Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-13370 State: PUBLISHED Published: 2025-11-25T07:28:26.625Z Last Updated: 2025-11-25T07:28:26.625Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: ov3rkll Products: ProjectList Problem Types: CWE-89 Description: The ProjectList plugin for WordPress is vulnerable to time-based SQL Injection via the 'id' parameter in all versions up to, and including, 0.3.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Editor-level access and above, to append additional SQL queries into already existing queries that can be used to
, with Editor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e424d27b-f719-4fbf-b4eb-83b42130666c?source=cve - https://it.wordpress.org/plugins/projectlist/ - https://plugins.trac.wordpress.org/browser/projectlist/trunk/pages/pl-add.php#L61 - https://plugins.trac.wordpress.org/browser/projectlist/tags/0.3.0/pages/pl-add.php#L61
CVE ID: CVE-2025-13376 State: PUBLISHED Published: 2025-11-25T07:28:21.417Z Last Updated: 2025-11-25T07:28:21.417Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: ov3rkll Products: ProjectList Problem Types: CWE-434 Description: The ProjectList plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in all versions up to, and including, 0.3.0. This makes it possible for authenticated attackers, with Editor-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/781c3b84-df80-470e
mote code execution possible. References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/781c3b84-df80-470e-8bcb-3305a8bbb64a?source=cve - https://plugins.trac.wordpress.org/browser/projectlist/trunk/pages/pl-add.php#L27 - https://plugins.trac.wordpress.org/browser/projectlist/tags/0.3.0/pages/pl-add.php#L27
CVE ID: CVE-2025-13380 State: PUBLISHED Published: 2025-11-25T07:28:24.659Z Last Updated: 2025-11-25T07:28:24.659Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: liquidthemes Products: AI Engine for WordPress: ChatGPT, GPT Content Generator Problem Types: CWE-73 Description: The AI Engine for WordPress: ChatGPT, GPT Content Generator plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 1.0.1. This is due to insufficient validation of user-supplied file paths in the 'lqdai_update_post' AJAX endpoint and the use of file_get_contents() with user-controlled URLs without protocol restrictions in the insert_image() funct
t and the use of file_get_contents() with user-controlled URLs without protocol restrictions in the insert_image() function. This makes it possible for authenticated attackers, with Contributor-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ae0abace-9bf6-4ef9-a9b8-7efffbf25628?source=cve - https://plugins.trac.wordpress.org/browser/liquid-chatgpt/tags/1.0.1/liquid-chatgpt.php#L83 - https://plugins.trac.wordpress.org/browser/liquid-chatgpt/tags/1.0.1/liquid-chatgpt.php#L315 - https://plugins.trac.wordpress.org/browser/liquid-chatgpt/tags/1.0.1/liquid
chatgpt/tags/1.0.1/liquid-chatgpt.php#L315 - https://plugins.trac.wordpress.org/browser/liquid-chatgpt/tags/1.0.1/liquid-chatgpt.php#L423 - https://github.com/d0n601/CVE-2025-13380 - https://ryankozak.com/posts/cve-2025-13380/
CVE ID: CVE-2025-13382 State: PUBLISHED Published: 2025-11-25T07:28:24.012Z Last Updated: 2025-11-25T07:28:24.012Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: nmedia Products: Frontend File Manager Plugin Problem Types: CWE-639 Description: The Frontend File Manager Plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 23.4. This is due to the plugin not validating file ownership before processing file rename requests in the '/wpfm/v1/file-rename' REST API endpoint. This makes it possible for authenticated attackers, with Subscriber-level access and above, to rename files uploaded by other users via
ssible for authenticated attackers, with Subscriber-level access and above, to rename files uploaded by other users via the 'fileid' parameter. References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/aa8d5feb-2ae9-44b8-90b5-9fc67226855a?source=cve - https://plugins.trac.wordpress.org/browser/nmedia-user-file-uploader/tags/23.4/inc/classes/class.rest.php#L20 - https://plugins.trac.wordpress.org/browser/nmedia-user-file-uploader/tags/23.4/inc/classes/class.rest.php#L52
CVE ID: CVE-2025-13383 State: PUBLISHED Published: 2025-11-25T07:28:19.446Z Last Updated: 2025-11-25T07:28:19.446Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: bestweblayout Products: Job Board by BestWebSoft Problem Types: CWE-79 Description: The Job Board by BestWebSoft plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 1.2.1. This is due to the plugin storing the entire unsanitized `$_GET` superglobal array directly into the database via `update_user_meta()` when users save search results, and later outputting this data without proper escaping. This makes it possible for unauthenticated attackers to
esults, and later outputting this data without proper escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute whenever a user accesses the saved search or views their profile, granted they can trick the user into performing the search and saving the results. References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/1eb1622f-19fb-472e-871b-9a456f80f390?source=cve - https://plugins.trac.wordpress.org/browser/job-board/tags/1.2.1/job-board.php#L2354 - https://plugins.trac.wordpress.org/browser/job-board/tags/1.2.1/job-board.php#L2355 - https://plugins.trac.wordpress.org/browser/job-board/tags/1.2.1/job-board.php#L1680
CVE ID: CVE-2025-13384 State: PUBLISHED Published: 2025-11-22T07:29:19.553Z Last Updated: 2025-11-24T19:31:03.108Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: codepeople Products: CP Contact Form with PayPal Problem Types: CWE-862 Description: The CP Contact Form with PayPal plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.3.56. This is due to the plugin exposing an unauthenticated IPN-like endpoint (via the 'cp_contactformpp_ipncheck' query parameter) that processes payment confirmations without any authentication, nonce verification, or PayPal IPN signature validation. This makes it possible for unauthen
without any authentication, nonce verification, or PayPal IPN signature validation. This makes it possible for unauthenticated attackers to mark form submissions as paid without making actual payments by sending forged payment notification requests with arbitrary POST data (payment_status, txn_id, payer_email). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/6639c3d8-8f26-4ee5-8c4b-2efcf34668a2?source=cve - https://plugins.trac.wordpress.org/browser/cp-contact-form-with-paypal/tags/1.3.56/cp_contactformpp_functions.php#L541 - https://plugins.trac.wordpress.org/browser/cp-contact-form-with-paypal/tags/1.3.56/cp_contac
formpp_functions.php#L541 - https://plugins.trac.wordpress.org/browser/cp-contact-form-with-paypal/tags/1.3.56/cp_contactformpp_functions.php#L877 - https://plugins.trac.wordpress.org/browser/cp-contact-form-with-paypal/tags/1.3.56/cp_contactformpp_functions.php#L925 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3399104%40cp-contact-form-with-paypal&new=3399104%40cp-contact-form-with-paypal&sfp_email=&sfph_mail=
CVE ID: CVE-2025-13385 State: PUBLISHED Published: 2025-11-25T07:28:27.424Z Last Updated: 2025-11-25T07:28:27.424Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: bylancer Products: Bookme – Free Online Appointment Booking and Scheduling Plugin Problem Types: CWE-89 Description: The Bookme – Free Online Appointment Booking and Scheduling Plugin for WordPress is vulnerable to time-based SQL Injection via the `filter[status]` parameter in all versions up to, and including, 4.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with admin-l
ck of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with admin-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f2c17222-5de5-4ecd-a7c6-beabe7624c5b?source=cve - https://plugins.trac.wordpress.org/browser/bookme-free-appointment-booking-system/tags/4.2/app/admin/Bookings.php#L123 - https://plugins.trac.wordpress.org/browser/bookme-free-appointment-booking-system/trunk/app/admin/Bookings.php#L123
CVE ID: CVE-2025-13386 State: PUBLISHED Published: 2025-11-25T07:28:22.668Z Last Updated: 2025-11-25T07:28:22.668Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: lyrathemes Products: Social Images Widget Problem Types: CWE-862 Description: The Social Images Widget plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'options_update' function in all versions up to, and including, 2.1. This makes it possible for unauthenticated attackers to delete the plugin's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. References: -
request granted they can trick a site administrator into performing an action such as clicking on a link. References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/95ab7473-e368-47ad-a8a0-0efbdafce562?source=cve - https://plugins.trac.wordpress.org/browser/social-images-widget/tags/2.1/class-social-images-widget-settings.php#L44 - https://plugins.trac.wordpress.org/browser/social-images-widget/trunk/class-social-images-widget-settings.php#L44
CVE ID: CVE-2025-13389 State: PUBLISHED Published: 2025-11-25T07:28:21.828Z Last Updated: 2025-11-25T07:28:21.828Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: nmedia Products: Admin and Customer Messages After Order for WooCommerce: OrderConvo Problem Types: CWE-639 Description: The Admin and Customer Messages After Order for WooCommerce: OrderConvo plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the `get_order_by_id()` function in all versions up to, and including, 14. This makes it possible for unauthenticated attackers to view sensitive WooCommerce order details and private conversation messages b
t possible for unauthenticated attackers to view sensitive WooCommerce order details and private conversation messages between customers and store administrators for any order by supplying an arbitrary order ID. References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/9149d2c6-b6c7-430d-8886-c8c5de483220?source=cve - https://plugins.trac.wordpress.org/browser/admin-and-client-message-after-order-for-woocommerce/tags/14/includes/wprest.class.php#L142 - https://plugins.trac.wordpress.org/browser/admin-and-client-message-after-order-for-woocommerce/trunk/includes/wprest.class.php#L142
CVE ID: CVE-2025-13395 State: PUBLISHED Published: 2025-11-19T11:02:05.449Z Last Updated: 2025-11-19T16:09:53.921Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: codehub666 Products: 94list Problem Types: CWE-89, CWE-74 Description: A security flaw has been discovered in codehub666 94list up to 5831c8240e99a72b7d3508c79ef46ae4b96befe8. The impacted element is the function Login of the file /function.php. The manipulation results in sql injection. The attack can be launched remotely. The exploit has been released to the public and may be exploited. This product does not use versioning. This is why information about affected and unaffected releases are unavailab
ited. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.332923 - https://vuldb.com/?ctiid.332923 - https://vuldb.com/?submit.692095 - https://github.com/codehub666/94list/issues/63 - https://github.com/codehub666/94list/issues/63#issue-3607918945
CVE ID: CVE-2025-13396 State: PUBLISHED Published: 2025-11-19T15:32:05.710Z Last Updated: 2025-11-19T16:46:18.939Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: Courier Management System Problem Types: CWE-89, CWE-74 Description: A weakness has been identified in code-projects Courier Management System 1.0. This affects an unknown function of the file /add-office.php. This manipulation of the argument OfficeName causes sql injection. The attack may be initiated remotely. The exploit has been made available to the public and could be exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.332924
ic and could be exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.332924 - https://vuldb.com/?ctiid.332924 - https://vuldb.com/?submit.692127 - https://github.com/beamyou/CVE/issues/1 - https://code-projects.org/
CVE ID: CVE-2025-13397 State: PUBLISHED Published: 2025-11-19T15:32:08.751Z Last Updated: 2025-11-19T16:48:37.028Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:X/RL:O/RC:C) Vendors: n/a Products: mrubyc Problem Types: CWE-476, CWE-404 Description: A security vulnerability has been detected in mrubyc up to 3.4. This impacts the function mrbc_raw_realloc of the file src/alloc.c. Such manipulation of the argument ptr leads to null pointer dereference. An attack has to be approached locally. The name of the patch is 009111904807b8567262036bf45297c3da8f1c87. It is advisable to implement a patch to correct this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: Ref
1c87. It is advisable to implement a patch to correct this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.332925 - https://vuldb.com/?ctiid.332925 - https://vuldb.com/?submit.692130 - https://github.com/mrubyc/mrubyc/issues/244 - https://github.com/mrubyc/mrubyc/issues/244#issuecomment-3400382026 - https://github.com/mrubyc/mrubyc/commit/009111904807b8567262036bf45297c3da8f1c87
CVE ID: CVE-2025-13400 State: PUBLISHED Published: 2025-11-19T17:02:06.703Z Last Updated: 2025-11-20T15:49:40.061Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR) Vendors: Tenda Products: CH22 Problem Types: CWE-120, CWE-119 Description: A vulnerability was detected in Tenda CH22 1.0.0.1. Affected is the function formWrlExtraGet of the file /goform/WrlExtraGet. Performing manipulation of the argument chkHz results in buffer overflow. Remote exploitation of the attack is possible. The exploit is now public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.332926 - https://vuldb.com/?ctiid.332926 - https://vuldb.com/?sub
ADP Vulnrichment: References: - https://vuldb.com/?id.332926 - https://vuldb.com/?ctiid.332926 - https://vuldb.com/?submit.692145 - https://github.com/f000x0/cve/issues/14 - https://www.tenda.com.cn/
CVE ID: CVE-2025-13404 State: PUBLISHED Published: 2025-11-25T07:28:23.547Z Last Updated: 2025-11-25T07:28:23.547Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: docjojo Products: atec Duplicate Page & Post Problem Types: CWE-862 Description: The atec Duplicate Page & Post plugin for WordPress is vulnerable to unauthorized post duplication due to missing authorization validation on the duplicate_post() function in all versions up to, and including, 1.2.20. This makes it possible for authenticated attackers, with Contributor-level access and above, to duplicate arbitrary posts, including private and password-protected posts, leading to data exposure. Referen
d above, to duplicate arbitrary posts, including private and password-protected posts, leading to data exposure. References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a793b24f-979e-4209-93f7-cff8d3867a7d?source=cve - https://plugins.trac.wordpress.org/browser/atec-duplicate-page-post/tags/1.2.20/includes/atec-wpdpp-hooks.php#L27 - https://plugins.trac.wordpress.org/browser/atec-duplicate-page-post/tags/1.2.21/includes/atec-wpdpp-hooks.php#L27
CVE ID: CVE-2025-13405 State: PUBLISHED Published: 2025-11-25T07:28:25.203Z Last Updated: 2025-11-25T07:28:25.203Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: buywptemplates Products: Ace Post Type Builder Problem Types: CWE-862 Description: The Ace Post Type Builder plugin for WordPress is vulnerable to unauthorized custom taxonomy deletion due to missing authorization validation on the cptb_delete_custom_taxonomy() function in all versions up to, and including, 1.9. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary custom taxonomies. References: - https://www.wordfence.com/threat-intel/vulne
evel access and above, to delete arbitrary custom taxonomies. References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b56cef33-057b-4c40-945f-68306597b00b?source=cve - https://plugins.trac.wordpress.org/browser/ace-post-type-builder/trunk/includes/class-cptb-core.php#L400 - https://plugins.trac.wordpress.org/browser/ace-post-type-builder/tags/1.9/includes/class-cptb-core.php#L400
CVE ID: CVE-2025-13410 State: PUBLISHED Published: 2025-11-19T20:32:06.519Z Last Updated: 2025-11-20T14:31:36.556Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: Campcodes Products: Retro Basketball Shoes Online Store Problem Types: CWE-89, CWE-74 Description: A vulnerability has been found in Campcodes Retro Basketball Shoes Online Store 1.0. Affected is an unknown function of the file /admin/receipt.php. Such manipulation of the argument tid leads to sql injection. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.332937 - h
ublic and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.332937 - https://vuldb.com/?ctiid.332937 - https://vuldb.com/?submit.693696 - https://github.com/laosijivul/cve/issues/3 - https://www.campcodes.com/
CVE ID: CVE-2025-13411 State: PUBLISHED Published: 2025-11-19T20:32:09.027Z Last Updated: 2025-11-19T20:44:05.829Z Severity: N/A (CVSS 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: Campcodes Products: Retro Basketball Shoes Online Store Problem Types: CWE-434, CWE-284 Description: A vulnerability was found in Campcodes Retro Basketball Shoes Online Store 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/admin_football.php. Performing manipulation of the argument product_image results in unrestricted upload. The attack is possible to be carried out remotely. The exploit has been made public and could be used. Additional Analyst Notes: - CISA ADP V
e to be carried out remotely. The exploit has been made public and could be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.332938 - https://vuldb.com/?ctiid.332938 - https://vuldb.com/?submit.693697 - https://github.com/laosijivul/cve/issues/2 - https://www.campcodes.com/
CVE ID: CVE-2025-13412 State: PUBLISHED Published: 2025-11-19T21:02:05.671Z Last Updated: 2025-11-20T14:34:07.212Z Severity: N/A (CVSS 3.3 AV:N/AC:L/Au:M/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: Campcodes Products: Retro Basketball Shoes Online Store Problem Types: CWE-79, CWE-94 Description: A vulnerability was determined in Campcodes Retro Basketball Shoes Online Store 1.0. Affected by this issue is some unknown functionality of the file /admin/admin_running.php. Executing manipulation of the argument product_name can lead to cross site scripting. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. Additional Analyst Notes: - CISA ADP Vulnri
ed from remote. The exploit has been publicly disclosed and may be utilized. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.332939 - https://vuldb.com/?ctiid.332939 - https://vuldb.com/?submit.693698 - https://github.com/laosijivul/cve/issues/1 - https://www.campcodes.com/
CVE ID: CVE-2025-13414 State: PUBLISHED Published: 2025-11-25T07:28:19.005Z Last Updated: 2025-11-25T07:28:19.005Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: gwendydd Products: Chamber Dashboard Business Directory Problem Types: CWE-862 Description: The Chamber Dashboard Business Directory plugin for WordPress is vulnerable to unauthorized data export due to a missing capability check on the cdash_watch_for_export() function in all versions up to, and including, 3.3.11. This makes it possible for unauthenticated attackers to export business directory information, including sensitive business details. References: - https://www.wordfence.com/threat-intel/
iness directory information, including sensitive business details. References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/1896885a-a104-464a-bb57-2c3c73ff9415?source=cve - https://plugins.trac.wordpress.org/browser/chamber-dashboard-business-directory/trunk/options.php#L850 - https://plugins.trac.wordpress.org/browser/chamber-dashboard-business-directory/tags/3.3.11/options.php#L850
CVE ID: CVE-2025-13415 State: PUBLISHED Published: 2025-11-19T22:02:06.240Z Last Updated: 2025-11-20T15:41:18.914Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N/E:ND/RL:ND/RC:UR) Vendors: icret Products: EasyImages Problem Types: CWE-79, CWE-94 Description: A vulnerability was identified in icret EasyImages up to 2.8.6. This affects an unknown part of the file /app/upload.php of the component SVG Image Handler. The manipulation of the argument File leads to cross site scripting. It is possible to initiate the attack remotely. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.332940 - https://vuldb.com/?ctiid.332940 - https://vuldb.com/?submit.693732 -
ment: References: - https://vuldb.com/?id.332940 - https://vuldb.com/?ctiid.332940 - https://vuldb.com/?submit.693732 - https://github.com/icret/EasyImages2.0/issues/260
CVE ID: CVE-2025-13420 State: PUBLISHED Published: 2025-11-19T22:32:06.248Z Last Updated: 2025-11-20T15:40:29.139Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: itsourcecode Products: Human Resource Management System Problem Types: CWE-89, CWE-74 Description: A weakness has been identified in itsourcecode Human Resource Management System 1.0. This issue affects some unknown processing of the file /src/store/EventStore.php. This manipulation of the argument eventSubject causes sql injection. The attack can be initiated remotely. The exploit has been made available to the public and could be exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: Referenc
as been made available to the public and could be exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.332942 - https://vuldb.com/?ctiid.332942 - https://vuldb.com/?submit.695952 - https://github.com/f14g-orz/CVE/issues/8 - https://itsourcecode.com/