Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-29984 State: PUBLISHED Published: 2025-04-15T03:38:08.310Z Last Updated: 2025-04-16T03:55:07.417Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: Dell Products: Dell Trusted Device Client Problem Types: CWE-284 Description: Dell Trusted Device, versions prior to 7.0.3.0, contain an Incorrect Default Permissions vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000299528/dsa-2025-151
CVE ID: CVE-2025-29985 State: PUBLISHED Published: 2025-04-08T10:44:24.736Z Last Updated: 2025-04-08T13:02:58.691Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: Dell Products: Common Event Enabler Problem Types: CWE-1188 Description: Dell Common Event Enabler, version(s) CEE 9.0.0.0, contain(s) an Initialization of a Resource with an Insecure Default vulnerability in the Common Anti-Virus Agent (CAVA). An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000303931/dsa-2025-158-secu
alyst Notes: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000303931/dsa-2025-158-security-update-for-dell-common-event-enabler-vulnerabilities
CVE ID: CVE-2025-29986 State: PUBLISHED Published: 2025-04-08T10:40:39.690Z Last Updated: 2025-04-08T13:03:43.923Z Severity: HIGH (CVSS 8.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L) Vendors: Dell Products: Common Event Enabler Problem Types: CWE-923 Description: Dell Common Event Enabler, version(s) CEE 9.0.0.0, contain(s) an Improper Restriction of Communication Channel to Intended Endpoints vulnerability in the Common Anti-Virus Agent (CAVA). An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000303931/dsa-20
ditional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000303931/dsa-2025-158-security-update-for-dell-common-event-enabler-vulnerabilities
CVE ID: CVE-2025-29987 State: PUBLISHED Published: 2025-04-03T15:18:06.144Z Last Updated: 2025-04-05T03:55:35.210Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Dell Products: DD OS 8.3, DD OS 7.13, DD OS 7.10, PowerProtect DP Series Appliance (IDPA) Problem Types: CWE-1220 Description: Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) versions prior to 8.3.0.15 contain an Insufficient Granularity of Access Control vulnerability. An authenticated user from a trusted remote client could exploit this vulnerability to execute arbitrary commands with root privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://w
cute arbitrary commands with root privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000300899/dsa-2025-139-dell-technologies-powerprotect-data-domain-security-update-for-a-security-vulnerability
CVE ID: CVE-2025-29988 State: PUBLISHED Published: 2025-04-09T02:25:06.695Z Last Updated: 2025-04-10T03:55:25.957Z Severity: MEDIUM (CVSS 6.9 CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:H) Vendors: Dell Products: Dell Client Platform BIOS Problem Types: CWE-121 Description: Dell Client Platform BIOS contains a Stack-based Buffer Overflow Vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to arbitrary code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-in/000283859/dsa-2025-088
CVE ID: CVE-2025-29989 State: PUBLISHED Published: 2025-04-10T01:55:55.597Z Last Updated: 2025-04-10T14:28:52.086Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:L) Vendors: Dell Products: Dell Client Platform BIOS Problem Types: CWE-1328 Description: Dell Client Platform BIOS contains a Security Version Number Mutable to Older Versions vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to BIOS upgrade denial. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000250131/dsa-2025-016
CVE ID: CVE-2025-29991 State: PUBLISHED Published: 2025-04-03T00:00:00.000Z Last Updated: 2025-04-03T14:06:05.266Z Severity: LOW (CVSS 2.2 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N) Vendors: Yubico Products: YubiKey Problem Types: CWE-1390 Description: Yubico YubiKey 5.4.1 through 5.7.3 before 5.7.4 has an incorrect FIDO CTAP PIN/UV Auth Protocol Two implementation. It uses the signature length from CTAP PIN/UV Auth Protocol One, even when CTAP PIN/UV Auth Protocol Two was chosen, resulting in a partial signature verification. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.yubico.com/support/security-advisories/ysa-2025-02/
CVE ID: CVE-2025-29992 State: PUBLISHED Published: 2025-08-26T00:00:00.000Z Last Updated: 2025-08-27T14:21:02.217Z Vendors: n/a Products: n/a Problem Types: n/a Description: Mahara before 24.04.9 exposes database connection information if the database becomes unreachable, e.g., due to the database server being temporarily down or too busy. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://mahara.org/THE-FINAL-URL-IN-QUESTION - https://mahara.org/interaction/forum/topic.php?id=9711
CVE ID: CVE-2025-29993 State: PUBLISHED Published: 2025-03-27T09:06:53.028Z Last Updated: 2025-03-27T13:30:08.643Z Severity: MEDIUM (CVSS 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: Alfasado Inc. Products: PowerCMS 6.x series, PowerCMS 5.x series, PowerCMS 4.x series Problem Types: CWE-74 Description: The affected versions of PowerCMS allow HTTP header injection. This vulnerability can be leveraged to direct the affected product to send email with a tampered URL, such as password reset mail. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.powercms.jp/news/release-powercms-661-528-459.html - https://jvn.jp/en/jp/JVN39026557/
CVE ID: CVE-2025-29994 State: PUBLISHED Published: 2025-03-13T11:12:43.796Z Last Updated: 2025-03-13T19:37:48.450Z Vendors: Rising Technosoft Products: CAP back office application Problem Types: CWE-1390 Description: This vulnerability exists in the CAP back office application due to improper authentication check at the API endpoint. An unauthenticated remote attacker with a valid login ID could exploit this vulnerability by manipulating API input parameters through API request URL/payload leading to unauthorized access to other user accounts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2025-0048
CVE ID: CVE-2025-29995 State: PUBLISHED Published: 2025-03-13T11:16:26.519Z Last Updated: 2025-03-13T19:36:58.038Z Vendors: Rising Technosoft Products: CAP back office application Problem Types: CWE-640 Description: This vulnerability exists in the CAP back office application due to a weak password-reset mechanism implemented at API endpoints. An authenticated remote attacker with a valid login ID could exploit this vulnerability through vulnerable API endpoint which could lead to account takeover of targeted users. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2025-0048
CVE ID: CVE-2025-29996 State: PUBLISHED Published: 2025-03-13T11:18:54.799Z Last Updated: 2025-03-13T19:36:11.734Z Vendors: Rising Technosoft Products: CAP back office application Problem Types: CWE-288 Description: This vulnerability exists in the CAP back office application due to improper implementation of OTP verification mechanism in its API based login. A remote attacker with valid credentials could exploit this vulnerability by manipulating API request URL/payload. Successful exploitation of this vulnerability could allow the attacker to bypass Two-Factor Authentication (2FA) for other user accounts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cert-in.
ion (2FA) for other user accounts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2025-0048
CVE ID: CVE-2025-29997 State: PUBLISHED Published: 2025-03-13T11:21:17.016Z Last Updated: 2025-03-13T19:34:11.857Z Vendors: Rising Technosoft Products: CAP back office application Problem Types: CWE-863 Description: This vulnerability exists in the CAP back office application due to improper authorization checks on certain API endpoints. An authenticated remote attacker could exploit this vulnerability by manipulating API request URL to gain unauthorized access to other user accounts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2025-0048
CVE ID: CVE-2025-29998 State: PUBLISHED Published: 2025-03-13T11:23:57.998Z Last Updated: 2025-03-13T19:33:09.748Z Vendors: Rising Technosoft Products: CAP back office application Problem Types: CWE-799 Description: This vulnerability exists in the CAP back office application due to missing rate limiting on OTP requests in an API endpoint. An authenticated remote attacker could exploit this vulnerability by sending multiple OTP request through vulnerable API endpoint which could lead to the OTP bombing/flooding on the targeted system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2025-0048
CVE ID: CVE-2025-29999 State: PUBLISHED Published: 2025-04-08T08:22:28.099Z Last Updated: 2025-04-08T13:26:14.840Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: Siemens Products: Siemens License Server (SLS) Problem Types: CWE-269 Description: A vulnerability has been identified in Siemens License Server (SLS) (All versions < V4.3). The affected application searches for executable files in the application folder without proper validation. This could allow an attacker to execute arbitrary code with administrative privileges by placing a malicious executable in the same directory. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert-
licious executable in the same directory. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/html/ssa-525431.html
CVE ID: CVE-2025-2000 State: PUBLISHED Published: 2025-03-14T13:04:46.351Z Last Updated: 2025-09-01T01:05:41.994Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: IBM Products: Qiskit SDK Problem Types: CWE-502 Description: A maliciously crafted QPY file can potential execute arbitrary-code embedded in the payload without privilege escalation when deserialising QPY formats < 13. A python process calling Qiskit 0.18.0 through 1.4.1's `qiskit.qpy.load()` function could potentially execute any arbitrary Python code embedded in the correct place in the binary file as part of specially constructed payload. Additional Analyst Notes: - CISA ADP Vulnrichment: Refer
ce in the binary file as part of specially constructed payload. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7185949
CVE ID: CVE-2025-2002 State: PUBLISHED Published: 2025-03-12T15:25:20.057Z Last Updated: 2025-05-12T15:37:21.223Z Severity: MEDIUM (CVSS 6 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N) Vendors: Schneider Electric Products: EcoStruxure Panel Server Problem Types: CWE-532 Description: CWE-532: Insertion of Sensitive Information into Log Files vulnerability exists that could cause the disclosure of FTP server credentials when the FTP server is deployed, and the device is placed in debug mode by an administrative user and the debug files are exported from the device. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2025
Analyst Notes: - CISA ADP Vulnrichment: References: - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2025-070-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2025-070-01.pdf
CVE ID: CVE-2025-2003 State: PUBLISHED Published: 2025-03-05T18:56:20.360Z Last Updated: 2025-03-05T19:23:25.474Z Vendors: Devolutions Products: Server Problem Types: CWE-863 Description: Incorrect authorization in PAM vaults in Devolutions Server 2024.3.12 and earlier allows an authenticated user to bypass the 'add in root' permission. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://devolutions.net/security/advisories/DEVO-2025-0003/
CVE ID: CVE-2025-2004 State: PUBLISHED Published: 2025-04-08T04:21:30.255Z Last Updated: 2025-04-08T14:51:51.803Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H) Vendors: wpminds Products: Simple WP Events Problem Types: CWE-73 Description: The Simple WP Events plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the wpe_delete_file AJAX action in all versions up to, and including, 1.8.17. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). Additional Analyst Notes: - CI
ily lead to remote code execution when the right file is deleted (such as wp-config.php). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/abdca93e-f68d-4a96-8bd7-443ee46ccb5a?source=cve - https://plugins.trac.wordpress.org/browser/simple-wp-events/trunk/admin/includes/wp-events-export-events.php#L399
CVE ID: CVE-2025-2005 State: PUBLISHED Published: 2025-04-02T09:21:42.633Z Last Updated: 2025-04-02T16:14:39.009Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: rustaurius Products: Front End Users Problem Types: CWE-434 Description: The Front End Users plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the file uploads field of the registration form in all versions up to, and including, 3.2.32. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. Additional Analyst Notes: - CISA ADP Vulnrichment: Referenc
site's server which may make remote code execution possible. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/102223a1-07f5-485b-a6af-49cf316d9797?source=cve - https://wordpress.org/support/plugin/front-end-only-users/
CVE ID: CVE-2025-2006 State: PUBLISHED Published: 2025-03-29T07:03:31.321Z Last Updated: 2025-04-07T18:23:53.409Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: aspengrovestudios Products: Inline Image Upload for BBPress Problem Types: CWE-434 Description: The Inline Image Upload for BBPress plugin for WordPress is vulnerable to arbitrary file uploads due to missing file extension validation in the file uploading functionality in all versions up to, and including, 1.1.19. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possi
vel access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. This may be exploitable by unauthenticated attackers when the "Allow guest users without accounts to create topics and replies" setting is enabled. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/df09af41-399a-4878-8420-721f1198d895?source=cve - https://plugins.trac.wordpress.org/browser/image-upload-for-bbpress/tags/1.1.19/bbp-image-upload.php#L136 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3264738%40image-upload-for-bbpress&new=3264738%40image-upload-for
ress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3264738%40image-upload-for-bbpress&new=3264738%40image-upload-for-bbpress&sfp_email=&sfph_mail=
CVE ID: CVE-2025-2007 State: PUBLISHED Published: 2025-04-01T04:21:20.141Z Last Updated: 2025-04-01T16:34:39.261Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) Vendors: smackcoders Products: Import Export Suite for CSV and XML Datafeed Problem Types: CWE-23 Description: The Import Export Suite for CSV and XML Datafeed plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the deleteImage() function in all versions up to, and including, 7.19. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code executio
ubscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/3923c732-80b5-4a04-80dd-b4d5b5e5567d?source=cve - https://plugins.trac.wordpress.org/changeset/3261521/wp-ultimate-csv-importer/trunk/MediaHandling.php
CVE ID: CVE-2025-2008 State: PUBLISHED Published: 2025-04-01T04:21:20.673Z Last Updated: 2025-04-01T16:21:35.775Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: smackcoders Products: Import Export Suite for CSV and XML Datafeed Problem Types: CWE-434 Description: The Import Export Suite for CSV and XML Datafeed plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the import_single_post_as_csv() function in all versions up to, and including, 7.19. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote
s, with Subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a114faf9-cada-4132-abe3-c0137b66e276?source=cve - https://plugins.trac.wordpress.org/changeset/3261521/wp-ultimate-csv-importer/trunk/SingleImportExport.php
CVE ID: CVE-2025-2009 State: PUBLISHED Published: 2025-03-26T08:21:50.914Z Last Updated: 2025-03-26T14:13:29.856Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: contrid Products: Newsletters Problem Types: CWE-79 Description: The Newsletters plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the logging functionality in all versions up to, and including, 4.9.9.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - htt
execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/3825c80c-e4b1-4dd8-be77-38f718920b9a?source=cve - https://plugins.trac.wordpress.org/browser/newsletters-lite/trunk/views/admin/settings/view_logs.php?rev=3212300#L107 - https://plugins.trac.wordpress.org/changeset/3257980/newsletters-lite/trunk/views/admin/settings/view_logs.php
CVE ID: CVE-2025-2010 State: PUBLISHED Published: 2025-04-19T02:22:34.142Z Last Updated: 2025-04-21T02:46:05.610Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: mhmrajib Products: JobWP – Job Board, Job Listing, Career Page and Recruitment Plugin Problem Types: CWE-89 Description: The JobWP – Job Board, Job Listing, Career Page and Recruitment Plugin plugin for WordPress is vulnerable to SQL Injection via the 'jobwp_upload_resume' parameter in all versions up to, and including, 2.3.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to
r and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b3b658f0-b9d8-4b7f-8d40-39ce185ef797?source=cve - https://plugins.trac.wordpress.org/changeset/3271612/jobwp/tags/2.4.0/core/job_application.php?old=3230672&old_path=jobwp%2Ftags%2F2.3.9%2Fcore%2Fjob_application.php
CVE ID: CVE-2025-2011 State: PUBLISHED Published: 2025-05-06T09:21:49.177Z Last Updated: 2025-05-07T13:35:13.884Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: averta Products: Popup and Slider Builder by Depicter – Add Email collecting Popup, Popup Modal, Coupon Popup, Image Slider, Carousel Slider, Post Slider Carousel Problem Types: CWE-89 Description: The Slider & Popup Builder by Depicter plugin for WordPress is vulnerable to generic SQL Injection via the ‘s' parameter in all versions up to, and including, 3.6.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possibl
aping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/49b36cde-39d8-4a69-8d7c-7b850b76a7cd?source=cve - https://plugins.trac.wordpress.org/browser/depicter/trunk/app/src/Database/Repository/LeadRepository.php?rev=3156664#L224 - https://plugins.trac.wordpress.org/browser/depicter/trunk/app/src/Services/LeadService.php?rev
ry.php?rev=3156664#L224 - https://plugins.trac.wordpress.org/browser/depicter/trunk/app/src/Services/LeadService.php?rev=3156664#L82 - https://plugins.trac.wordpress.org/browser/depicter/trunk/app/src/Controllers/Ajax/LeadsAjaxController.php?rev=3156664#L23 - https://plugins.trac.wordpress.org/browser/depicter/trunk/app/src/Controllers/Ajax/LeadsAjaxController.php?rev=3156664#L49 - https://plugins.trac.wordpress.org/browser/depicter/trunk/app/src/Controllers/Ajax/LeadsAjaxController.php?rev=3156664#L179 - https://wordpress.org/plugins/depicter/#description - https://plugins.trac.wordpress.org/changeset/3287525/
CVE ID: CVE-2025-2012 State: PUBLISHED Published: 2025-03-11T20:42:30.883Z Last Updated: 2025-03-12T14:42:04.971Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Ashlar-Vellum Products: Cobalt Problem Types: CWE-125 Description: Ashlar-Vellum Cobalt VS File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Cobalt. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of VS files. The issue results from the lack of pr