Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-57846 State: PUBLISHED Published: 2025-08-27T05:28:42.925Z Last Updated: 2025-08-27T14:52:39.319Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Digital Arts Inc., Fujitsu Limited, OPTiM Corporation Products: i-フィルター 6.0, i-フィルター for マルチデバイス, i-フィルター for ZAQ, i-フィルター for ネットカフェ, i-FILTER ブラウザー＆クラウド MultiAgent for Windows, FENCE-Mobile RemoteManager i-FILTER Browser Service, Optimal Biz Web Filtering Powered by i-FILTER (Windows version) Problem Types: CWE-276 Description: Multiple i-フィルター products contain an issue with incorrect default permissions. If this vulnerability is exploited, a local authenticated attacker may replace a service execu
rect default permissions. If this vulnerability is exploited, a local authenticated attacker may replace a service executable on the system where the product is running, potentially allowing arbitrary code execution with SYSTEM privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.daj.jp/shared/php/downloadset/c/parts.php?page=dl&filename=information_20250827_01.pdf - https://www.daj.jp/shared/php/downloadset/c/parts.php?page=dl&filename=information_20250827_02.pdf - https://jvn.jp/en/jp/JVN55678602/
CVE ID: CVE-2025-57848 State: PUBLISHED Published: 2025-10-23T20:10:31.311Z Last Updated: 2025-11-06T23:40:27.728Z Severity: MEDIUM (CVSS 5.2 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:H/A:L) Vendors: Red Hat Products: Red Hat OpenShift Virtualization 4 Problem Types: CWE-276 Description: A container privilege escalation flaw was found in certain Container-native Virtualization images. This issue stems from the /etc/passwd file being created with group-writable permissions during build time. In certain conditions, an attacker who can execute commands within an affected container, even as a non-root user, can leverage their membership in the root group to modify the /etc/passwd file. This could a
r, even as a non-root user, can leverage their membership in the root group to modify the /etc/passwd file. This could allow the attacker to add a new user with any arbitrary UID, including UID 0, leading to full root privileges within the container. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.redhat.com/security/cve/CVE-2025-57848 - https://bugzilla.redhat.com/show_bug.cgi?id=2391099
CVE ID: CVE-2025-57852 State: PUBLISHED Published: 2025-09-30T14:37:10.024Z Last Updated: 2025-11-07T00:46:29.225Z Severity: MEDIUM (CVSS 5.2 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:H/A:L) Vendors: Red Hat Products: Red Hat OpenShift AI 2.16, Red Hat OpenShift AI 2.19, Red Hat OpenShift AI 2.21, Red Hat OpenShift AI 2.22, Red Hat OpenShift AI 2.24 Problem Types: CWE-276 Description: A container privilege escalation flaw was found in KServe ModelMesh container images. This issue stems from the /etc/passwd file being created with group-writable permissions during build time. In certain conditions, an attacker who can execute commands within an affected container, even as a non-root user, can le
n certain conditions, an attacker who can execute commands within an affected container, even as a non-root user, can leverage their membership in the root group to modify the /etc/passwd file. This could allow the attacker to add a new user with any arbitrary UID, including UID 0, leading to full root privileges within the container. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.redhat.com/errata/RHSA-2025:16981 - https://access.redhat.com/errata/RHSA-2025:16982 - https://access.redhat.com/errata/RHSA-2025:16983 - https://access.redhat.com/errata/RHSA-2025:16984 - https://access.redhat.com/errata/RHSA-2025:17501 - https://access.redhat.com/security/cve/CVE-
/errata/RHSA-2025:16984 - https://access.redhat.com/errata/RHSA-2025:17501 - https://access.redhat.com/security/cve/CVE-2025-57852 - https://bugzilla.redhat.com/show_bug.cgi?id=2391105
CVE ID: CVE-2025-57870 State: PUBLISHED Published: 2025-10-22T14:26:22.857Z Last Updated: 2025-10-23T03:55:33.519Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Esri Products: ArcGIS Server Problem Types: CWE-89 Description: A SQL Injection vulnerability exists in Esri ArcGIS Server versions 11.3, 11.4 and 11.5 on Windows, Linux and Kubernetes. This vulnerability allows a remote, unauthenticated attacker to execute arbitrary SQL commands via a specific ArcGIS Feature Service operation. Successful exploitation can potentially result in unauthorized access, modification, or deletion of data from the underlying Enterprise Geodatabase. Additional Analyst Note
authorized access, modification, or deletion of data from the underlying Enterprise Geodatabase. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/arcgis-server-feature-services-security-patch
CVE ID: CVE-2025-57871 State: PUBLISHED Published: 2025-09-29T18:39:13.631Z Last Updated: 2025-09-29T18:51:37.943Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) Vendors: Esri Products: Portal for ArcGIS Problem Types: CWE-79 Description: There is a reflected cross site scripting vulnerability in Esri Portal for ArcGIS 11.4 and below that may allow a remote authenticated attacker with administrative access to supply a crafted string which would execute arbitrary JavaScript code in the browser. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/portal-for-arcgis-security-2025-update-3
rences: - https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/portal-for-arcgis-security-2025-update-3-patch
CVE ID: CVE-2025-57872 State: PUBLISHED Published: 2025-09-29T18:38:34.529Z Last Updated: 2025-09-29T18:54:57.118Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Esri Products: Portal for ArcGIS Problem Types: CWE-601 Description: There is an unvalidated redirect vulnerability in Esri Portal for ArcGIS 11.4 and below that may allow a remote, unauthenticated attacker to craft a URL that could redirect a victim to an arbitrary website, simplifying phishing attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/portal-for-arcgis-security-2025-update-3-patch
CVE ID: CVE-2025-57873 State: PUBLISHED Published: 2025-09-29T18:37:54.701Z Last Updated: 2025-09-29T19:09:37.372Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) Vendors: Esri Products: Portal for ArcGIS Problem Types: CWE-79 Description: There is a reflected cross site scripting vulnerability in Esri Portal for ArcGIS 11.4 and below that may allow a remote authenticated attacker with administrative access to supply a crafted string which would execute arbitrary JavaScript code in the browser. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/portal-for-arcgis-security-2025-update-3
CVE ID: CVE-2025-57874 State: PUBLISHED Published: 2025-09-29T18:37:16.737Z Last Updated: 2025-09-29T19:11:05.059Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) Vendors: Esri Products: Portal for ArcGIS Problem Types: CWE-79 Description: There is a reflected cross site scripting vulnerability in Esri Portal for ArcGIS 11.4 and below that may allow a remote authenticated attacker with administrative access to supply a crafted string which would execute arbitrary JavaScript code in the browser. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/portal-for-arcgis-security-2025-update-3
CVE ID: CVE-2025-57875 State: PUBLISHED Published: 2025-09-29T18:35:34.753Z Last Updated: 2025-09-29T20:00:18.890Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) Vendors: Esri Products: Portal for ArcGIS Problem Types: CWE-79 Description: There is a reflected cross site scripting vulnerability in Esri Portal for ArcGIS 11.4 and below that may allow a remote authenticated attacker with administrative access to supply a crafted string which would execute arbitrary JavaScript code in the browser. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/portal-for-arcgis-security-2025-update-3
CVE ID: CVE-2025-57876 State: PUBLISHED Published: 2025-09-29T18:32:20.557Z Last Updated: 2025-09-29T19:52:16.857Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) Vendors: Esri Products: Portal for ArcGIS Problem Types: CWE-79 Description: There is a stored Cross-site Scripting vulnerability in Esri Portal for ArcGIS 11.4 and below that may allow a remote, authenticated attacker to inject malicious a file with an embedded xss script which when loaded could potentially execute arbitrary JavaScript code in the victim’s browser. The privileges required to execute this attack are high. The attack could disclose a privileged token which may result in the attacker gaining
to execute this attack are high. The attack could disclose a privileged token which may result in the attacker gaining full control of the Portal. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/portal-for-arcgis-security-2025-update-3-patch
CVE ID: CVE-2025-57877 State: PUBLISHED Published: 2025-09-29T18:34:59.201Z Last Updated: 2025-09-29T19:53:54.356Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) Vendors: Esri Products: Portal for ArcGIS Problem Types: CWE-79 Description: There is a reflected cross site scripting vulnerability in Esri Portal for ArcGIS 11.4 and below that may allow a remote authenticated attacker with administrative access to supply a crafted string which would execute arbitrary JavaScript code in the browser. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/portal-for-arcgis-security-2025-update-3
CVE ID: CVE-2025-57878 State: PUBLISHED Published: 2025-09-29T18:33:59.071Z Last Updated: 2025-09-29T19:53:18.268Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Esri Products: Portal for ArcGIS Problem Types: CWE-601 Description: There is an unvalidated redirect vulnerability in Esri Portal for ArcGIS 11.4 and below that may allow a remote, unauthenticated attacker to craft a URL that could redirect a victim to an arbitrary website, simplifying phishing attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/portal-for-arcgis-security-2025-update-3-patch
CVE ID: CVE-2025-57879 State: PUBLISHED Published: 2025-09-29T18:33:06.669Z Last Updated: 2025-09-29T19:52:42.354Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Esri Products: Portal for ArcGIS Problem Types: CWE-601 Description: There is an unvalidated redirect vulnerability in Esri Portal for ArcGIS 11.4 and below that may allow a remote, unauthenticated attacker to craft a URL that could redirect a victim to an arbitrary website, simplifying phishing attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/portal-for-arcgis-security-2025-update-3-patch
CVE ID: CVE-2025-57880 State: PUBLISHED Published: 2025-09-19T13:10:12.916Z Last Updated: 2025-09-19T13:56:35.076Z Vendors: Hallo Welt! GmbH Products: BlueSpice Problem Types: CWE-116 Description: Improper Encoding or Escaping of Output vulnerability in Hallo Welt! GmbH BlueSpice (Extension:BlueSpiceWhoIsOnline) allows Cross-Site Scripting (XSS). This issue affects BlueSpice: from 5 through 5.1.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://en.wiki.bluespice.com/wiki/Security:Security_Advisories/BSSA-2025-05
CVE ID: CVE-2025-57882 State: PUBLISHED Published: 2025-09-23T22:27:02.078Z Last Updated: 2025-09-24T14:05:58.599Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: AutomationDirect Products: CLICK PLUS C0-0x CPU firmware, CLICK PLUS C0-1x CPU firmware, CLICK PLUS C2-x CPU firmware Problem Types: CWE-404 Description: An improper resource shutdown or release vulnerability has been identified in the Click Plus C2-03CPU-2 device running firmware version 3.60. The vulnerability allows an unauthenticated attacker to perform a denial-of-service attack by exhausting all available device sessions in the Remote PLC application. Additional Analyst Notes: - CISA ADP Vuln
ack by exhausting all available device sessions in the Remote PLC application. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-25-266-01 - https://www.automationdirect.com/support/software-downloads
CVE ID: CVE-2025-57884 State: PUBLISHED Published: 2025-08-22T11:59:52.112Z Last Updated: 2025-08-22T13:27:49.370Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: wpsoul Products: Greenshift Problem Types: CWE-862 Description: Missing Authorization vulnerability in wpsoul Greenshift allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Greenshift: from n/a through 12.1.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/greenshift-animation-and-page-builder-blocks/vulnerability/wordpress-greenshift-plugin-12-1-1-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-57885 State: PUBLISHED Published: 2025-08-22T11:59:52.952Z Last Updated: 2025-08-22T13:29:18.900Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Shahjahan Jewel Products: Fluent Support Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Shahjahan Jewel Fluent Support allows Cross Site Request Forgery. This issue affects Fluent Support: from n/a through 1.9.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/fluent-support/vulnerability/wordpress-fluent-support-plugin-1-9-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2025-57886 State: PUBLISHED Published: 2025-08-22T11:59:53.722Z Last Updated: 2025-08-22T13:03:25.929Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) Vendors: Equalize Digital Products: Accessibility Checker by Equalize Digital Problem Types: CWE-639 Description: Authorization Bypass Through User-Controlled Key vulnerability in Equalize Digital Accessibility Checker by Equalize Digital allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Accessibility Checker by Equalize Digital: from n/a through 1.30.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin
.30.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/accessibility-checker/vulnerability/wordpress-accessibility-checker-by-equalize-digital-plugin-1-30-0-insecure-direct-object-references-idor-vulnerability?_s_id=cve
CVE ID: CVE-2025-57887 State: PUBLISHED Published: 2025-08-22T11:59:54.465Z Last Updated: 2025-08-22T13:03:08.106Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: NooTheme Products: Jobmonster Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NooTheme Jobmonster allows Stored XSS. This issue affects Jobmonster: from n/a through 4.8.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/theme/noo-jobmonster/vulnerability/wordpress-jobmonster-theme-4-8-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-57888 State: PUBLISHED Published: 2025-08-22T11:59:55.223Z Last Updated: 2025-08-22T13:00:57.741Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: NooTheme Products: Jobmonster Problem Types: CWE-497 Description: Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in NooTheme Jobmonster allows Retrieve Embedded Sensitive Data. This issue affects Jobmonster: from n/a through 4.8.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/theme/noo-jobmonster/vulnerability/wordpress-jobmonster-theme-4-8-0-sensitive-data-exposure-vulnerability?_s_id=cve
CVE ID: CVE-2025-57889 State: PUBLISHED Published: 2025-09-05T16:15:38.723Z Last Updated: 2025-09-05T18:39:47.104Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: RealMag777 Products: InPost Gallery Problem Types: CWE-98 Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in RealMag777 InPost Gallery allows PHP Local File Inclusion. This issue affects InPost Gallery: from n/a through 2.1.4.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/inpost-gallery/vulnerability/wordpress-inpost-gallery-plugin-2-1-4-5-local-file
patchstack.com/database/wordpress/plugin/inpost-gallery/vulnerability/wordpress-inpost-gallery-plugin-2-1-4-5-local-file-inclusion-vulnerability?_s_id=cve
CVE ID: CVE-2025-57890 State: PUBLISHED Published: 2025-08-22T11:59:55.966Z Last Updated: 2025-08-22T13:00:36.407Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Pierre Lannoy Products: Sessions Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pierre Lannoy Sessions allows Stored XSS. This issue affects Sessions: from n/a through 3.2.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/sessions/vulnerability/wordpress-sessions-plugin-3-2-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-57891 State: PUBLISHED Published: 2025-08-22T11:59:56.714Z Last Updated: 2025-08-22T13:00:15.345Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: wpecommerce Products: Recurring PayPal Donations Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpecommerce Recurring PayPal Donations allows Stored XSS. This issue affects Recurring PayPal Donations: from n/a through 1.8. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/recurring-donation/vulnerability/wordpress-recurring-paypal-donations-plugin
://patchstack.com/database/wordpress/plugin/recurring-donation/vulnerability/wordpress-recurring-paypal-donations-plugin-1-8-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-57892 State: PUBLISHED Published: 2025-08-22T11:59:57.464Z Last Updated: 2025-08-22T12:59:51.148Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Jeff Starr Products: Simple Statistics for Feeds Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Jeff Starr Simple Statistics for Feeds allows Cross Site Request Forgery. This issue affects Simple Statistics for Feeds: from n/a through 20250322. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/simple-feed-stats/vulnerability/wordpress-simple-statistics-for-feeds-plugin-20250322-cross-site-request
ordpress/plugin/simple-feed-stats/vulnerability/wordpress-simple-statistics-for-feeds-plugin-20250322-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2025-57893 State: PUBLISHED Published: 2025-08-22T11:59:58.108Z Last Updated: 2025-08-22T12:59:20.547Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Epsiloncool Products: WP Fast Total Search Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Epsiloncool WP Fast Total Search allows Cross Site Request Forgery. This issue affects WP Fast Total Search: from n/a through 1.79.270. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/fulltext-search/vulnerability/wordpress-wp-fast-total-search-plugin-1-79-270-cross-site-request-forgery-csrf-vulnerability?
ltext-search/vulnerability/wordpress-wp-fast-total-search-plugin-1-79-270-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2025-57894 State: PUBLISHED Published: 2025-08-22T11:59:58.767Z Last Updated: 2025-08-22T12:58:58.397Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: ollybach Products: WPPizza Problem Types: CWE-862 Description: Missing Authorization vulnerability in ollybach WPPizza allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WPPizza: from n/a through 3.19.8. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wppizza/vulnerability/wordpress-wppizza-plugin-3-19-8-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-57895 State: PUBLISHED Published: 2025-08-22T11:59:59.400Z Last Updated: 2025-08-22T12:58:17.701Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Hossni Mubarak Products: JobWP Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Hossni Mubarak JobWP allows Cross Site Request Forgery. This issue affects JobWP: from n/a through 2.4.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/jobwp/vulnerability/wordpress-jobwp-plugin-2-4-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2025-57896 State: PUBLISHED Published: 2025-08-22T12:00:03.838Z Last Updated: 2025-08-22T12:57:41.404Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: andy_moyle Products: Church Admin Problem Types: CWE-862 Description: Missing Authorization vulnerability in andy_moyle Church Admin allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Church Admin: from n/a through 5.0.26. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/church-admin/vulnerability/wordpress-church-admin-plugin-5-0-26-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-57898 State: PUBLISHED Published: 2025-09-22T18:25:29.576Z Last Updated: 2025-09-23T13:46:32.300Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Jose Vega Products: WP Frontend Admin Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jose Vega WP Frontend Admin allows Stored XSS. This issue affects WP Frontend Admin: from n/a through 1.22.6. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/display-admin-page-on-frontend/vulnerability/wordpress-wp-frontend-admin-plugin-1-22-6-cross-site-script
ordpress/plugin/display-admin-page-on-frontend/vulnerability/wordpress-wp-frontend-admin-plugin-1-22-6-cross-site-scripting-xss-vulnerability?_s_id=cve