Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-11895 State: PUBLISHED Published: 2025-10-17T09:26:39.563Z Last Updated: 2025-10-17T13:05:27.926Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: letscms Products: Binary MLM Plan Problem Types: CWE-639 Description: The Binary MLM Plan plugin for WordPress is vulnerable to insecure direct object reference in versions up to, and including, 3.0. This is due to the bmp_user_payout_detail_of_current_user() function selecting payout records solely by id without verifying ownership. This makes it possible for authenticated attackers with the bmp_user role (often subscribers) to view other members' payout summaries via direct requests to the /bmp-a
ers with the bmp_user role (often subscribers) to view other members' payout summaries via direct requests to the /bmp-account-detail/ endpoint with a crafted payout-id parameter granted they can access the shortcode output. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/adba7d0c-29ca-49c5-ac75-bb79d62f6107?source=cve - https://plugins.trac.wordpress.org/browser/binary-mlm-plan/trunk/includes/bmp-hook-functions.php#L833
CVE ID: CVE-2025-11896 State: PUBLISHED Published: 2025-10-16T21:59:45.136Z Last Updated: 2025-10-17T13:49:40.937Z Vendors: Xpdf Products: Xpdf Problem Types: CWE-674 Description: In Xpdf 4.05 (and earlier), a PDF object loop in a CMap, via the "UseCMap" entry, leads to infinite recursion and a stack overflow. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.xpdfreader.com/security-bug/object-loops.html
CVE ID: CVE-2025-11897 State: PUBLISHED Published: 2025-10-25T12:26:28.878Z Last Updated: 2025-10-27T15:29:28.780Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: Dream-Theme Products: The7 — Website and eCommerce Builder for WordPress Problem Types: CWE-79 Description: The The7 — Website and eCommerce Builder for WordPress theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘ the7_fancy_title_css’ parameter in all versions up to, and including, 12.9.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in
es it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d26c7cd4-7548-421f-ace0-7f9dce16b0dc?source=cve - https://themeforest.net/item/the7-responsive-multipurpose-wordpress-theme/5556590#item-description__recent-updates
CVE ID: CVE-2025-11898 State: PUBLISHED Published: 2025-10-17T03:41:53.022Z Last Updated: 2025-10-17T14:26:05.635Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Flowring Technology Products: Agentflow Problem Types: CWE-23 Description: Agentflow developed by Flowring has an Arbitrary File Reading vulnerability, allowing unauthenticated remote attackers to exploit Relative Path Traversal to download arbitrary system files. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-10438-1173e-1.html - https://www.twcert.org.tw/en/cp-139-10439-0bd15-2.html
CVE ID: CVE-2025-11899 State: PUBLISHED Published: 2025-10-17T03:44:54.733Z Last Updated: 2025-10-17T14:25:41.468Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Flowring Technology Products: Agentflow Problem Types: CWE-321 Description: Agentflow developed by Flowring has an Use of Hard-coded Cryptographic Key vulnerability, allowing unauthenticated remote attackers to exploit the fixed key to generate verification information, thereby logging into the system as any user. Attacker must first obtain an user ID in order to exploit this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-10438-1173
ability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-10438-1173e-1.html - https://www.twcert.org.tw/en/cp-139-10439-0bd15-2.html
CVE ID: CVE-2025-11900 State: PUBLISHED Published: 2025-10-17T03:50:44.524Z Last Updated: 2025-10-17T14:25:15.078Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: HGiga Products: iSherlock 4.5, iSherlock 5.5 Problem Types: CWE-78 Description: The iSherlock developed by HGiga has an OS Command Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary OS commands and execute them on the server. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-10440-dd55d-1.html - https://www.twcert.org.tw/en/cp-139-10441-00aaf-2.html
CVE ID: CVE-2025-11902 State: PUBLISHED Published: 2025-10-17T14:02:05.201Z Last Updated: 2025-10-17T14:40:34.841Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: yanyutao0402 Products: ChanCMS Problem Types: CWE-89, CWE-74 Description: A vulnerability was detected in yanyutao0402 ChanCMS up to 3.3.2. Affected by this vulnerability is the function findField of the file /cms/article/findField. Performing manipulation of the argument cid results in sql injection. The attack can be initiated remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP
e vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.328912 - https://vuldb.com/?ctiid.328912 - https://vuldb.com/?submit.670262 - https://github.com/NarcherAlter/Security_Note/blob/main/Vulnerability_Discovery/ChanCMSv3.3.2.md - https://github.com/NarcherAlter/Security_Note/blob/main/Vulnerability_Discovery/ChanCMSv3.3.2.md#cmsarticlefindfield
CVE ID: CVE-2025-11903 State: PUBLISHED Published: 2025-10-17T14:02:07.265Z Last Updated: 2025-10-17T14:34:18.885Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: yanyutao0402 Products: ChanCMS Problem Types: CWE-89, CWE-74 Description: A flaw has been found in yanyutao0402 ChanCMS up to 3.3.2. Affected by this issue is the function update of the file /cms/article/update. Executing manipulation of the argument cid can lead to sql injection. The attack can be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: Ref
acted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.328913 - https://vuldb.com/?ctiid.328913 - https://vuldb.com/?submit.670271 - https://github.com/NarcherAlter/Security_Note/blob/main/Vulnerability_Discovery/ChanCMSv3.3.2.md#111 - https://github.com/NarcherAlter/Security_Note/blob/main/Vulnerability_Discovery/ChanCMSv3.3.2.md#cmsarticleupdate
CVE ID: CVE-2025-11904 State: PUBLISHED Published: 2025-10-17T15:02:05.703Z Last Updated: 2025-10-17T15:21:58.828Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: yanyutao0402 Products: ChanCMS Problem Types: CWE-89, CWE-74 Description: A vulnerability has been found in yanyutao0402 ChanCMS up to 3.3.2. This affects the function hasUse of the file /cms/model/hasUse. The manipulation of the argument ID leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: Refe
cted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.328914 - https://vuldb.com/?ctiid.328914 - https://vuldb.com/?submit.670274 - https://github.com/NarcherAlter/Security_Note/blob/main/Vulnerability_Discovery/ChanCMSv3.3.2.md#222 - https://github.com/NarcherAlter/Security_Note/blob/main/Vulnerability_Discovery/ChanCMSv3.3.2.md#cmsmodelhasuse
CVE ID: CVE-2025-11905 State: PUBLISHED Published: 2025-10-17T15:32:06.106Z Last Updated: 2025-10-17T15:50:45.808Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: yanyutao0402 Products: ChanCMS Problem Types: CWE-94, CWE-74 Description: A vulnerability was found in yanyutao0402 ChanCMS up to 3.3.2. This vulnerability affects the function getArticle of the file app\modules\cms\controller\gather.js. The manipulation results in code injection. The attack may be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment:
contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.328915 - https://vuldb.com/?ctiid.328915 - https://vuldb.com/?submit.671338 - https://github.com/NarcherAlter/Security_Note/blob/main/Vulnerability_Discovery/ChanCMSv3.3.2.md#555 - https://github.com/NarcherAlter/Security_Note/blob/main/Vulnerability_Discovery/ChanCMSv3.3.2.md#cmsgathergetarticle
CVE ID: CVE-2025-11906 State: PUBLISHED Published: 2025-10-30T07:39:38.530Z Last Updated: 2025-10-31T03:55:28.727Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Progress Software Products: Flowmon Problem Types: CWE-732 Description: A vulnerability exists in Progress Flowmon versions prior 12.5.6 where certain system configuration files have incorrect file permissions, allowing a user with access to the default flowmon system user account used for SSH access to potentially escalate privileges to root during service initialization. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://community.progress.com/s/article/Progress-Flowmon-CVE-
nal Analyst Notes: - CISA ADP Vulnrichment: References: - https://community.progress.com/s/article/Progress-Flowmon-CVE-2025-11906
CVE ID: CVE-2025-11908 State: PUBLISHED Published: 2025-10-17T18:32:05.126Z Last Updated: 2025-10-17T19:00:27.668Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: Shenzhen Ruiming Technology Products: Streamax Crocus Problem Types: CWE-434, CWE-284 Description: A security flaw has been discovered in Shenzhen Ruiming Technology Streamax Crocus 1.3.40. The affected element is the function uploadFile of the file /FileDir.do?Action=Upload. Performing manipulation of the argument File results in unrestricted upload. The attack is possible to be carried out remotely. The exploit has been released to the public and may be exploited. The vendor was contacted early abou
ried out remotely. The exploit has been released to the public and may be exploited. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.328918 - https://vuldb.com/?ctiid.328918 - https://vuldb.com/?submit.671391 - https://github.com/FightingLzn9/vul/blob/main/%E6%B7%B1%E5%9C%B3%E5%B8%82%E9%94%90%E6%98%8E%E6%8A%80%E6%9C%AF%E8%82%A1%E4%BB%BD%E6%9C%89%E9%99%90%E5%85%AC%E5%8F%B8Crocus%E7%B3%BB%E7%BB%9F.md
CVE ID: CVE-2025-11909 State: PUBLISHED Published: 2025-10-17T18:32:07.643Z Last Updated: 2025-10-17T18:59:37.177Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: Shenzhen Ruiming Technology Products: Streamax Crocus Problem Types: CWE-89, CWE-74 Description: A weakness has been identified in Shenzhen Ruiming Technology Streamax Crocus 1.3.40. The impacted element is the function queryLast of the file /RepairRecord.do?Action=QueryLast. Executing manipulation of the argument orderField can lead to sql injection. The attack may be performed from remote. The exploit has been made available to the public and could be exploited. The vendor was contacted early about
remote. The exploit has been made available to the public and could be exploited. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.328919 - https://vuldb.com/?ctiid.328919 - https://vuldb.com/?submit.671412 - https://github.com/FightingLzn9/vul/blob/main/%E6%B7%B1%E5%9C%B3%E5%B8%82%E9%94%90%E6%98%8E%E6%8A%80%E6%9C%AF%E8%82%A1%E4%BB%BD%E6%9C%89%E9%99%90%E5%85%AC%E5%8F%B8Crocus%E7%B3%BB%E7%BB%9F-2.md
CVE ID: CVE-2025-11910 State: PUBLISHED Published: 2025-10-17T19:32:05.414Z Last Updated: 2025-10-17T19:50:30.878Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: Shenzhen Ruiming Technology Products: Streamax Crocus Problem Types: CWE-89, CWE-74 Description: A security vulnerability has been detected in Shenzhen Ruiming Technology Streamax Crocus 1.3.40. This affects the function Query of the file /MemoryState.do?Action=Query. The manipulation of the argument orderField leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not
he exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.328920 - https://vuldb.com/?ctiid.328920 - https://vuldb.com/?submit.671437 - https://github.com/FightingLzn9/vul/blob/main/%E6%B7%B1%E5%9C%B3%E5%B8%82%E9%94%90%E6%98%8E%E6%8A%80%E6%9C%AF%E8%82%A1%E4%BB%BD%E6%9C%89%E9%99%90%E5%85%AC%E5%8F%B8Crocus%E7%B3%BB%E7%BB%9F-3.md
CVE ID: CVE-2025-11911 State: PUBLISHED Published: 2025-10-17T19:32:07.988Z Last Updated: 2025-10-17T19:52:31.061Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: Shenzhen Ruiming Technology Products: Streamax Crocus Problem Types: CWE-89, CWE-74 Description: A vulnerability was detected in Shenzhen Ruiming Technology Streamax Crocus 1.3.40. This impacts the function Query of the file /DeviceFault.do?Action=Query. The manipulation of the argument sortField results in sql injection. It is possible to launch the attack remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Addition
ow public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.328921 - https://vuldb.com/?ctiid.328921 - https://vuldb.com/?submit.671450 - https://github.com/FightingLzn9/vul/blob/main/%E6%B7%B1%E5%9C%B3%E5%B8%82%E9%94%90%E6%98%8E%E6%8A%80%E6%9C%AF%E8%82%A1%E4%BB%BD%E6%9C%89%E9%99%90%E5%85%AC%E5%8F%B8Crocus%E7%B3%BB%E7%BB%9F-4.md
CVE ID: CVE-2025-11912 State: PUBLISHED Published: 2025-10-17T20:02:05.763Z Last Updated: 2025-10-17T20:27:44.646Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: Shenzhen Ruiming Technology Products: Streamax Crocus Problem Types: CWE-89, CWE-74 Description: A flaw has been found in Shenzhen Ruiming Technology Streamax Crocus 1.3.40. Affected is the function Query of the file /DeviceState.do?Action=Query. This manipulation of the argument orderField causes sql injection. The attack can be initiated remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst No
may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.328922 - https://vuldb.com/?ctiid.328922 - https://vuldb.com/?submit.671455 - https://github.com/FightingLzn9/vul/blob/main/%E6%B7%B1%E5%9C%B3%E5%B8%82%E9%94%90%E6%98%8E%E6%8A%80%E6%9C%AF%E8%82%A1%E4%BB%BD%E6%9C%89%E9%99%90%E5%85%AC%E5%8F%B8Crocus%E7%B3%BB%E7%BB%9F-5.md
CVE ID: CVE-2025-11913 State: PUBLISHED Published: 2025-10-17T20:02:08.285Z Last Updated: 2025-10-17T20:30:04.588Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R) Vendors: Shenzhen Ruiming Technology Products: Streamax Crocus Problem Types: CWE-22 Description: A vulnerability has been found in Shenzhen Ruiming Technology Streamax Crocus 1.3.40. Affected by this vulnerability is the function Download of the file /Service.do?Action=Download. Such manipulation of the argument Path leads to path traversal. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure b
ly. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.328923 - https://vuldb.com/?ctiid.328923 - https://vuldb.com/?submit.671480 - https://github.com/FightingLzn9/vul/blob/main/%E6%B7%B1%E5%9C%B3%E5%B8%82%E9%94%90%E6%98%8E%E6%8A%80%E6%9C%AF%E8%82%A1%E4%BB%BD%E6%9C%89%E9%99%90%E5%85%AC%E5%8F%B8Crocus%E7%B3%BB%E7%BB%9F-6.md
CVE ID: CVE-2025-11914 State: PUBLISHED Published: 2025-10-17T20:32:05.981Z Last Updated: 2025-10-17T20:57:27.491Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R) Vendors: Shenzhen Ruiming Technology Products: Streamax Crocus Problem Types: CWE-22 Description: A vulnerability was found in Shenzhen Ruiming Technology Streamax Crocus 1.3.40. Affected by this issue is the function Download of the file /DeviceFileReport.do?Action=Download. Performing manipulation of the argument FilePath results in path traversal. The attack may be initiated remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure bu
ed remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.328924 - https://vuldb.com/?ctiid.328924 - https://vuldb.com/?submit.671483 - https://github.com/FightingLzn9/vul/blob/main/%E6%B7%B1%E5%9C%B3%E5%B8%82%E9%94%90%E6%98%8E%E6%8A%80%E6%9C%AF%E8%82%A1%E4%BB%BD%E6%9C%89%E9%99%90%E5%85%AC%E5%8F%B8Crocus%E7%B3%BB%E7%BB%9F-7.md
CVE ID: CVE-2025-11915 State: PUBLISHED Published: 2025-10-22T09:13:24.601Z Last Updated: 2025-10-23T09:23:21.342Z Vendors: Google Cloud Products: Vertex AI: Partner Models for MaaS, Vertex AI: Open Models for MaaS, Vertex AI: Self-Deployed Models Problem Types: CWE-444 Description: Connection desynchronization between an HTTP proxy and the model backend. The fixes were rolled out for all proxies in front of impacted models by 2025-09-28. Users do not need to take any action. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cloud.google.com/vertex-ai/generative-ai/docs/security-bulletins#gcp-2025-059
CVE ID: CVE-2025-11917 State: PUBLISHED Published: 2025-11-05T06:34:59.886Z Last Updated: 2025-11-05T15:45:19.848Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: etruel Products: WPeMatico RSS Feed Fetcher Problem Types: CWE-918 Description: The WPeMatico RSS Feed Fetcher plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.8.11 via the wpematico_test_feed() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal servic
rary locations originating from the web application and can be used to query and modify information from internal services. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/5a1c6377-c2a7-4344-86bd-d2797db19469?source=cve - https://plugins.trac.wordpress.org/browser/wpematico/tags/2.8.11/app/campaign_edit.php#L24 - https://plugins.trac.wordpress.org/browser/wpematico/tags/2.8.11/app/wpematico_functions.php#L1249 - https://plugins.trac.wordpress.org/browser/wpematico/tags/2.8.11/app/wpematico_functions.php#L1260 - https://github.com/etruel/wpematico/commit/7a281dcfc0868490d62caee54f3b743708fed7cf
CVE ID: CVE-2025-11918 State: PUBLISHED Published: 2025-11-14T13:28:39.453Z Last Updated: 2025-11-14T15:44:16.712Z Vendors: Rockwell Automation Products: Arena® Simulation Problem Types: CWE-121 Description: Rockwell Automation Arena® suffers from a stack-based buffer overflow vulnerability. The specific flaw exists within the parsing of DOE files. Local attackers are able to exploit this issue to potentially execute arbitrary code on affected installations of Arena®. Exploiting the vulnerability requires opening a malicious DOE file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1763.html
CVE ID: CVE-2025-11920 State: PUBLISHED Published: 2025-11-01T01:47:41.378Z Last Updated: 2025-11-03T18:53:31.185Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: whyun Products: WPCOM Member Problem Types: CWE-98 Description: The WPCOM Member plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.7.14 via the action parameter in one of its shortcodes. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive d
r, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/43b04825-d1c6-4e2a-9035-1f4fbfe14818?source=cve - https://plugins.trac.wordpress.org/browser/wpcom-member/tags/1.7.13/includes/class-member.php#L374 - https://plugins.trac.wordpress.org/browser/wpcom-member/tags/1.7.13/includes/class-member.php#L1119 - https://plugins.trac.wordpress.org/browser/wpcom-member/tags/1.7.13/includes/class-member.php#L1171 - https://pl
L1119 - https://plugins.trac.wordpress.org/browser/wpcom-member/tags/1.7.13/includes/class-member.php#L1171 - https://plugins.trac.wordpress.org/changeset/3385562/wpcom-member/trunk
CVE ID: CVE-2025-11921 State: PUBLISHED Published: 2025-11-24T14:22:12.801Z Last Updated: 2025-11-24T15:01:30.333Z Vendors: Bjango Products: iStats Problem Types: CWE-732, CWE-77 Description: iStats contains an insecure XPC service that allows local, unprivileged users to escalate their privileges to root via command injection.This issue affects iStats: 7.10.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fluidattacks.com/advisories/muse - https://bjango.com/mac/istatmenus/ - https://cdn.istatmenus.app/files/istatmenus7/versions/iStatMenus7.10.6.zip
CVE ID: CVE-2025-11922 State: PUBLISHED Published: 2025-11-01T01:47:41.819Z Last Updated: 2025-11-03T15:48:16.331Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: j_3rk Products: Inactive Logout Problem Types: CWE-79 Description: The Inactive Logout plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ina_redirect_page_individual_user' parameter in all versions up to, and including, 3.5.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page