Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-10745 State: PUBLISHED Published: 2025-09-26T03:25:34.436Z Last Updated: 2025-09-26T19:32:24.596Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: specialk Products: Banhammer – Monitor Site Traffic, Block Bad Users and Bots Problem Types: CWE-330 Description: The Banhammer – Monitor Site Traffic, Block Bad Users and Bots plugin for WordPress is vulnerable to Blocking Bypass in all versions up to, and including, 3.4.8. This is due to a site-wide “secret key” being deterministically generated from a constant character set using md5() and base64_encode() and then stored in the `banhammer_secret_key` option. This makes it possible for unauthenti
ng md5() and base64_encode() and then stored in the `banhammer_secret_key` option. This makes it possible for unauthenticated attackers to bypass the plugin’s logging and blocking by appending a GET parameter named `banhammer-process_{SECRET}` where `{SECRET}` is the predictable value, thereby causing Banhammer to abort its protections for that request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/97c46a13-6981-426f-b24a-c9820657042f?source=cve - https://plugins.trac.wordpress.org/browser/banhammer/trunk/inc/banhammer-functions.php#L336 - https://plugins.trac.wordpress.org/browser/banhammer/trunk/inc/banhammer-core
r/trunk/inc/banhammer-functions.php#L336 - https://plugins.trac.wordpress.org/browser/banhammer/trunk/inc/banhammer-core.php#L101 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3365979%40banhammer&new=3365979%40banhammer&sfp_email=&sfph_mail= - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3365087%40banhammer&new=3365087%40banhammer&sfp_email=&sfph_mail=
CVE ID: CVE-2025-10746 State: PUBLISHED Published: 2025-10-04T02:24:36.757Z Last Updated: 2025-10-06T14:16:41.038Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: cyberlord92 Products: Integrate Dynamics 365 CRM Problem Types: CWE-306 Description: The Integrate Dynamics 365 CRM plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 1.0.9. This is due to missing capability checks and nonce verification on functions hooked to 'init'. This makes it possible for unauthenticated attackers to deactivate the plugin, tamper with OAuth configuration, and trigger test connections that expose sensitive data via direct request to
e plugin, tamper with OAuth configuration, and trigger test connections that expose sensitive data via direct request to vulnerable endpoints granted they can craft malicious requests with specific parameters. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b7fb23e8-dabb-4d6e-a2b2-2b27d6a38b3c?source=cve - https://plugins.trac.wordpress.org/browser/integrate-dynamics-365-crm/tags/1.0.9/Observer/adminObserver.php#L26 - https://plugins.trac.wordpress.org/browser/integrate-dynamics-365-crm/tags/1.0.9/integrate-dynamics-365-crm.php#L48 - https://plugins.trac.wordpress.org/browser/integrate-dynamics-365-crm/trunk/Observer/
tegrate-dynamics-365-crm.php#L48 - https://plugins.trac.wordpress.org/browser/integrate-dynamics-365-crm/trunk/Observer/class-adminobserver.php?rev=3370266#L71
CVE ID: CVE-2025-10747 State: PUBLISHED Published: 2025-09-26T05:27:20.601Z Last Updated: 2025-09-26T19:48:25.317Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: gamerz Products: WP-DownloadManager Problem Types: CWE-434 Description: The WP-DownloadManager plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the download-add.php file in all versions up to, and including, 1.68.11. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. Additional Analyst Notes: - CISA ADP Vu
les on the affected site's server which may make remote code execution possible. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/2c535cea-dad6-440f-b37f-6d196b469214?source=cve - https://wordpress.org/plugins/wp-downloadmanager/ - https://plugins.trac.wordpress.org/browser/wp-downloadmanager/trunk/download-add.php#L35 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3364847%40wp-downloadmanager&new=3364847%40wp-downloadmanager&sfp_email=&sfph_mail=
CVE ID: CVE-2025-10748 State: PUBLISHED Published: 2025-10-24T08:23:58.873Z Last Updated: 2025-10-24T12:30:59.240Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: onlinediagnosticbd Products: RapidResult Problem Types: CWE-89 Description: The RapidResult plugin for WordPress is vulnerable to SQL Injection via the 's' parameter in all versions up to, and including, 1.2. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with contributor-level permissions and above to append additional SQL queries into already existing queries that
ackers with contributor-level permissions and above to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/4e5d7d04-f73a-48ea-81e3-36a514c76cc6?source=cve - https://plugins.trac.wordpress.org/browser/rapidresult/tags/1.2/rapidresult.php#L112
CVE ID: CVE-2025-10749 State: PUBLISHED Published: 2025-10-24T08:24:04.556Z Last Updated: 2025-10-24T12:30:17.813Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) Vendors: 10up Products: Microsoft Azure Storage for WordPress Problem Types: CWE-862 Description: The Microsoft Azure Storage for WordPress plugin for WordPress is vulnerable to Unauthorized Arbitrary Media Deletion in all versions up to, and including, 4.5.1. This is due to missing capability checks on the 'azure-storage-media-replace' AJAX action. This makes it possible for authenticated attackers with subscriber-level access and above to delete arbitrary media files from the WordPress Media Library via t
attackers with subscriber-level access and above to delete arbitrary media files from the WordPress Media Library via the replace_attachment parameter granted they can access the nonce which is exposed to all authenticated users. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e1b80852-a221-4c2c-b76d-8bdcd1e0f1ad?source=cve - https://plugins.trac.wordpress.org/browser/windows-azure-storage/tags/4.5.1/includes/class-windows-azure-replace-media.php#L152 - https://plugins.trac.wordpress.org/browser/windows-azure-storage/tags/4.5.1/includes/class-windows-azure-replace-media.php#L346
CVE ID: CVE-2025-10750 State: PUBLISHED Published: 2025-10-18T07:26:32.267Z Last Updated: 2025-10-20T17:37:10.527Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: cyberlord92 Products: PowerBI Embed Reports Problem Types: CWE-200 Description: The PowerBI Embed Reports plugin for WordPress is vulnerable to Sensitive Information Disclosure in all versions up to, and including, 1.2.0. This is due to missing capability checks and authentication verification on the 'testUser' endpoint accessible via the mo_epbr_admin_observer() function hooked on 'init'. This makes it possible for unauthenticated attackers to access sensitive Azure AD user information including p
n 'init'. This makes it possible for unauthenticated attackers to access sensitive Azure AD user information including personal identifiable information (PII) such as displayName, mail, phones, department, or detailed OAuth error data including Azure AD Application/Client IDs, error codes, trace IDs, and correlation IDs. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d830c2eb-16e8-425c-ac46-a467a2fd0133?source=cve - https://plugins.trac.wordpress.org/browser/embed-power-bi-reports/tags/1.2.0/embed-microsoft-power-bi-reports.php#L75 - https://plugins.trac.wordpress.org/browser/embed-power-bi-reports/tags/1.2.0/Observe
icrosoft-power-bi-reports.php#L75 - https://plugins.trac.wordpress.org/browser/embed-power-bi-reports/tags/1.2.0/Observer/adminObserver.php#L54 - https://plugins.trac.wordpress.org/browser/embed-power-bi-reports/tags/1.2.0/Observer/adminObserver.php#L265 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3369956%40embed-power-bi-reports&new=3369956%40embed-power-bi-reports&sfp_email=&sfph_mail=
CVE ID: CVE-2025-10751 State: PUBLISHED Published: 2025-10-04T00:37:58.200Z Last Updated: 2025-10-17T14:43:09.476Z Vendors: MacEnhance Products: MacForge Problem Types: CWE-732 Description: MacForge contains an insecure XPC service that allows local, unprivileged users to escalate their privileges to root.This issue affects MacForge: 1.2.0 Beta 1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fluidattacks.com/advisories/m83 - https://github.com/MacEnhance/MacForge - https://www.macenhance.com/macforge
CVE ID: CVE-2025-10752 State: PUBLISHED Published: 2025-09-26T01:47:27.527Z Last Updated: 2025-09-26T19:24:44.021Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: cyberlord92 Products: OAuth Single Sign On – SSO (OAuth Client) Problem Types: CWE-352 Description: The OAuth Single Sign On – SSO (OAuth Client) plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.26.12. This is due to using a predictable state parameter (base64 encoded app name) without any randomness in the OAuth flow. This makes it possible for unauthenticated attackers to forge OAuth authorization requests and potentially hijack the OAuth fl
akes it possible for unauthenticated attackers to forge OAuth authorization requests and potentially hijack the OAuth flow via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e8d7e8f3-e8ff-460f-a343-807bcdb865dc?source=cve - https://plugins.trac.wordpress.org/browser/miniorange-login-with-eve-online-google-facebook/tags/6.26.12/class-mooauth-widget.php#L285 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3360768%40miniorange-login-with-eve-online-google-facebook&new=3360
ss.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3360768%40miniorange-login-with-eve-online-google-facebook&new=3360768%40miniorange-login-with-eve-online-google-facebook&sfp_email=&sfph_mail=
CVE ID: CVE-2025-10754 State: PUBLISHED Published: 2025-10-15T08:25:49.118Z Last Updated: 2025-10-15T15:58:13.861Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: geolocationtechnology Products: DocoDoco Store Locator Problem Types: CWE-434 Description: The DocoDoco Store Locator plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the zip upload functionality in all versions up to, and including, 1.0.1. This makes it possible for authenticated attackers, with Editor-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. Additional Analyst Not
load arbitrary files on the affected site's server which may make remote code execution possible. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/14759eb0-455f-4b7d-abab-4e4d89b32bb1?source=cve - https://plugins.trac.wordpress.org/browser/docodoco-store-locator/tags/1.0.1/includes/Admin/ZIP.php#L187 - https://plugins.trac.wordpress.org/browser/docodoco-store-locator/tags/1.0.1/includes/Admin/ZIP.php#L275
CVE ID: CVE-2025-10755 State: PUBLISHED Published: 2025-09-20T21:02:05.774Z Last Updated: 2025-09-22T14:46:59.912Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: Selleo Products: Mentingo Problem Types: CWE-434, CWE-284 Description: A vulnerability was detected in Selleo Mentingo 2025.08.27. The impacted element is an unknown function of the component Content-Type Handler. The manipulation of the argument userAvatar results in unrestricted upload. The attack may be performed from remote. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichme
as contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.325069 - https://vuldb.com/?ctiid.325069 - https://vuldb.com/?submit.645419 - https://gist.github.com/KhanMarshaI/7a2e74fcb194f7d6ee7e60da4a14af7b
CVE ID: CVE-2025-10756 State: PUBLISHED Published: 2025-09-20T22:32:06.326Z Last Updated: 2025-09-22T14:44:12.469Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR) Vendors: UTT Products: HiPER 840G Problem Types: CWE-120, CWE-119 Description: A security flaw has been discovered in UTT HiPER 840G up to 3.1.1-190328. Impacted is an unknown function of the file /goform/getOneApConfTempEntry. The manipulation of the argument tempName results in buffer overflow. It is possible to launch the attack remotely. The exploit has been released to the public and may be exploited. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Not
e exploited. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.325111 - https://vuldb.com/?ctiid.325111 - https://vuldb.com/?submit.645678 - https://github.com/cymiao1978/cve/blob/main/5.md - https://github.com/cymiao1978/cve/blob/main/5.md#poc
CVE ID: CVE-2025-10757 State: PUBLISHED Published: 2025-09-20T23:32:06.948Z Last Updated: 2025-09-22T14:40:59.805Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR) Vendors: UTT Products: 1200GW Problem Types: CWE-120, CWE-119 Description: A weakness has been identified in UTT 1200GW up to 3.0.0-170831. The affected element is an unknown function of the file /goform/formConfigDnsFilterGlobal. This manipulation of the argument GroupName causes buffer overflow. The attack can be initiated remotely. The exploit has been made available to the public and could be exploited. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst No
be exploited. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.325112 - https://vuldb.com/?ctiid.325112 - https://vuldb.com/?submit.645681 - https://github.com/cymiao1978/cve/blob/main/6.md - https://github.com/cymiao1978/cve/blob/main/6.md#poc
CVE ID: CVE-2025-10758 State: PUBLISHED Published: 2025-09-21T00:02:07.636Z Last Updated: 2025-09-22T14:38:55.718Z Severity: N/A (CVSS 3.3 AV:N/AC:L/Au:M/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: n/a Products: htmly Problem Types: CWE-79, CWE-94 Description: A security vulnerability has been detected in htmly up to 3.1.0. The impacted element is an unknown function of the file /htmly/admin/field/post of the component Custom Field Handler. Such manipulation of the argument label leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additiona
publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.325113 - https://vuldb.com/?ctiid.325113 - https://vuldb.com/?submit.645806 - https://www.notion.so/inmog/Reported-Vulnerability-XSS-Vulnerability-in-htmly-v3-1-0-2627752d1edd804fbd71f310bde44d11
CVE ID: CVE-2025-10759 State: PUBLISHED Published: 2025-09-21T01:02:06.341Z Last Updated: 2025-09-22T14:36:40.498Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C) Vendors: Webkul Products: QloApps Problem Types: CWE-639, CWE-285 Description: A vulnerability was detected in Webkul QloApps up to 1.7.0. This affects an unknown function of the component CSRF Token Handler. Performing manipulation of the argument token results in authorization bypass. The attack may be initiated remotely. The exploit is now public and may be used. The vendor explains: "As We are already aware about this vulnerability and our Internal team are already working on this issue. (
r explains: "As We are already aware about this vulnerability and our Internal team are already working on this issue. (...) We'll implement the fix for this vulnerability in our next major release." Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.325114 - https://vuldb.com/?ctiid.325114 - https://vuldb.com/?submit.645821 - https://github.com/Ryomensukuna13/QloApps-Reusable-CSRF-Token-in-Logout-Functionality/blob/main/README.md - https://github.com/Ryomensukuna13/QloApps-Reusable-CSRF-Token-in-Logout-Functionality/blob/main/README.md#proof-of-concept-poc
CVE ID: CVE-2025-10760 State: PUBLISHED Published: 2025-09-21T02:32:06.125Z Last Updated: 2025-09-22T14:10:36.828Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: n/a Products: Harness Problem Types: CWE-918 Description: A flaw has been found in Harness 3.3.0. This impacts the function LookupRepo of the file app/api/controller/gitspace/lookup_repo.go. Executing manipulation of the argument url can lead to server-side request forgery. The attack may be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References
arly about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.325115 - https://vuldb.com/?ctiid.325115 - https://vuldb.com/?submit.646843 - https://github.com/August829/Yu/blob/main/58ead8e7e08bfb019.md - https://github.com/August829/Yu/blob/main/58ead8e7e08bfb019.md#poc
CVE ID: CVE-2025-10761 State: PUBLISHED Published: 2025-09-21T03:02:08.657Z Last Updated: 2025-09-22T14:08:20.975Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R) Vendors: n/a Products: Harness Problem Types: CWE-307, CWE-799 Description: A vulnerability has been found in Harness 3.3.0. Affected is an unknown function of the file /api/v1/login of the component Login Endpoint. The manipulation leads to improper restriction of excessive authentication attempts. Remote exploitation of the attack is possible. The attack is considered to have high complexity. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be use
high complexity. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.325116 - https://vuldb.com/?ctiid.325116 - https://vuldb.com/?submit.646871 - https://github.com/August829/Yu/blob/main/58ead8e7e08bfb020.md - https://github.com/August829/Yu/blob/main/58ead8e7e08bfb020.md#poc
CVE ID: CVE-2025-10762 State: PUBLISHED Published: 2025-09-21T04:32:06.811Z Last Updated: 2025-09-22T14:06:15.901Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: kuaifan Products: DooTask Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in kuaifan DooTask up to 1.2.49. Affected by this vulnerability is an unknown functionality of the file app/Http/Controllers/Api/UsersController.php. The manipulation of the argument keys[department] results in sql injection. The attack can be executed remotely. The exploit has been made public and could be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.325117 -
blic and could be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.325117 - https://vuldb.com/?ctiid.325117 - https://vuldb.com/?submit.646886 - https://github.com/kuaifan/dootask/issues/283 - https://github.com/kuaifan/dootask/issues/283#issue-3379188930
CVE ID: CVE-2025-10763 State: PUBLISHED Published: 2025-09-21T05:02:05.454Z Last Updated: 2025-09-22T14:04:29.192Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: academico-sis Products: academico Problem Types: CWE-434, CWE-284 Description: A vulnerability was determined in academico-sis academico up to d9a9e2636fbf7e5845ee086bcb03ca62faceb6ab. Affected by this issue is some unknown functionality of the file /edit-photo of the component Profile Picture Handler. This manipulation causes unrestricted upload. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. This product adopts a rolling release strate
out remotely. The exploit has been publicly disclosed and may be utilized. This product adopts a rolling release strategy to maintain continuous delivery The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.325118 - https://vuldb.com/?ctiid.325118 - https://vuldb.com/?submit.646915 - https://gist.github.com/KhanMarshaI/86d0c1553355bb168084fffbdb6e7fea
CVE ID: CVE-2025-10764 State: PUBLISHED Published: 2025-09-21T05:32:05.806Z Last Updated: 2025-09-22T14:02:19.649Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: SeriaWei Products: ZKEACMS Problem Types: CWE-918 Description: A vulnerability was identified in SeriaWei ZKEACMS up to 4.3. This affects the function Edit of the file src/ZKEACMS.EventAction/Controllers/PendingTaskController.cs of the component Event Action System. Such manipulation of the argument Data leads to server-side request forgery. The attack may be performed from remote. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not res
he exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.325119 - https://vuldb.com/?ctiid.325119 - https://vuldb.com/?submit.647629 - https://github.com/August829/Yu/blob/main/58ead8e7e08bfb021.md
CVE ID: CVE-2025-10765 State: PUBLISHED Published: 2025-09-21T06:32:06.895Z Last Updated: 2025-09-22T14:09:14.625Z Severity: N/A (CVSS 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: SeriaWei Products: ZKEACMS Problem Types: CWE-918 Description: A security flaw has been discovered in SeriaWei ZKEACMS up to 4.3. This vulnerability affects the function CheckPage/Suggestions in the library cms-v4.3\wwwroot\Plugins\ZKEACMS.SEOSuggestions\ZKEACMS.SEOSuggestions.dll of the component SEOSuggestions. Performing manipulation results in server-side request forgery. It is possible to initiate the attack remotely. The exploit has been released to the public and may be exploited. The vendor wa
ossible to initiate the attack remotely. The exploit has been released to the public and may be exploited. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.325120 - https://vuldb.com/?ctiid.325120 - https://vuldb.com/?submit.647952 - https://github.com/wooyun123/wooyun/issues/1