Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-11433 State: PUBLISHED Published: 2025-10-08T05:02:05.738Z Last Updated: 2025-10-08T17:47:43.415Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: itsourcecode Products: Leave Management System Problem Types: CWE-79, CWE-94 Description: A security flaw has been discovered in itsourcecode Leave Management System 1.0. This impacts the function redirect of the file /module/employee/controller.php?action=reset of the component Query Parameter Handler. Performing manipulation of the argument ID results in cross site scripting. It is possible to initiate the attack remotely. The exploit has been released to the public and may be exploited. Additional An
ossible to initiate the attack remotely. The exploit has been released to the public and may be exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.327370 - https://vuldb.com/?ctiid.327370 - https://vuldb.com/?submit.666541 - https://github.com/romatdibrohiksnov/vulndb.com/blob/main/itsourcecode%20Leave%20Management%20System%20%E2%80%94%20Reflected%20Cross-Site%20Scripting%20(XSS)/readme.md - https://itsourcecode.com/
CVE ID: CVE-2025-11434 State: PUBLISHED Published: 2025-10-08T05:02:08.754Z Last Updated: 2025-10-08T16:21:47.686Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: itsourcecode Products: Student Transcript Processing System Problem Types: CWE-89, CWE-74 Description: A weakness has been identified in itsourcecode Student Transcript Processing System 1.0. Affected is an unknown function of the file /login.php. Executing manipulation of the argument uname can lead to sql injection. It is possible to launch the attack remotely. The exploit has been made available to the public and could be exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - h
made available to the public and could be exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.327371 - https://vuldb.com/?ctiid.327371 - https://vuldb.com/?submit.666746 - https://github.com/yihaofuweng/cve/issues/49 - https://itsourcecode.com/
CVE ID: CVE-2025-11435 State: PUBLISHED Published: 2025-10-08T05:32:08.513Z Last Updated: 2025-10-08T17:42:52.233Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N/E:POC/RL:OF/RC:C) Vendors: JhumanJ Products: OpnForm Problem Types: CWE-79, CWE-94 Description: A security vulnerability has been detected in JhumanJ OpnForm up to 1.9.3. Affected by this vulnerability is an unknown functionality of the file /show/submissions. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. The identifier of the patch is a2af1184e53953afa8cb052f4055f288adcaa608. To fix this issue, it is recommended to deploy a patch. Add
er of the patch is a2af1184e53953afa8cb052f4055f288adcaa608. To fix this issue, it is recommended to deploy a patch. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.327372 - https://vuldb.com/?ctiid.327372 - https://vuldb.com/?submit.666876 - https://docs.google.com/document/d/1GUjJA9vUbsXUngAv6ySsbCIhVynf8_djardLZYEDOe0/edit?usp=sharing - https://github.com/JhumanJ/OpnForm/pull/900/commits/a2af1184e53953afa8cb052f4055f288adcaa608
CVE ID: CVE-2025-11436 State: PUBLISHED Published: 2025-10-08T05:32:12.472Z Last Updated: 2025-10-08T17:40:25.931Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C) Vendors: JhumanJ Products: OpnForm Problem Types: CWE-434, CWE-284 Description: A vulnerability was detected in JhumanJ OpnForm up to 1.9.3. Affected by this issue is some unknown functionality of the file /answer. The manipulation results in unrestricted upload. The attack can be launched remotely. The exploit is now public and may be used. The patch is identified as 95c3e23856465d202e6aec10bdb6ee0688b5305a. It is advisable to implement a patch to correct this issue. Additional Analyst Notes: - CISA ADP Vulnri
db6ee0688b5305a. It is advisable to implement a patch to correct this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.327373 - https://vuldb.com/?ctiid.327373 - https://vuldb.com/?submit.666877 - https://docs.google.com/document/d/1GUjJA9vUbsXUngAv6ySsbCIhVynf8_djardLZYEDOe0/edit?tab=t.0#heading=h.dm5ttliupfqn - https://github.com/JhumanJ/OpnForm/pull/900/commits/95c3e23856465d202e6aec10bdb6ee0688b5305a
CVE ID: CVE-2025-11437 State: PUBLISHED Published: 2025-10-08T06:02:06.384Z Last Updated: 2025-10-08T17:37:01.494Z Severity: N/A (CVSS 3.3 AV:N/AC:L/Au:M/C:N/I:P/A:N/E:POC/RL:ND/RC:C) Vendors: JhumanJ Products: OpnForm Problem Types: CWE-79, CWE-94 Description: A flaw has been found in JhumanJ OpnForm up to 1.9.3. This affects an unknown part of the file /api/open/forms/ of the component Form Editor. This manipulation causes cross site scripting. The attack may be initiated remotely. The exploit has been published and may be used. This issue is currently under review for additional handling. As of right now the vendor has stated that the feature is disabled until the user has configured thei
ditional handling. As of right now the vendor has stated that the feature is disabled until the user has configured their own domain which will mitigate this attack vector. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.327374 - https://vuldb.com/?ctiid.327374 - https://vuldb.com/?submit.666878 - https://docs.google.com/document/d/1GUjJA9vUbsXUngAv6ySsbCIhVynf8_djardLZYEDOe0/edit?tab=t.0#heading=h.nowv0hlgdq8
CVE ID: CVE-2025-11438 State: PUBLISHED Published: 2025-10-08T06:32:06.726Z Last Updated: 2025-10-08T17:32:06.050Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C) Vendors: JhumanJ Products: OpnForm Problem Types: CWE-862, CWE-863 Description: A vulnerability has been found in JhumanJ OpnForm up to 1.9.3. This vulnerability affects unknown code of the file /custom-domains of the component API Endpoint. Such manipulation leads to missing authorization. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The name of the patch is beb153ce52dceb971c1518f98333328c95f1ba20. It is best practice to apply a patch to resolve this issue
ame of the patch is beb153ce52dceb971c1518f98333328c95f1ba20. It is best practice to apply a patch to resolve this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.327375 - https://vuldb.com/?ctiid.327375 - https://vuldb.com/?submit.666879 - https://docs.google.com/document/d/1GUjJA9vUbsXUngAv6ySsbCIhVynf8_djardLZYEDOe0/edit?tab=t.0#heading=h.gm61tyll8uys - https://github.com/JhumanJ/OpnForm/pull/900/commits/beb153ce52dceb971c1518f98333328c95f1ba20
CVE ID: CVE-2025-11439 State: PUBLISHED Published: 2025-10-08T06:32:09.874Z Last Updated: 2025-10-08T17:28:05.301Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C) Vendors: JhumanJ Products: OpnForm Problem Types: CWE-862, CWE-863 Description: A vulnerability was found in JhumanJ OpnForm up to 1.9.3. This issue affects some unknown processing of the file /show/integrations. Performing manipulation results in missing authorization. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The patch is named 11d97d78f2de2cb49f79baed6bde8b611ec1f384. It is recommended to apply a patch to fix this issue. Additional An
h is named 11d97d78f2de2cb49f79baed6bde8b611ec1f384. It is recommended to apply a patch to fix this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.327376 - https://vuldb.com/?ctiid.327376 - https://vuldb.com/?submit.666880 - https://docs.google.com/document/d/1GUjJA9vUbsXUngAv6ySsbCIhVynf8_djardLZYEDOe0/edit?tab=t.0#heading=h.reuyi9lwvpj - https://github.com/JhumanJ/OpnForm/pull/900/commits/11d97d78f2de2cb49f79baed6bde8b611ec1f384
CVE ID: CVE-2025-11440 State: PUBLISHED Published: 2025-10-08T07:02:07.818Z Last Updated: 2025-10-08T13:48:06.257Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C) Vendors: JhumanJ Products: OpnForm Problem Types: CWE-284, CWE-266 Description: A vulnerability was determined in JhumanJ OpnForm up to 1.9.3. Impacted is an unknown function of the file /edit. Executing manipulation can lead to improper access controls. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. This patch is called b15e29021d326be127193a5dbbd528c4e37e6324. Applying a patch is advised to resolve this issue. Additional Analyst Notes: - CIS
29021d326be127193a5dbbd528c4e37e6324. Applying a patch is advised to resolve this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.327377 - https://vuldb.com/?ctiid.327377 - https://vuldb.com/?submit.666881 - https://docs.google.com/document/d/1GUjJA9vUbsXUngAv6ySsbCIhVynf8_djardLZYEDOe0/edit?tab=t.0#heading=h.t78mmp24qqk5 - https://github.com/JhumanJ/OpnForm/pull/900/commits/b15e29021d326be127193a5dbbd528c4e37e6324
CVE ID: CVE-2025-11441 State: PUBLISHED Published: 2025-10-08T07:02:11.296Z Last Updated: 2025-10-08T13:47:26.751Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C) Vendors: JhumanJ Products: OpnForm Problem Types: CWE-307, CWE-799 Description: A vulnerability was identified in JhumanJ OpnForm up to 1.9.3. The affected element is an unknown function of the component HTTP Header Handler. The manipulation of the argument X-Forwarded-For leads to improper restriction of excessive authentication attempts. The attack is possible to be carried out remotely. A high degree of complexity is needed for the attack. The exploitability is described as difficult. The expl
t remotely. A high degree of complexity is needed for the attack. The exploitability is described as difficult. The exploit is publicly available and might be used. The identifier of the patch is 11e99960e14ca986b1a001a56e7533223d2cfa5b. It is suggested to install a patch to address this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.327378 - https://vuldb.com/?ctiid.327378 - https://vuldb.com/?submit.666888 - https://docs.google.com/document/d/1GUjJA9vUbsXUngAv6ySsbCIhVynf8_djardLZYEDOe0/edit?tab=t.0#heading=h.va2ituwwqcf3 - https://github.com/JhumanJ/OpnForm/pull/900/commits/11e99960e14ca986b1a001a56e7533223d2cfa5b
CVE ID: CVE-2025-11442 State: PUBLISHED Published: 2025-10-08T07:32:05.380Z Last Updated: 2025-10-08T13:19:45.546Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N/E:POC/RL:ND/RC:C) Vendors: JhumanJ Products: OpnForm Problem Types: CWE-352, CWE-862 Description: A security flaw has been discovered in JhumanJ OpnForm up to 1.9.3. The impacted element is an unknown function of the component API Endpoint. The manipulation results in cross-site request forgery. The attack may be performed from remote. The exploit has been released to the public and may be exploited. The vendor has stated that API calls require authentication through Authorization Bearer Tokens, so classic CSRF attacks do not appl
as stated that API calls require authentication through Authorization Bearer Tokens, so classic CSRF attacks do not apply here. An attacker would need to possess the JWT through means such as XSS which were mitigated, disabling any form of initial access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.327379 - https://vuldb.com/?ctiid.327379 - https://vuldb.com/?submit.666889 - https://docs.google.com/document/d/1GUjJA9vUbsXUngAv6ySsbCIhVynf8_djardLZYEDOe0/edit?tab=t.0#heading=h.w5b1nllxwvdq
CVE ID: CVE-2025-11443 State: PUBLISHED Published: 2025-10-08T07:32:07.900Z Last Updated: 2025-10-08T13:16:46.766Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:C) Vendors: JhumanJ Products: OpnForm Problem Types: CWE-203, CWE-200 Description: A weakness has been identified in JhumanJ OpnForm up to 1.9.3. This affects an unknown function of the file /api/password/email of the component Forgotten Password Handler. This manipulation causes information exposure through discrepancy. It is possible to initiate the attack remotely. The attack is considered to have high complexity. The exploitability is reported as difficult. The exploit has been made available to
considered to have high complexity. The exploitability is reported as difficult. The exploit has been made available to the public and could be exploited. This issue is currently aligned with Laravel issue #46465, which is why no mitigation action was taken. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.327380 - https://vuldb.com/?ctiid.327380 - https://vuldb.com/?submit.666890 - https://docs.google.com/document/d/1GUjJA9vUbsXUngAv6ySsbCIhVynf8_djardLZYEDOe0/edit?tab=t.0#heading=h.my0ldciyllp
CVE ID: CVE-2025-11444 State: PUBLISHED Published: 2025-10-08T08:02:10.203Z Last Updated: 2025-10-08T13:15:16.782Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR) Vendors: TOTOLINK Products: N600R Problem Types: CWE-120, CWE-119 Description: A security vulnerability has been detected in TOTOLINK N600R up to 4.3.0cu.7866_B20220506. This impacts the function setWiFiBasicConfig of the file /cgi-bin/cstecgi.cgi of the component HTTP Request Handler. Such manipulation of the argument wepkey leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: Reference
y. The exploit has been disclosed publicly and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.327381 - https://vuldb.com/?ctiid.327381 - https://vuldb.com/?submit.666915 - https://github.com/z472421519/BinaryAudit/blob/main/PoC/BOF/TOTOLINK/wepkey/wepkey.md - https://github.com/z472421519/BinaryAudit/blob/main/PoC/BOF/TOTOLINK/wepkey/wepkey.md#reproduce - https://www.totolink.net/
CVE ID: CVE-2025-11445 State: PUBLISHED Published: 2025-10-08T08:32:07.925Z Last Updated: 2025-10-08T13:09:54.569Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:OF/RC:C) Vendors: n/a Products: Kilo Code Problem Types: CWE-74, CWE-707 Description: A vulnerability was detected in Kilo Code up to 4.86.0. Affected is the function ClineProvider of the file src/core/webview/ClineProvider.ts of the component Prompt Handler. Performing manipulation results in injection. The attack can be initiated remotely. The exploit is now public and may be used. Applying a patch is the recommended action to fix this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vul
s the recommended action to fix this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.327382 - https://vuldb.com/?ctiid.327382 - https://vuldb.com/?submit.667004 - https://mcpsec.dev/advisories/2025-10-02-kilo-code-ai-agent-supply-chain-attack/ - https://github.com/Kilo-Org/kilocode/pull/2244 - https://github.com/Kilo-Org/kilocode/pull/2244/commits/2fdddf89edba41ec3a527134e485a3388c464333
CVE ID: CVE-2025-11446 State: PUBLISHED Published: 2025-11-19T08:53:12.765Z Last Updated: 2025-11-19T17:19:34.530Z Vendors: upKeeper Solutions Products: upKeeper Manager Problem Types: CWE-532 Description: Insertion of Sensitive Information into Log File vulnerability in upKeeper Solutions upKeeper Manager allows Use of Known Domain Credentials.This issue affects upKeeper Manager: from 5.2.0 before 5.2.12. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.upkeeper.se/hc/en-us/articles/23693858370076-CVE-2025-11446-Insertion-of-Sensitive-Information-into-Log-File
CVE ID: CVE-2025-11447 State: PUBLISHED Published: 2025-10-27T00:05:19.810Z Last Updated: 2025-10-28T14:58:37.798Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: GitLab Products: GitLab Problem Types: CWE-770 Description: GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.0 before 18.3.5, 18.4 before 18.4.3, and 18.5 before 18.5.1 that could have allowed an unauthenticated attacker to cause a denial of service condition by sending GraphQL requests with crafted JSON payloads. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://about.gitlab.com/releases/2025/10/22/patch-release-gitlab-18-5-1-released/ - https://gi
nrichment: References: - https://about.gitlab.com/releases/2025/10/22/patch-release-gitlab-18-5-1-released/ - https://gitlab.com/gitlab-org/gitlab/-/issues/574858 - https://hackerone.com/reports/3367019
CVE ID: CVE-2025-11448 State: PUBLISHED Published: 2025-11-08T09:28:11.104Z Last Updated: 2025-11-10T14:13:43.112Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: smub Products: Gallery Plugin for WordPress – Envira Photo Gallery Problem Types: CWE-862 Description: The Gallery Plugin for WordPress – Envira Photo Gallery plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the '/envira-convert/v1/bulk-convert' REST API endpoint in all versions up to, and including, 1.11.0. This makes it possible for authenticated attackers, with contributor-level access and above, to convert galleries to Envira galleries
possible for authenticated attackers, with contributor-level access and above, to convert galleries to Envira galleries. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/900e6528-f350-4e1b-80a5-aa01248323a8?source=cve - https://plugins.trac.wordpress.org/changeset/3387243/envira-gallery-lite/trunk/includes/global/convert_gallery/Convert_Gallery_REST.php?old=3379688&old_path=envira-gallery-lite%2Ftrunk%2Fincludes%2Fglobal%2Fconvert_gallery%2FConvert_Gallery_REST.php
CVE ID: CVE-2025-11449 State: PUBLISHED Published: 2025-10-10T01:15:41.132Z Last Updated: 2025-10-10T18:35:33.224Z Vendors: ServiceNow Products: ServiceNow AI Platform Problem Types: CWE-79 Description: ServiceNow has addressed a reflected cross-site scripting vulnerability that was identified in the ServiceNow AI Platform. This vulnerability could result in arbitrary code being executed within the browsers of ServiceNow users who click on a specially crafted link. ServiceNow has addressed this vulnerability by deploying a relevant security update to the majority of hosted instances. Relevant security updates also have been provided to ServiceNow self-hosted customers, partners, and hosted c
instances. Relevant security updates also have been provided to ServiceNow self-hosted customers, partners, and hosted customers with unique configuration. Further, the vulnerability is addressed in the listed patches and hot fixes. We recommend customers promptly apply appropriate updates or upgrade if they have not already done so. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB2552817
CVE ID: CVE-2025-11450 State: PUBLISHED Published: 2025-10-10T01:09:54.850Z Last Updated: 2025-10-10T14:40:03.256Z Vendors: ServiceNow Products: ServiceNow AI Platform Problem Types: CWE-79 Description: ServiceNow has addressed a reflected cross-site scripting vulnerability that was identified in the ServiceNow AI Platform. This vulnerability could result in arbitrary code being executed within the browsers of ServiceNow users who click on a specially crafted link. ServiceNow has addressed this vulnerability by deploying a relevant security update to the majority of hosted instances. Relevant security updates also have been provided to ServiceNow self-hosted customers, partners, and hosted c
instances. Relevant security updates also have been provided to ServiceNow self-hosted customers, partners, and hosted customers with unique configurations. Further, the vulnerability is addressed in the listed patches and hot fixes. We recommend customers promptly apply appropriate updates or upgrade if they have not already done so. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB2552817
CVE ID: CVE-2025-11451 State: PUBLISHED Published: 2025-11-11T03:30:39.282Z Last Updated: 2025-11-12T20:07:20.166Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: miunosoft Products: Auto Amazon Links – Amazon Associates Affiliate Plugin Problem Types: CWE-73 Description: The Auto Amazon Links – Amazon Associates Affiliate Plugin plugin for WordPress is vulnerable to arbitrary files reads in all versions up to, and including, 5.4.3 via the '/wp-json/wp/v2/aal_ajax_unit_loading' RST API endpoint. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. Additional Analyst
ckers to read the contents of arbitrary files on the server, which can contain sensitive information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/568254a4-400d-45ea-8a96-1669b0694d70?source=cve - https://plugins.trac.wordpress.org/browser/amazon-auto-links/trunk/include/core/component/unit/_common/output/_abstract/AmazonAutoLinks_UnitOutput_Base.php - https://plugins.trac.wordpress.org/browser/amazon-auto-links/trunk/include/core/component/unit/_common/option/template/AmazonAutoLinks_UnitOutput__TemplatePath.php
CVE ID: CVE-2025-11452 State: PUBLISHED Published: 2025-11-08T02:28:01.507Z Last Updated: 2025-11-10T20:18:16.371Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: asgaros Products: Asgaros Forum Problem Types: CWE-89 Description: The Asgaros Forum plugin for WordPress is vulnerable to SQL Injection via the '$_COOKIE['asgarosforum_unread_exclude']' cookie in all versions up to, and including, 3.1.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract s
r unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/75d66a45-5bb9-4e82-acd5-e0b92e3870a9?source=cve - https://github.com/Asgaros/asgaros-forum/commit/41e499f26cb534c55587c35496e6f9056753b942 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3388337%40asgaros-forum&new=3388337%40asgaros-forum&sfp_email=&sfph_mail=
CVE ID: CVE-2025-11454 State: PUBLISHED Published: 2025-11-12T11:05:38.743Z Last Updated: 2025-11-12T14:15:38.335Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: giuse Products: Specific Content For Mobile – Customize the mobile version without redirections Problem Types: CWE-89 Description: The Specific Content For Mobile – Customize the mobile version without redirections plugin for WordPress is vulnerable to SQL Injection via the eos_scfm_duplicate_post_as_draft() function in all versions up to, and including, 0.5.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it poss
escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with COntributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/6ed99dfd-6ca6-41e7-a844-d53eec7068c1?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3387807%40specific-content-for-mobile&new=3387807%40specific-content-for-mobile&sfp_email=&sfph_mail=