Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-11510 State: PUBLISHED Published: 2025-10-18T06:42:47.037Z Last Updated: 2025-10-20T19:02:03.165Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: ninjateam Products: FileBird – WordPress Media Library Folders & File Manager Problem Types: CWE-285 Description: The FileBird – WordPress Media Library Folders & File Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the /filebird/v1/fb-wipe-clear-all-data function in all versions up to, and including, 6.4.9. This makes it possible for authenticated attackers, with author-level access and above, to reset all of the plugin's configu
makes it possible for authenticated attackers, with author-level access and above, to reset all of the plugin's configuration data. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/60ed7738-5cba-4fc0-9178-265773555369?source=cve - https://plugins.trac.wordpress.org/changeset/3379856/filebird/trunk/includes/Classes/Convert.php
CVE ID: CVE-2025-11511 State: PUBLISHED Published: 2025-10-08T23:02:07.101Z Last Updated: 2025-10-14T14:18:00.803Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: E-Commerce Website Problem Types: CWE-89, CWE-74 Description: A flaw has been found in code-projects E-Commerce Website 1.0. Affected is an unknown function of the file /pages/supplier_add.php. Executing manipulation of the argument supp_email can lead to sql injection. The attack may be launched remotely. The exploit has been published and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.327635 - https://vuldb.com/?ctiid.32763
onal Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.327635 - https://vuldb.com/?ctiid.327635 - https://vuldb.com/?submit.669489 - https://github.com/Blowingwinds/cve-report/blob/main/cve4/report.md - https://code-projects.org/
CVE ID: CVE-2025-11512 State: PUBLISHED Published: 2025-10-08T23:32:06.161Z Last Updated: 2025-10-09T14:33:52.022Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: Voting System Problem Types: CWE-79, CWE-94 Description: A vulnerability was found in code-projects Voting System 1.0. Affected by this issue is some unknown functionality of the file /admin/voters_add.php. The manipulation of the argument Firstname/Lastname/Platform results in cross site scripting. The attack can be executed remotely. The exploit has been made public and could be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.327637
public and could be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.327637 - https://vuldb.com/?ctiid.327637 - https://vuldb.com/?submit.669497 - https://github.com/underatted/CVE/issues/14 - https://code-projects.org/
CVE ID: CVE-2025-11513 State: PUBLISHED Published: 2025-10-08T23:32:08.829Z Last Updated: 2025-10-09T14:33:45.281Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: E-Commerce Website Problem Types: CWE-89, CWE-74 Description: A vulnerability was determined in code-projects E-Commerce Website 1.0. This affects an unknown part of the file /pages/supplier_update.php. This manipulation of the argument supp_id causes sql injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.327638 - https:/
may be utilized. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.327638 - https://vuldb.com/?ctiid.327638 - https://vuldb.com/?submit.669747 - https://github.com/cxm947/CVE-report-251006 - https://code-projects.org/
CVE ID: CVE-2025-11514 State: PUBLISHED Published: 2025-10-09T00:02:06.047Z Last Updated: 2025-10-09T14:14:06.428Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: Online Complaint Site Problem Types: CWE-89, CWE-74 Description: A vulnerability was identified in code-projects Online Complaint Site 1.0. This vulnerability affects unknown code of the file /cms/users/index.php. Such manipulation of the argument Username leads to sql injection. The attack may be performed from remote. The exploit is publicly available and might be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.327639 - https://vul
ght be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.327639 - https://vuldb.com/?ctiid.327639 - https://vuldb.com/?submit.669812 - https://github.com/Aurion365/cve/issues/1 - https://code-projects.org/
CVE ID: CVE-2025-11515 State: PUBLISHED Published: 2025-10-09T00:02:08.598Z Last Updated: 2025-10-09T14:12:10.216Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: Online Complaint Site Problem Types: CWE-89, CWE-74 Description: A security flaw has been discovered in code-projects Online Complaint Site 1.0. This issue affects some unknown processing of the file /cms/users/register-complaint.php. Performing manipulation of the argument cid results in sql injection. It is possible to initiate the attack remotely. The exploit has been released to the public and may be exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: References:
it has been released to the public and may be exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.327640 - https://vuldb.com/?ctiid.327640 - https://vuldb.com/?submit.669813 - https://github.com/Aurion365/cve/issues/2 - https://code-projects.org/
CVE ID: CVE-2025-11516 State: PUBLISHED Published: 2025-10-09T00:32:05.593Z Last Updated: 2025-10-09T19:20:41.864Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: Online Complaint Site Problem Types: CWE-89, CWE-74 Description: A weakness has been identified in code-projects Online Complaint Site 1.0. Impacted is an unknown function of the file /cms/users/complaint-details.php. Executing manipulation of the argument cid can lead to sql injection. It is possible to launch the attack remotely. The exploit has been made available to the public and could be exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://v
ailable to the public and could be exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.327641 - https://vuldb.com/?ctiid.327641 - https://vuldb.com/?submit.669814 - https://github.com/Aurion365/cve/issues/3 - https://code-projects.org/
CVE ID: CVE-2025-11517 State: PUBLISHED Published: 2025-10-18T06:42:43.892Z Last Updated: 2025-10-20T19:01:23.289Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: theeventscalendar Products: Event Tickets and Registration Problem Types: CWE-639 Description: The Event Tickets and Registration plugin for WordPress is vulnerable to payment bypass in all versions up to, and including, 5.26.5. This is due to the /wp-json/tribe/tickets/v1/commerce/free/order endpoint not verifying that a ticket type should be free allowing the user to bypass the payment. This makes it possible for unauthenticated attackers to obtain access to paid tickets, without paying for them, c
yment. This makes it possible for unauthenticated attackers to obtain access to paid tickets, without paying for them, causing a loss of revenue for the target. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/21cd8cb8-2a29-4b66-ab7a-8d8b2f85e2e0?source=cve - https://plugins.trac.wordpress.org/changeset/3378214/event-tickets/tags/5.26.6/src/Tickets/Commerce/Gateways/Free/REST/Order_Endpoint.php
CVE ID: CVE-2025-11518 State: PUBLISHED Published: 2025-10-11T08:29:16.871Z Last Updated: 2025-10-14T14:11:19.421Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: wpclever Products: WPC Smart Wishlist for WooCommerce Problem Types: CWE-639 Description: The WPC Smart Wishlist for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.0.3 via several wishlist AJAX functions due to missing validation on a user controlled key that is exposed when wishlists are shared. This makes it possible for unauthenticated attackers to empty and add to other user's wishlists, if they have access to the key.
s it possible for unauthenticated attackers to empty and add to other user's wishlists, if they have access to the key. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/afe275b4-edc0-4b19-a91f-5099a085e8ce?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3375421%40woo-smart-wishlist&new=3375421%40woo-smart-wishlist&sfp_email=&sfph_mail=
CVE ID: CVE-2025-11519 State: PUBLISHED Published: 2025-10-18T06:42:47.493Z Last Updated: 2025-10-20T19:02:49.385Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: optimole Products: Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization Problem Types: CWE-639 Description: The Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.1.0 via the /wp-json/optml/v1/move_image REST API endpoint due to missing validation on a user controlled key. This makes it possible for authenticated attac
age REST API endpoint due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Author-level access and above, to offload media that doesn't belong to them. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/9288ed60-b14b-4188-84d4-efe770093551?source=cve - https://research.cleantalk.org/CVE-2025-11519 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3378645%40optimole-wp&new=3378645%40optimole-wp&sfp_email=&sfph_mail=
CVE ID: CVE-2025-11521 State: PUBLISHED Published: 2025-11-11T03:30:52.495Z Last Updated: 2025-11-12T20:04:28.579Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: astrasecuritysuite Products: Astra Security Suite – Firewall & Malware Scan Problem Types: CWE-285 Description: The Astra Security Suite – Firewall & Malware Scan plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient validation of remote URLs for zip downloads and an easily guessable key in all versions up to, and including, 0.2. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution
unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f99a6b5c-e95d-49d0-a4b2-1d7188447da1?source=cve - https://wordpress.org/plugins/getastra/
CVE ID: CVE-2025-11522 State: PUBLISHED Published: 2025-10-09T07:23:51.749Z Last Updated: 2025-10-09T15:18:44.769Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Elated-Themes Products: Search & Go - Directory WordPress Theme Problem Types: CWE-288 Description: The Search & Go - Directory WordPress Theme theme for WordPress is vulnerable to Authentication Bypass via account takeover in all versions up to, and including, 2.7. This is due to insufficient user validation in the search_and_go_elated_check_facebook_user() function This makes it possible for unauthenticated attackers to gain access to other user's accounts, including administrators, when Facebo
it possible for unauthenticated attackers to gain access to other user's accounts, including administrators, when Facebook login is enabled. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/da590a65-8728-4577-b6e4-ecebc2a2277d?source=cve - https://themeforest.net/item/search-go-modern-smart-directory-theme/15365040
CVE ID: CVE-2025-11523 State: PUBLISHED Published: 2025-10-09T01:02:07.640Z Last Updated: 2025-10-09T19:19:43.118Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: Tenda Products: AC7 Problem Types: CWE-77, CWE-74 Description: A vulnerability was detected in Tenda AC7 15.03.06.44. This vulnerability affects unknown code of the file /goform/AdvSetLanip. The manipulation of the argument lanIp results in command injection. It is possible to launch the attack remotely. The exploit is now public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.327661 - https://vuldb.com/?ctiid.327661 - https://vuldb.com/?submit.6
Vulnrichment: References: - https://vuldb.com/?id.327661 - https://vuldb.com/?ctiid.327661 - https://vuldb.com/?submit.669849 - https://github.com/noahze01/IoT-vulnerable/blob/main/Tenda/AC7/AdvSetLanip.md - https://www.tenda.com.cn/
CVE ID: CVE-2025-11524 State: PUBLISHED Published: 2025-10-09T01:02:11.216Z Last Updated: 2025-10-09T19:18:13.658Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR) Vendors: Tenda Products: AC7 Problem Types: CWE-121, CWE-119 Description: A flaw has been found in Tenda AC7 15.03.06.44. This issue affects some unknown processing of the file /goform/SetDDNSCfg. This manipulation of the argument ddnsEn causes stack-based buffer overflow. The attack can be initiated remotely. The exploit has been published and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.327662 - https://vuldb.com/?ctiid.327662 - https://vuldb.com/?submit.6
Vulnrichment: References: - https://vuldb.com/?id.327662 - https://vuldb.com/?ctiid.327662 - https://vuldb.com/?submit.669852 - https://github.com/noahze01/IoT-vulnerable/blob/main/Tenda/AC7/SetDDNSCfg.md - https://www.tenda.com.cn/
CVE ID: CVE-2025-11525 State: PUBLISHED Published: 2025-10-09T01:32:06.484Z Last Updated: 2025-10-09T18:14:22.911Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR) Vendors: Tenda Products: AC7 Problem Types: CWE-121, CWE-119 Description: A vulnerability has been found in Tenda AC7 15.03.06.44. Impacted is an unknown function of the file /goform/SetUpnpCfg. Such manipulation of the argument upnpEn leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.327663 - https://vuldb.com/?ctiid.327663 - https://vuldb.
: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.327663 - https://vuldb.com/?ctiid.327663 - https://vuldb.com/?submit.669853 - https://vuldb.com/?submit.669860 - https://github.com/noahze01/IoT-vulnerable/blob/main/Tenda/AC7/SetUpnpCfg.md - https://www.tenda.com.cn/
CVE ID: CVE-2025-11526 State: PUBLISHED Published: 2025-10-09T02:32:10.251Z Last Updated: 2025-10-14T14:17:36.028Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR) Vendors: Tenda Products: AC7 Problem Types: CWE-121, CWE-119 Description: A vulnerability was found in Tenda AC7 15.03.06.44. The affected element is an unknown function of the file /goform/WifiMacFilterSet. Performing manipulation of the argument wifi_chkHz results in stack-based buffer overflow. The attack may be initiated remotely. The exploit has been made public and could be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.327664 - https://vuldb.com/?ctiid.327664
al Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.327664 - https://vuldb.com/?ctiid.327664 - https://vuldb.com/?submit.669854 - https://vuldb.com/?submit.669861 - https://github.com/noahze01/IoT-vulnerable/blob/main/Tenda/AC7/WifiMacFilterSet.md - https://www.tenda.com.cn/
CVE ID: CVE-2025-11527 State: PUBLISHED Published: 2025-10-09T02:32:13.681Z Last Updated: 2025-10-14T14:17:21.858Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR) Vendors: Tenda Products: AC7 Problem Types: CWE-121, CWE-119 Description: A vulnerability was determined in Tenda AC7 15.03.06.44. The impacted element is an unknown function of the file /goform/fast_setting_pppoe_set. Executing manipulation of the argument Password can lead to stack-based buffer overflow. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.327665 - https://vuldb.c
tilized. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.327665 - https://vuldb.com/?ctiid.327665 - https://vuldb.com/?submit.669856 - https://github.com/noahze01/IoT-vulnerable/blob/main/Tenda/AC7/fast_setting_pppoe_set.md - https://www.tenda.com.cn/
CVE ID: CVE-2025-11528 State: PUBLISHED Published: 2025-10-09T03:02:07.634Z Last Updated: 2025-10-09T14:33:29.636Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR) Vendors: Tenda Products: AC7 Problem Types: CWE-121, CWE-119 Description: A vulnerability was identified in Tenda AC7 15.03.06.44. This affects an unknown function of the file /goform/saveAutoQos. The manipulation of the argument enable leads to stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.327666 - https://vuldb.com/?ctiid.327666 - https://vuld
es: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.327666 - https://vuldb.com/?ctiid.327666 - https://vuldb.com/?submit.669859 - https://github.com/noahze01/IoT-vulnerable/blob/main/Tenda/AC7/saveAutoQos.md - https://www.tenda.com.cn/
CVE ID: CVE-2025-11529 State: PUBLISHED Published: 2025-10-09T03:02:11.993Z Last Updated: 2025-10-09T14:33:23.789Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:OF/RC:C) Vendors: n/a Products: ChurchCRM Problem Types: CWE-306, CWE-287 Description: A security flaw has been discovered in ChurchCRM up to 5.18.0. This impacts the function AuthMiddleware of the file src/ChurchCRM/Slim/Middleware/AuthMiddleware.php of the component API Endpoint. The manipulation results in missing authentication. The attack can be executed remotely. The exploit has been released to the public and may be exploited. The patch is identified as 3a1cffd2aea63d884025949cfbcfd274d06216a4. A patch should be
the public and may be exploited. The patch is identified as 3a1cffd2aea63d884025949cfbcfd274d06216a4. A patch should be applied to remediate this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.327667 - https://vuldb.com/?ctiid.327667 - https://vuldb.com/?submit.669916 - https://github.com/uartu0/advisories/blob/main/churchcrm-api-auth-bypass-2025.md - https://github.com/ChurchCRM/CRM/pull/7376 - https://github.com/ChurchCRM/CRM/commit/3a1cffd2aea63d884025949cfbcfd274d06216a4
CVE ID: CVE-2025-11530 State: PUBLISHED Published: 2025-10-09T03:32:05.357Z Last Updated: 2025-10-09T13:33:09.173Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: Online Complaint Site Problem Types: CWE-89, CWE-74 Description: A weakness has been identified in code-projects Online Complaint Site 1.0. Affected is an unknown function of the file /cms/admin/state.php. This manipulation of the argument state causes sql injection. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.32
public and could be exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.327668 - https://vuldb.com/?ctiid.327668 - https://vuldb.com/?submit.670208 - https://github.com/xmqaq/cve/issues/1 - https://code-projects.org/
CVE ID: CVE-2025-11532 State: PUBLISHED Published: 2025-11-11T03:30:47.370Z Last Updated: 2025-11-12T20:05:28.344Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: softivus Products: Wisly Problem Types: CWE-639 Description: The Wisly plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.0.0 due to missing validation on the 'wishlist_id' user controlled key. This makes it possible for unauthenticated attackers to remove and add items to other user's wishlists. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b311b404-f808-40fc-9f0
- CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b311b404-f808-40fc-9f09-4eac05bce798?source=cve - https://wordpress.org/plugins/wisly/
CVE ID: CVE-2025-11533 State: PUBLISHED Published: 2025-10-11T07:25:56.458Z Last Updated: 2025-10-14T14:12:42.701Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: ApusTheme Products: WP Freeio Problem Types: CWE-269 Description: The WP Freeio plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.2.21. This is due to the process_register() function not restricting what user roles a user can register with. This makes it possible for unauthenticated attackers to supply the 'administrator' role during registration and gain administrator access to the site. Additional Analyst Notes: - CISA ADP Vulnrichment: Reference
ing registration and gain administrator access to the site. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/0db85f84-04e9-42eb-a16b-96554fbfd186?source=cve - https://themeforest.net/item/freeio-freelance-marketplace-wordpress-theme/42045416
CVE ID: CVE-2025-11534 State: PUBLISHED Published: 2025-10-21T16:59:29.846Z Last Updated: 2025-10-21T19:39:16.122Z Vendors: Raisecomm Products: RAX701-GC-WP-01 P200R002C52, RAX701-GC-WP-01 P200R002C53 Problem Types: CWE-288 Description: The affected Raisecom devices allow SSH sessions to be established without completing user authentication. This could allow attackers to gain shell access without valid credentials. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-25-294-06 - https://www.runzero.com/advisories/raisecom-ssh-bypass-cve-2025-11534/
CVE ID: CVE-2025-11535 State: PUBLISHED Published: 2025-10-08T22:07:18.498Z Last Updated: 2025-10-10T03:55:24.212Z Vendors: MongoDB Inc Products: MongoDB Connector for BI Problem Types: CWE-276 Description: MongoDB Connector for BI installation via MSI on Windows leaves ACLs unset on custom install directories allows Privilege Escalation.This issue affects MongoDB Connector for BI: from 2.0.0 through 2.14.24. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.mongodb.com/docs/bi-connector/current/release-notes/#bi-2.14.25
CVE ID: CVE-2025-11536 State: PUBLISHED Published: 2025-10-20T21:23:48.282Z Last Updated: 2025-10-21T14:09:22.901Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N) Vendors: bdthemes Products: Element Pack Addons for Elementor Problem Types: CWE-918 Description: The Element Pack Addons for Elementor plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 8.2.5 via the wp_ajax_import_elementor_template action. This makes it possible for authenticated attackers, with Subscriber-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify inf