Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-1531 State: PUBLISHED Published: 2025-05-16T06:17:30.848Z Last Updated: 2025-05-16T15:39:46.559Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: Hitachi Products: Hitachi Ops Center Analyzer viewpoint Problem Types: CWE-1392 Description: Authentication credentials leakage vulnerability in Hitachi Ops Center Analyzer viewpoint.This issue affects Hitachi Ops Center Analyzer viewpoint: from 10.0.0-00 before 11.0.4-00. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2025-116/index.html
CVE ID: CVE-2025-1532 State: PUBLISHED Published: 2025-04-17T09:31:17.816Z Last Updated: 2025-04-17T18:17:23.339Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N) Vendors: Honor Products: com.hihonor.phoneservice Description: Phoneservice module is affected by code injection vulnerability, successful exploitation of this vulnerability may affect service confidentiality and integrity. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.honor.com/global/security/cve-2025-1532/
CVE ID: CVE-2025-1533 State: PUBLISHED Published: 2025-05-12T09:28:12.314Z Last Updated: 2025-05-12T14:28:16.070Z Vendors: ASUS Products: Armoury Crate Problem Types: CWE-121 Description: A stack buffer overflow has been identified in the AsIO3.sys driver. This vulnerability can be triggered by input manipulation, may leading to a system crash (BSOD) or other potentially undefined execution. Refer to the 'Security Update for Armoury Crate App' section on the ASUS Security Advisory for more information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.asus.com/content/asus-product-security-advisory/ - https://www.talosintelligence.com/vulnerability_reports/TALOS-20
/www.asus.com/content/asus-product-security-advisory/ - https://www.talosintelligence.com/vulnerability_reports/TALOS-2025-2144
CVE ID: CVE-2025-1534 State: PUBLISHED Published: 2025-04-01T03:25:30.153Z Last Updated: 2025-04-07T20:59:19.493Z Vendors: Payara Platform Products: Payara Server Problem Types: CVE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: CVE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Payara Platform Payara Server allows : Remote Code Inclusion.This issue affects Payara Server: from 4.1.2.1919.1 before 4.1.2.191.51, from 5.20.0 before 5.68.0, from 6.0.0 before 6.23.0, from 6.2022.1 before 6.2025.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.payara.fis
from 6.2022.1 before 6.2025.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.payara.fish/enterprise/docs/Release%20Notes/Release%20Notes%206.24.0.html - https://docs.payara.fish/community/docs/6.2025.3/Release%20Notes/Release%20Notes%206.2025.3.html - https://www.gruppotim.it/it/footer/red-team.html
CVE ID: CVE-2025-1535 State: PUBLISHED Published: 2025-02-21T12:00:14.395Z Last Updated: 2025-02-21T13:12:08.256Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: Baiyi Products: Cloud Asset Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in Baiyi Cloud Asset Management System 8.142.100.161. It has been classified as critical. This affects an unknown part of the file /wuser/admin.ticket.close.php. The manipulation of the argument ticket_id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respon
as been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.296475 - https://vuldb.com/?ctiid.296475 - https://vuldb.com/?submit.496969 - https://github.com/sekaino-sakura/CVE/blob/main/CVE_2.md
CVE ID: CVE-2025-1536 State: PUBLISHED Published: 2025-02-21T14:31:04.960Z Last Updated: 2025-02-21T16:46:38.199Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: Raisecom Products: Multi-Service Intelligent Gateway Problem Types: CWE-78, CWE-77 Description: A vulnerability was found in Raisecom Multi-Service Intelligent Gateway up to 20250208. It has been declared as critical. This vulnerability affects unknown code of the file /vpn/vpn_template_style.php of the component Request Parameter Handler. The manipulation of the argument stylenum leads to os command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor
njection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.296476 - https://vuldb.com/?ctiid.296476 - https://vuldb.com/?submit.497021 - https://github.com/koishi0x01/CVE/blob/main/CVE_1.md
CVE ID: CVE-2025-1537 State: PUBLISHED Published: 2025-02-21T14:31:07.283Z Last Updated: 2025-02-21T14:49:59.829Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Harpia Products: DiagSystem Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in Harpia DiagSystem 12. It has been rated as critical. This issue affects some unknown processing of the file /diagsystem/PACS/atualatendimento_jpeg.php. The manipulation of the argument codexame leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Not
may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.296477 - https://vuldb.com/?ctiid.296477 - https://vuldb.com/?submit.497125 - https://drive.google.com/file/d/10IspKbYh7TYmxRPRIQZ7oRg6Xise8ykJ/view?usp=sharing
CVE ID: CVE-2025-1538 State: PUBLISHED Published: 2025-02-21T15:00:08.968Z Last Updated: 2025-02-21T16:31:53.663Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C) Vendors: D-Link Products: DAP-1320 Problem Types: CWE-122, CWE-119 Description: A vulnerability classified as critical was found in D-Link DAP-1320 1.00. Affected by this vulnerability is the function set_ws_action of the file /dws/api/. The manipulation leads to heap-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer. Additional Analyst Notes: - CISA ADP Vulnrichment: Refer
ffects products that are no longer supported by the maintainer. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.296479 - https://vuldb.com/?ctiid.296479 - https://vuldb.com/?submit.497301 - https://tasty-foxtrot-3a8.notion.site/D-link-DAP-1320-set_ws_action-Vulnerability-1950448e61958049be3cc606d434bc9d?pvs=74 - https://legacy.us.dlink.com/pages/product.aspx?id=4b2bbe2e3f1d440ea65bc56c7e3dcc5c - https://tasty-foxtrot-3a8.notion.site/D-link-DAP-1320-set_ws_action-Vulnerability-1950448e61958049be3cc606d434bc9d - https://www.dlink.com/
CVE ID: CVE-2025-1539 State: PUBLISHED Published: 2025-02-21T15:00:14.905Z Last Updated: 2025-02-21T15:42:32.332Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C) Vendors: D-Link Products: DAP-1320 Problem Types: CWE-121, CWE-119 Description: A vulnerability, which was classified as critical, has been found in D-Link DAP-1320 1.00. Affected by this issue is the function replace_special_char of the file /storagein.pd-XXXXXX. The manipulation leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer. Additional Analyst Notes: -
d. This vulnerability only affects products that are no longer supported by the maintainer. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.296480 - https://vuldb.com/?ctiid.296480 - https://vuldb.com/?submit.497496 - https://tasty-foxtrot-3a8.notion.site/D-link-DAP-1320-replace_special_char-Vulnerability-1960448e6195809c94f9fd2ff1f59bcf?pvs=4 - https://legacy.us.dlink.com/pages/product.aspx?id=4b2bbe2e3f1d440ea65bc56c7e3dcc5c - https://www.dlink.com/
CVE ID: CVE-2025-1540 State: PUBLISHED Published: 2025-03-06T08:31:07.791Z Last Updated: 2025-03-06T16:29:08.261Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: GitLab Products: GitLab Problem Types: CWE-863 Description: An issue has been discovered in GitLab CE/EE for Self-Managed and Dedicated instances affecting all versions from 17.5 prior to 17.6.5, 17.7 prior to 17.7.4, and 17.8 prior to 17.8.2. It was possible for a user added as an External to read and clone internal projects under certain circumstances." Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/512765 - https://about.gitlab.com/rele
ISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/512765 - https://about.gitlab.com/releases/2025/02/12/patch-release-gitlab-17-8-2-released/#saml-authentication-misconfigures-external-user-attribute
CVE ID: CVE-2025-1542 State: PUBLISHED Published: 2025-03-26T11:07:08.665Z Last Updated: 2025-10-03T09:05:29.077Z Vendors: Infonet Projekt SA Products: OXARI ServiceDesk Problem Types: CWE-425 Description: Improper permission control vulnerability in the OXARI ServiceDesk application could allow an attacker using a guest access or an unprivileged account to gain additional administrative permissions in the application.This issue affects OXARI ServiceDesk in versions before 2.0.324.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert.pl/en/posts/2025/03/CVE-2025-1542/ - https://www.oxari.com/en/product/oxari-servicedesk
CVE ID: CVE-2025-1543 State: PUBLISHED Published: 2025-02-21T16:00:08.951Z Last Updated: 2025-02-21T17:16:47.598Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: iteachyou Products: Dreamer CMS Problem Types: CWE-22 Description: A vulnerability, which was classified as problematic, has been found in iteachyou Dreamer CMS 4.1.3. This issue affects some unknown processing of the file /resource/js/ueditor-1.4.3.3. The manipulation leads to path traversal. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes
y be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.296489 - https://vuldb.com/?ctiid.296489 - https://vuldb.com/?submit.497329 - https://github.com/cydtseng/Vulnerability-Research/blob/main/dreamercms/PathTraversal-UeditorResource.md
CVE ID: CVE-2025-1544 State: PUBLISHED Published: 2025-02-21T16:00:11.285Z Last Updated: 2025-02-25T14:50:23.281Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: dingfanzu Products: CMS Problem Types: CWE-89, CWE-74 Description: A vulnerability, which was classified as critical, was found in dingfanzu CMS up to 20250210. Affected is an unknown function of the file /ajax/loadShopInfo.php. The manipulation of the argument shopId leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vu
vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.296490 - https://vuldb.com/?ctiid.296490 - https://vuldb.com/?submit.497477 - https://github.com/XinCaoZ/cve/blob/main/dingfanzu/dingfanzu-CMS%20loadShopInfo.php%20shopId%20SQL%20inject.md
CVE ID: CVE-2025-1546 State: PUBLISHED Published: 2025-02-21T16:31:04.058Z Last Updated: 2025-08-28T14:33:55.618Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: BDCOM Products: Behavior Management and Auditing System Problem Types: CWE-78, CWE-77 Description: A vulnerability has been found in BDCOM Behavior Management and Auditing System up to 20250210 and classified as critical. Affected by this vulnerability is the function log_operate_clear of the file /webui/modules/log/operate.mds. The manipulation of the argument start_code leads to os command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was conta
The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.296491 - https://vuldb.com/?ctiid.296491 - https://vuldb.com/?submit.497558 - https://github.com/koishi0x01/CVE/blob/main/CVE_2.md
CVE ID: CVE-2025-1548 State: PUBLISHED Published: 2025-02-21T17:00:10.190Z Last Updated: 2025-02-21T20:49:11.366Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: iteachyou Products: Dreamer CMS Problem Types: CWE-79, CWE-94 Description: A vulnerability was found in iteachyou Dreamer CMS 4.1.3. It has been declared as problematic. This vulnerability affects unknown code of the file /admin/archives/edit. The manipulation of the argument editorValue/answer/content leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additio
the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.296494 - https://vuldb.com/?ctiid.296494 - https://vuldb.com/?submit.497602 - https://github.com/cydtseng/Vulnerability-Research/blob/main/dreamercms/RemoteFileInclusion-ArticleEditorImageUpload.md
CVE ID: CVE-2025-1549 State: PUBLISHED Published: 2025-10-29T16:50:39.263Z Last Updated: 2025-10-30T03:56:04.752Z Vendors: WatchGuard Products: Mobile VPN with SSL Client Problem Types: CWE-77 Description: A local privilege escalation vulnerability in the WatchGuard Mobile VPN with SSL client on Windows enables a local user to execute arbitrary commands with elevated privileges on the Windows system. This vulnerability is an additional unmitigated attack path for CVE-2024-4944. This vulnerability is resolved in the Mobile VPN with SSL client for Windows version 12.11.3 Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2025-00
tional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2025-00016
CVE ID: CVE-2025-1550 State: PUBLISHED Published: 2025-03-11T08:12:34.974Z Last Updated: 2025-07-24T15:28:42.230Z Vendors: Google Products: Keras Problem Types: CWE-94 Description: The Keras Model.load_model function permits arbitrary code execution, even with safe_mode=True, through a manually constructed, malicious .keras archive. By altering the config.json file within the archive, an attacker can specify arbitrary Python modules and functions, along with their arguments, to be loaded and executed during model loading. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/keras-team/keras/pull/20751 - https://towerofhanoi.it/writeups/cve-2025-1550/
CVE ID: CVE-2025-1551 State: PUBLISHED Published: 2025-04-29T15:41:43.471Z Last Updated: 2025-08-28T15:03:15.862Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: IBM Products: Operational Decision Manager Problem Types: CWE-79 Description: IBM Operational Decision Manager 8.11.0.1, 8.11.1.0, 8.12.0.1, and 9.0.0.1 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pag
thin a trusted session. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7232032
CVE ID: CVE-2025-1553 State: PUBLISHED Published: 2025-02-22T09:34:58.283Z Last Updated: 2025-02-24T16:16:40.539Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: pankajindevops Products: scale Problem Types: CWE-79, CWE-94 Description: A vulnerability was found in pankajindevops scale up to 3633544a00245d3df88b6d13d9b3dd0f411be7f6. It has been classified as problematic. Affected is an unknown function of the file /scale/project. The manipulation of the argument goal leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, n
disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.296502 - https://vuldb.com/?ctiid.296502 - https://vuldb.com/?submit.491216 - https://docs.google.com/document/d/1r8Ad7Kaw0bwKZMVFDlhzhpjdque7vRGTDKDeP7yiUEc - https://drive.google.com/file/d/1CRdzTf2bPEB7MshIighYYcVL3IbArBPr/view
CVE ID: CVE-2025-1555 State: PUBLISHED Published: 2025-02-21T21:00:12.239Z Last Updated: 2025-02-24T14:52:47.917Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: hzmanyun Products: Education and Training System Problem Types: CWE-434, CWE-284 Description: A vulnerability classified as critical was found in hzmanyun Education and Training System 3.1.1. This vulnerability affects the function saveImage. The manipulation of the argument file leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - C
used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.296506 - https://vuldb.com/?ctiid.296506 - https://vuldb.com/?submit.496932 - https://github.com/Rain1er/report/blob/main/CDG/bnhiMg%3D%3D.md
CVE ID: CVE-2025-1556 State: PUBLISHED Published: 2025-02-22T12:31:04.247Z Last Updated: 2025-02-24T12:54:06.029Z Severity: N/A (CVSS 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P) Vendors: westboy Products: CicadasCMS Problem Types: CWE-502, CWE-20 Description: A vulnerability, which was classified as problematic, has been found in westboy CicadasCMS 1.0. This issue affects some unknown processing of the file /system of the component Template Management. The manipulation leads to deserialization. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.296507 - https://vuldb.co
e used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.296507 - https://vuldb.com/?ctiid.296507 - https://vuldb.com/?submit.499520 - https://github.com/FightingLzn9/vul/blob/main/CicadasCMS(2).md
CVE ID: CVE-2025-1557 State: PUBLISHED Published: 2025-02-22T13:00:11.418Z Last Updated: 2025-02-24T12:49:36.709Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N) Vendors: n/a Products: OFCMS Problem Types: CWE-352, CWE-862 Description: A vulnerability, which was classified as problematic, was found in OFCMS 1.1.3. Affected is an unknown function. The manipulation leads to cross-site request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.296508 - https://vuldb.com/?ctiid.296508 - https://vuldb.com/?submit.500269 - https://www.yuque.com/
tps://vuldb.com/?id.296508 - https://vuldb.com/?ctiid.296508 - https://vuldb.com/?submit.500269 - https://www.yuque.com/u123456789-6sobi/cdgcbq/kq7117ogyycutxo2?singleDoc#%20%E3%80%8ACSRF%20Vulnerability%20in%20OfCms%20%2F%20OfCms%E5%AD%98%E5%9C%A8CSRF%E6%BC%8F%E6%B4%9E%E3%80%8B
CVE ID: CVE-2025-1558 State: PUBLISHED Published: 2025-03-24T15:01:52.463Z Last Updated: 2025-03-24T18:42:16.481Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: Mattermost Products: Mattermost Problem Types: CWE-1287 Description: Mattermost Mobile Apps versions <=2.25.0 fail to properly validate GIF images prior to rendering which allows a malicious user to cause the Android application to crash via message containing a maliciously crafted GIF. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://mattermost.com/security-updates
CVE ID: CVE-2025-1559 State: PUBLISHED Published: 2025-03-13T01:45:27.472Z Last Updated: 2025-03-14T13:55:13.306Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: clearcodehq Products: CC-IMG-Shortcode Problem Types: CWE-79 Description: The CC-IMG-Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'img' shortcode in all versions up to, and including, 1.1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses a
ontributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/81803a24-51ba-4d23-88ef-553cb4754977?source=cve - https://plugins.trac.wordpress.org/browser/cc-img-shortcode/trunk/includes/class-img-shortcode.php - https://wordpress.org/plugins/cc-img-shortcode/
CVE ID: CVE-2025-1560 State: PUBLISHED Published: 2025-02-28T08:23:14.044Z Last Updated: 2025-02-28T13:54:12.991Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: darkosxrc Products: WOW Entrance Effects (WEE!) Problem Types: CWE-79 Description: The WOW Entrance Effects (WEE!) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wee' shortcode in all versions up to, and including, 0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever
attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/423e840e-0bc2-4481-afff-61ace85788d3?source=cve - https://plugins.trac.wordpress.org/browser/wow-entrance-effects-wee/trunk/wee.php - https://wordpress.org/plugins/wow-entrance-effects-wee/