Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-7611 State: PUBLISHED Published: 2025-07-14T14:14:05.635Z Last Updated: 2025-07-14T14:51:33.033Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: Wedding Reservation Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in code-projects Wedding Reservation 1.0. It has been classified as critical. This affects an unknown part of the file /global.php. The manipulation of the argument lu leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.31631
the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.316311 - https://vuldb.com/?ctiid.316311 - https://vuldb.com/?submit.615362 - https://github.com/zzb1388/cve/issues/16 - https://code-projects.org/
CVE ID: CVE-2025-7612 State: PUBLISHED Published: 2025-07-14T14:32:05.065Z Last Updated: 2025-07-14T14:46:36.526Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: Mobile Shop Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in code-projects Mobile Shop 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /login.php. The manipulation of the argument email leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.316312 - https://vul
may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.316312 - https://vuldb.com/?ctiid.316312 - https://vuldb.com/?submit.615363 - https://github.com/zzb1388/cve/issues/21 - https://code-projects.org/
CVE ID: CVE-2025-7613 State: PUBLISHED Published: 2025-07-14T14:44:08.080Z Last Updated: 2025-07-14T15:06:28.189Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: TOTOLINK Products: T6 Problem Types: CWE-77, CWE-74 Description: A vulnerability was found in TOTOLINK T6 4.1.5cu.748. It has been rated as critical. This issue affects the function CloudSrvVersionCheck of the file /cgi-bin/cstecgi.cgi of the component HTTP POST Request Handler. The manipulation of the argument ip leads to command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References:
xploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.316313 - https://vuldb.com/?ctiid.316313 - https://vuldb.com/?submit.615367 - https://github.com/ElvisBlue/Public/blob/main/Vuln/4.md - https://github.com/ElvisBlue/Public/blob/main/Vuln/4.md#poc - https://www.totolink.net/
CVE ID: CVE-2025-7614 State: PUBLISHED Published: 2025-07-14T15:02:09.650Z Last Updated: 2025-07-15T19:51:33.281Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: TOTOLINK Products: T6 Problem Types: CWE-77, CWE-74 Description: A vulnerability classified as critical has been found in TOTOLINK T6 4.1.5cu.748. Affected is the function delDevice of the file /cgi-bin/cstecgi.cgi of the component HTTP POST Request Handler. The manipulation of the argument ipAddr leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https:/
s been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.316314 - https://vuldb.com/?ctiid.316314 - https://vuldb.com/?submit.615368 - https://github.com/ElvisBlue/Public/blob/main/Vuln/5.md - https://github.com/ElvisBlue/Public/blob/main/Vuln/5.md#poc - https://www.totolink.net/
CVE ID: CVE-2025-7615 State: PUBLISHED Published: 2025-07-14T15:14:06.624Z Last Updated: 2025-07-14T15:35:45.427Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: TOTOLINK Products: T6 Problem Types: CWE-77, CWE-74 Description: A vulnerability classified as critical was found in TOTOLINK T6 4.1.5cu.748. Affected by this vulnerability is the function clearPairCfg of the file /cgi-bin/cstecgi.cgi of the component HTTP POST Request Handler. The manipulation of the argument ip leads to command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: -
loit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.316315 - https://vuldb.com/?ctiid.316315 - https://vuldb.com/?submit.615369 - https://github.com/ElvisBlue/Public/blob/main/Vuln/6.md - https://github.com/ElvisBlue/Public/blob/main/Vuln/6.md#poc - https://www.totolink.net/
CVE ID: CVE-2025-7616 State: PUBLISHED Published: 2025-07-14T15:32:12.150Z Last Updated: 2025-07-15T19:51:27.186Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R) Vendors: gmg137 Products: snap7-rs Problem Types: CWE-119 Description: A vulnerability, which was classified as critical, has been found in gmg137 snap7-rs up to 1.142.1. Affected by this issue is the function pthread_cond_destroy of the component Public API. The manipulation leads to memory corruption. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.316316 - https://vuldb.com/?ctiid.316316 - ht
nalyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.316316 - https://vuldb.com/?ctiid.316316 - https://gitee.com/gmg137/snap7-rs/issues/ICBIOB
CVE ID: CVE-2025-7618 State: PUBLISHED Published: 2025-07-14T10:15:10.892Z Last Updated: 2025-07-14T13:36:07.832Z Vendors: ASUSTOR Products: ADM Problem Types: CWE-79 Description: A stored Cross-Site Scripting (XSS) vulnerability vulnerability was found in the File Explorer and Text Editor of ADM. An attacker could exploit this vulnerability to inject malicious scripts into the applications, which may then access cookies or other sensitive information retained by the browser and used with the affected applications. Affected products and versions include: from ADM 4.1.0 to ADM 4.3.3.RH61 as well as ADM 5.0.0.RIN1 and earlier, and Text Editor 1.0.0.r112 and earlier. Additional Analyst Notes: -
DM 4.3.3.RH61 as well as ADM 5.0.0.RIN1 and earlier, and Text Editor 1.0.0.r112 and earlier. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.asustor.com/security/security_advisory_detail?id=45
CVE ID: CVE-2025-7619 State: PUBLISHED Published: 2025-07-14T03:00:59.905Z Last Updated: 2025-07-14T13:53:40.930Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: WellChoose Products: BatchSignCS Problem Types: CWE-23 Description: BatchSignCS, a background Windows application developed by WellChoose, has an Arbitrary File Write vulnerability. If a user visits a malicious website while the application is running, remote attackers can write arbitrary files to any path and potentially lead to arbitrary code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-10239-770ab-1.html - https://www.twcert.org.tw/
CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-10239-770ab-1.html - https://www.twcert.org.tw/en/cp-139-10240-00f86-2.html
CVE ID: CVE-2025-7620 State: PUBLISHED Published: 2025-07-14T03:16:00.409Z Last Updated: 2025-07-14T17:12:34.965Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: DSIC Products: Cross-browser Components for Official Document Creation Problem Types: CWE-494 Description: The cross-browser document creation component produced by Digitware System Integration Corporation has a Remote Code Execution vulnerability. If a user visits a malicious website while the component is active, remote attackers can cause the system to download and execute arbitrary programs. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-10241-
ry programs. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-10241-2ec07-1.html - https://www.twcert.org.tw/en/cp-139-10242-5ab42-2.html
CVE ID: CVE-2025-7622 State: PUBLISHED Published: 2025-08-12T05:09:23.834Z Last Updated: 2025-08-12T17:59:32.228Z Vendors: Axis Communications AB Products: AXIS Camera Station Pro, AXIS Camera Station Problem Types: CWE-918 Description: During an internal security assessment, a Server-Side Request Forgery (SSRF) vulnerability that allowed an authenticated attacker to access internal resources on the server was discovered. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.axis.com/dam/public/c5/9a/3c/cve-2025-7622pdf-en-US-492761.pdf
CVE ID: CVE-2025-7623 State: PUBLISHED Published: 2025-11-18T07:05:21.640Z Last Updated: 2025-11-18T16:15:33.824Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) Vendors: SMCI Products: MBD-X13SEDW-F Problem Types: CWE-121 Description: Stack-based buffer overflow in the SMASH-CLP shell. An authenticated attacker with SSH access to the BMC can exploit a stack buffer overflow via a crafted SMASH command, overwrite the return address and registers, and achieve arbitrary code execution on the BMC firmware operating system Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.supermicro.com/zh_tw/support/security_BMC_IPMI_Nov_2025
CVE ID: CVE-2025-7624 State: PUBLISHED Published: 2025-07-21T13:24:37.724Z Last Updated: 2025-07-21T15:04:55.287Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Sophos Products: Sophos Firewall Problem Types: CWE-89 Description: An SQL injection vulnerability in the legacy (transparent) SMTP proxy of Sophos Firewall versions older than 21.0 MR2 (21.0.2) can lead to remote code execution, if a quarantining policy is active for Email and SFOS was upgraded from a version older than 21.0 GA. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.sophos.com/en-us/security-advisories/sophos-sa-20250721-sfos-rce
CVE ID: CVE-2025-7625 State: PUBLISHED Published: 2025-07-14T16:14:05.423Z Last Updated: 2025-07-15T19:51:21.241Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R) Vendors: YiJiuSmile Products: kkFileViewOfficeEdit Problem Types: CWE-22 Description: A vulnerability, which was classified as critical, was found in YiJiuSmile kkFileViewOfficeEdit up to 5fbc57c48e8fe6c1b91e0e7995e2d59615f37abd. Affected is the function Download of the file /download. The manipulation of the argument url leads to path traversal. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases
ttack remotely. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.316326 - https://vuldb.com/?ctiid.316326 - https://vuldb.com/?submit.609076 - https://github.com/YiJiuSmile/kkFileViewOfficeEdit/issues/12
CVE ID: CVE-2025-7626 State: PUBLISHED Published: 2025-07-14T17:02:05.706Z Last Updated: 2025-07-14T17:26:17.208Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R) Vendors: YiJiuSmile Products: kkFileViewOfficeEdit Problem Types: CWE-22 Description: A vulnerability has been found in YiJiuSmile kkFileViewOfficeEdit up to 5fbc57c48e8fe6c1b91e0e7995e2d59615f37abd and classified as critical. Affected by this vulnerability is the function onlinePreview of the file /onlinePreview. The manipulation of the argument url leads to path traversal. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This product does not
he attack can be launched remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.316327 - https://vuldb.com/?ctiid.316327 - https://vuldb.com/?submit.609078 - https://github.com/YiJiuSmile/kkFileViewOfficeEdit/issues/13
CVE ID: CVE-2025-7627 State: PUBLISHED Published: 2025-07-14T17:44:05.999Z Last Updated: 2025-07-14T17:53:49.290Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: YiJiuSmile Products: kkFileViewOfficeEdit Problem Types: CWE-434, CWE-284 Description: A vulnerability was found in YiJiuSmile kkFileViewOfficeEdit up to 5fbc57c48e8fe6c1b91e0e7995e2d59615f37abd and classified as critical. Affected by this issue is the function fileUpload of the file /fileUpload. The manipulation of the argument File leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. This product is using a rolling release to
nched remotely. The exploit has been disclosed to the public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.316328 - https://vuldb.com/?ctiid.316328 - https://vuldb.com/?submit.609095 - https://github.com/YiJiuSmile/kkFileViewOfficeEdit/issues/14
CVE ID: CVE-2025-7628 State: PUBLISHED Published: 2025-07-14T18:02:05.305Z Last Updated: 2025-07-14T18:24:14.568Z Severity: N/A (CVSS 5.5 AV:N/AC:L/Au:S/C:N/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: YiJiuSmile Products: kkFileViewOfficeEdit Problem Types: CWE-22 Description: A vulnerability was found in YiJiuSmile kkFileViewOfficeEdit up to 5fbc57c48e8fe6c1b91e0e7995e2d59615f37abd. It has been classified as critical. This affects the function deleteFile of the file /deleteFile. The manipulation of the argument fileName leads to path traversal. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. This product takes the approach of rolling rel
k remotely. The exploit has been disclosed to the public and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.316329 - https://vuldb.com/?ctiid.316329 - https://vuldb.com/?submit.609098 - https://github.com/YiJiuSmile/kkFileViewOfficeEdit/issues/15
CVE ID: CVE-2025-7632 State: PUBLISHED Published: 2025-11-11T10:29:44.881Z Last Updated: 2025-11-13T04:55:27.240Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N) Vendors: Zohocorp Products: ManageEngine Exchange Reporter Plus Problem Types: CWE-79 Description: Zohocorp ManageEngine Exchange Reporter Plus versions 5723 and below are vulnerable to the Stored XSS Vulnerability in the Public Folders report. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.manageengine.com/products/exchange-reports/advisory/CVE-2025-7632.html
CVE ID: CVE-2025-7633 State: PUBLISHED Published: 2025-11-11T10:32:01.920Z Last Updated: 2025-11-13T04:55:29.892Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N) Vendors: Zohocorp Products: ManageEngine Exchange Reporter Plus Problem Types: CWE-79 Description: Zohocorp ManageEngine Exchange Reporter Plus versions 5723 and below are vulnerable to the Stored XSS Vulnerability in the Custom report. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.manageengine.com/products/exchange-reports/advisory/CVE-2025-7633.html
CVE ID: CVE-2025-7634 State: PUBLISHED Published: 2025-10-09T05:23:53.117Z Last Updated: 2025-10-09T15:50:54.097Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: wptravelengine Products: WP Travel Engine – Tour Booking Plugin – Tour Operator Software Problem Types: CWE-98 Description: The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 6.6.7 via the mode parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used
and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ce119965-01a0-4cff-a0b2-e99bceb1406c?source=cve - https://plugins.trac.wordpress.org/browser/wp-travel-engine/tags/6.6.0/includes/classes/Core/Controllers/Ajax/FilterTripsHtml.php#L72 - https://plugins.trac.wordpress.org/browser/wp-travel-engine/tags/6.6.0/includes/classes/Core/Controllers/Ajax/LoadTripsHtml.php#L27
CVE ID: CVE-2025-7635 State: PUBLISHED Published: 2025-09-09T20:08:37.767Z Last Updated: 2025-09-12T13:56:22.271Z Vendors: Calix Products: GigaCenter ONT Problem Types: CWE-306 Description: Unauthenticated Telnet access vulnerability in Calix GigaCenter ONT allows root access.This issue affects GigaCenter ONT: 844E, 844G, 844GE, 854GE. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fluidattacks.com/advisories/sal - https://www.calix.com - https://revers3everything.com/calix-case-five-0-days-five-cves/
CVE ID: CVE-2025-7638 State: PUBLISHED Published: 2025-07-18T04:23:01.973Z Last Updated: 2025-07-18T13:52:15.103Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: wpmudev Products: Forminator Forms – Contact Form, Payment Form & Custom Form Builder Problem Types: CWE-89 Description: The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to time-based SQL Injection via the `order_by` parameter in all versions up to, and including, 1.45.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers,
meter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/5f5a1eb3-3fda-49de-aefb-2205c9ca3520?source=cve - https://plugins.trac.wordpress.org/browser/forminator/tags/1.45.0/library/model/class-form-entry-model.php#L2561
CVE ID: CVE-2025-7640 State: PUBLISHED Published: 2025-07-24T09:22:15.857Z Last Updated: 2025-07-24T13:15:30.942Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H) Vendors: den-media Products: hiWeb Export Posts Problem Types: CWE-22 Description: The hiWeb Export Posts plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.9.0.0. This is due to missing or incorrect nonce validation on the tool-dashboard-history.php file. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php), via a f
e server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php), via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/38c23f59-8332-49ab-a219-1f5fac8a283c?source=cve - https://plugins.trac.wordpress.org/browser/hiweb-export-posts/trunk/views/tool-dashboard-history.php#L3 - https://wordpress.org/plugins/hiweb-export-posts/
CVE ID: CVE-2025-7641 State: PUBLISHED Published: 2025-08-15T08:25:38.365Z Last Updated: 2025-08-15T16:28:38.253Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: 48hmorris Products: Assistant for NextGEN Gallery Problem Types: CWE-22 Description: The Assistant for NextGEN Gallery plugin for WordPress is vulnerable to arbitrary directory deletion due to insufficient file path validation in the /wp-json/nextgenassistant/v1.0.0/control REST endpoint in all versions up to, and including, 1.0.9. This makes it possible for unauthenticated attackers to delete arbitrary directories on the server, which can cause a complete loss of availability. Additional Analyst Note
to delete arbitrary directories on the server, which can cause a complete loss of availability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/07ebb176-a1f8-4a5c-8d81-a83fda4b0af3?source=cve - http://plugins.trac.wordpress.org/browser/assistant-for-nextgen-gallery/trunk/nextgenassistant.php#L163 - https://wordpress.org/plugins/assistant-for-nextgen-gallery/
CVE ID: CVE-2025-7642 State: PUBLISHED Published: 2025-08-23T04:25:44.981Z Last Updated: 2025-08-25T17:41:01.454Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: simplercheckout Products: Simpler Checkout Problem Types: CWE-288 Description: The Simpler Checkout plugin for WordPress is vulnerable to Authentication Bypass in versions 0.7.0 to 1.1.9. This is due to the plugin not properly verifying a user's identity prior to logging them in as an admin through the simplerwc_woocommerce_order_created() function. This makes it possible for unauthenticated attackers to log in as other users based on their order ID, which can be an administrator if a site admin h
uthenticated attackers to log in as other users based on their order ID, which can be an administrator if a site admin has placed a test order. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/02cf0e1a-bd12-44b1-9bc5-1a5ec332b000?source=cve - https://plugins.trac.wordpress.org/browser/simpler-checkout/tags/1.1.9/includes/hooks.php#L7
CVE ID: CVE-2025-7643 State: PUBLISHED Published: 2025-07-18T05:23:58.312Z Last Updated: 2025-07-18T13:27:06.405Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H) Vendors: aaroncampbell Products: Attachment Manager Problem Types: CWE-22 Description: The Attachment Manager plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the handle_actions() function in all versions up to, and including, 2.1.2. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). Additional Analyst Note
can easily lead to remote code execution when the right file is deleted (such as wp-config.php). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/5731b971-4408-4c64-809c-e95fba33009e?source=cve - https://wordpress.org/plugins/attachment-manager/