation MediaWiki QuizGame extension allows Stored XSS.This issue affects MediaWiki QuizGame extension: 1.39, 1.43, 1.44. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://phabricator.wikimedia.org/T403924
CVE ID: CVE-2025-62655 State: PUBLISHED Published: 2025-10-17T22:46:28.849Z Last Updated: 2025-10-20T18:41:36.265Z Vendors: The Wikimedia Foundation Products: MediaWiki Cargo extension Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in The Wikimedia Foundation MediaWiki Cargo extension allows SQL Injection.This issue affects MediaWiki Cargo extension: 1.39, 1.43, 1.44. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://phabricator.wikimedia.org/T404016
CVE ID: CVE-2025-62656 State: PUBLISHED Published: 2025-10-20T20:15:14.947Z Last Updated: 2025-10-20T20:35:55.124Z Vendors: The Wikimedia Foundation Products: MediaWiki GlobalBlocking extension Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation MediaWiki GlobalBlocking extension allows Stored XSS.This issue affects MediaWiki GlobalBlocking extension: 1.43, 1.44. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://phabricator.wikimedia.org/T403291
CVE ID: CVE-2025-62657 State: PUBLISHED Published: 2025-10-20T20:19:32.576Z Last Updated: 2025-10-21T15:30:08.551Z Vendors: The Wikimedia Foundation Products: MediaWiki PageForms extension Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation MediaWiki PageForms extension allows Stored XSS.This issue affects MediaWiki PageForms extension: 1.44. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://phabricator.wikimedia.org/T405357
CVE ID: CVE-2025-62658 State: PUBLISHED Published: 2025-10-20T20:23:22.126Z Last Updated: 2025-10-21T15:29:00.585Z Vendors: The Wikimedia Foundation Products: MediaWiki WatchAnalytics extension Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in The Wikimedia Foundation MediaWiki WatchAnalytics extension allows SQL Injection.This issue affects MediaWiki WatchAnalytics extension: 1.43, 1.44. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://phabricator.wikimedia.org/T406380
CVE ID: CVE-2025-62659 State: PUBLISHED Published: 2025-10-22T15:31:28.899Z Last Updated: 2025-10-22T15:46:23.973Z Vendors: The Wikimedia Foundation Products: MediaWiki CookieConsent extension Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation MediaWiki CookieConsent extension allows Cross-Site Scripting (XSS).This issue affects MediaWiki CookieConsent extension: from v0.1.0 before v2.0.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://phabricator.wikimedia.org/T404475