Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-5390 State: PUBLISHED Published: 2025-05-31T19:00:08.306Z Last Updated: 2025-06-02T15:46:46.682Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: n/a Products: JeeWMS Problem Types: CWE-284, CWE-266 Description: A vulnerability, which was classified as critical, was found in JeeWMS up to 20250504. This affects the function filedeal of the file /systemController/filedeal.do of the component File Handler. The manipulation leads to improper access controls. It is possible to initiate the attack remotely. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. Additional Analyst Notes: - CISA ADP Vulnrichm
s why information about affected and unaffected releases are unavailable. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.310683 - https://vuldb.com/?ctiid.310683 - https://gitee.com/erzhongxmu/JEEWMS/issues/IC5FNV
CVE ID: CVE-2025-5391 State: PUBLISHED Published: 2025-08-12T02:24:45.298Z Last Updated: 2025-08-13T20:19:34.074Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) Vendors: bbioon Products: WooCommerce Purchase Orders Problem Types: CWE-22 Description: The WooCommerce Purchase Orders plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_file() function in all versions up to, and including, 1.0.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such
elete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/05a27a34-b324-4968-937e-2c0d24175d2a?source=cve - https://plugins.trac.wordpress.org/browser/wc-purchase-orders/trunk/includes/class-bbpo-purchase-orders.php#L151 - https://plugins.trac.wordpress.org/browser/wc-purchase-orders/trunk/includes/class-bbpo-purchase-orders-files.php#L148
CVE ID: CVE-2025-5392 State: PUBLISHED Published: 2025-07-11T06:43:33.982Z Last Updated: 2025-07-11T16:55:30.815Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: gb-plugins Products: GB Forms DB Problem Types: CWE-94 Description: The GB Forms DB plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.0.2 via the gbfdb_talk_to_front() function. This is due to the function accepting user input and then passing that through call_user_func(). This makes it possible for unauthenticated attackers to execute code on the server which can be leverage to inject backdoors or create new administrative user accounts to name a
xecute code on the server which can be leverage to inject backdoors or create new administrative user accounts to name a few things. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/fe8723a7-bbb1-41a0-b222-3cf4eb44cd64?source=cve - https://plugins.trac.wordpress.org/browser/gb-forms-db/trunk/core/functions.php#L334 - https://plugins.trac.wordpress.org/browser/gb-forms-db/trunk/core/functions.php#L367 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3323703%40gb-forms-db&new=3323703%40gb-forms-db&sfp_email=&sfph_mail=
CVE ID: CVE-2025-5393 State: PUBLISHED Published: 2025-07-15T03:43:22.575Z Last Updated: 2025-07-15T19:48:30.175Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H) Vendors: Bearsthemes Products: Alone – Charity Multipurpose Non-profit WordPress Theme Problem Types: CWE-73 Description: The Alone – Charity Multipurpose Non-profit WordPress Theme theme for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the alone_import_pack_restore_data() function in all versions up to, and including, 7.8.3. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code ex
possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/2cb1b526-0df6-42a1-9294-90bc61730209?source=cve - https://themeforest.net/item/alone-charity-multipurpose-nonprofit-wordpress-theme/15019939
CVE ID: CVE-2025-5394 State: PUBLISHED Published: 2025-07-15T03:43:23.137Z Last Updated: 2025-07-15T13:37:59.232Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Bearsthemes Products: Alone – Charity Multipurpose Non-profit WordPress Theme Problem Types: CWE-862 Description: The Alone – Charity Multipurpose Non-profit WordPress Theme theme for WordPress is vulnerable to arbitrary file uploads due to a missing capability check on the alone_import_pack_install_plugin() function in all versions up to, and including, 7.8.3. This makes it possible for unauthenticated attackers to upload zip files containing webshells disguised as plugins from remote locations t
ible for unauthenticated attackers to upload zip files containing webshells disguised as plugins from remote locations to achieve remote code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/86f91589-b309-49aa-8b04-ca972acaf8fb?source=cve - https://themeforest.net/item/alone-charity-multipurpose-nonprofit-wordpress-theme/15019939
CVE ID: CVE-2025-5395 State: PUBLISHED Published: 2025-06-11T06:39:46.773Z Last Updated: 2025-06-11T13:22:05.731Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: ValvePress Products: WordPress Automatic Plugin Problem Types: CWE-434 Description: The WordPress Automatic Plugin plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'core.php' file in all versions up to, and including, 3.115.0. This makes it possible for authenticated attackers, with Author-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. Additional Analyst Notes: -
rbitrary files on the affected site's server which may make remote code execution possible. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/57be67fd-8485-495f-b5e9-6eb52af945b7?source=cve - https://codecanyon.net/item/wordpress-automatic-plugin/1904470#item-description__changelog
CVE ID: CVE-2025-5396 State: PUBLISHED Published: 2025-07-17T01:44:54.566Z Last Updated: 2025-07-17T14:38:22.622Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Bearsthemes Products: Bears Backup Problem Types: CWE-94 Description: The Bears Backup plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.0.0. This is due to the bbackup_ajax_handle() function not having a capability check, nor validating user supplied input passed directly to call_user_func(). This makes it possible for unauthenticated attackers to execute code on the server which can be leverage to inject backdoors or create new administrative use
cated attackers to execute code on the server which can be leverage to inject backdoors or create new administrative user accounts to name a few things. On WordPress sites running the Alone theme versions 7.8.4 and older, this can be chained with CVE-2025-5394 to install the Bears Backup plugin and achieve the same impact. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/81b44abb-6d30-4930-b68b-9a04d93f5169?source=cve - https://themeforest.net/item/alone-charity-multipurpose-nonprofit-wordpress-theme/15019939
CVE ID: CVE-2025-5397 State: PUBLISHED Published: 2025-10-31T06:42:54.832Z Last Updated: 2025-10-31T14:40:20.080Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Unknown Products: Noo JobMonster Problem Types: CWE-288 Description: The Noo JobMonster theme for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 4.8.1. This is due to the check_login() function not properly verifying a user's identity prior to successfully authenticating them This makes it possible for unauthenticated attackers to bypass standard authentication and access administrative user accounts. Please note social login needs to be enabled in order for
andard authentication and access administrative user accounts. Please note social login needs to be enabled in order for a site to be impacted by this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/6fa4aa8d-d7f1-4e91-bb2c-c9f80a4bb216?source=cve - https://themeforest.net/item/jobmonster-job-board-wordpress-theme/10965446
CVE ID: CVE-2025-5398 State: PUBLISHED Published: 2025-06-27T09:23:19.247Z Last Updated: 2025-06-27T13:28:48.945Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: kstover Products: Ninja Forms – The Contact Form Builder That Grows With You Problem Types: CWE-79 Description: The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the use of a templating engine in all versions up to, and including, 3.10.2.1 due to insufficient output escaping on user data passed through the template. This makes it possible for authenticated attackers, with contributor-level access and above, to inject
gh the template. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/92d106c6-a910-4f41-94d1-59f6b7f3aeb0?source=cve - https://plugins.trac.wordpress.org/browser/ninja-forms/tags/3.10.1/assets/js/min/front-end.js - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3317181%40ninja-forms&new=3317181%40ninja-forms&sfp_email=&sfph_mail=
CVE ID: CVE-2025-5399 State: PUBLISHED Published: 2025-06-07T07:49:09.370Z Last Updated: 2025-06-09T13:20:29.843Z Vendors: curl Products: curl Problem Types: CWE-835 Loop with Unreachable Exit Condition ('Infinite Loop') Description: Due to a mistake in libcurl's WebSocket code, a malicious server can send a particularly crafted packet which makes libcurl get trapped in an endless busy-loop. There is no other way for the application to escape or exit this loop other than killing the thread/process. This might be used to DoS libcurl-using application. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://curl.se/docs/CVE-2025-5399.json - https://cur
s: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://curl.se/docs/CVE-2025-5399.json - https://curl.se/docs/CVE-2025-5399.html - https://hackerone.com/reports/3168039
CVE ID: CVE-2025-5400 State: PUBLISHED Published: 2025-06-01T08:31:05.205Z Last Updated: 2025-06-02T03:16:04.159Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: chaitak-gorai Products: Blogbook Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in chaitak-gorai Blogbook up to 92f5cf90f8a7e6566b576fe0952e14e1c6736513. It has been classified as critical. Affected is an unknown function of the file /user.php of the component GET Parameter Handler. The manipulation of the argument u_id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. This product is using a rolling release to provid
emotely. The exploit has been disclosed to the public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.310740 - https://vuldb.com/?ctiid.310740 - https://vuldb.com/?submit.582865 - https://github.com/rllvusgnzm98/Report/blob/main/blogbook/BlogBook%20user.php%20u_id%20Parameter%20SQL%20Injection.md
CVE ID: CVE-2025-5401 State: PUBLISHED Published: 2025-06-01T13:00:11.696Z Last Updated: 2025-06-02T03:20:47.061Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: chaitak-gorai Products: Blogbook Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in chaitak-gorai Blogbook up to 92f5cf90f8a7e6566b576fe0952e14e1c6736513. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /post.php of the component GET Parameter Handler. The manipulation of the argument p_id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This product takes the approach o
an be launched remotely. The exploit has been disclosed to the public and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.310741 - https://vuldb.com/?ctiid.310741 - https://vuldb.com/?submit.582874 - https://github.com/rllvusgnzm98/Report/blob/main/blogbook/BlogBook%20post.php%20p_id%20Parameter%20SQL%20Injection.md
CVE ID: CVE-2025-5402 State: PUBLISHED Published: 2025-06-01T14:00:05.044Z Last Updated: 2025-06-02T03:24:02.373Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: chaitak-gorai Products: Blogbook Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in chaitak-gorai Blogbook up to 92f5cf90f8a7e6566b576fe0952e14e1c6736513. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin/includes/edit_post.php of the component GET Parameter Handler. The manipulation of the argument edit_post_id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Continious del
ction. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.310742 - https://vuldb.com/?ctiid.310742 - https://vuldb.com/?submit.582904 - https://github.com/rllvusgnzm98/Report/blob/main/blogbook/BlogBook%20posts.php%20edit_post%20p_id%20Parameter%20SQL%20Injection.md
CVE ID: CVE-2025-5403 State: PUBLISHED Published: 2025-06-01T16:00:16.288Z Last Updated: 2025-06-02T03:24:58.499Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: chaitak-gorai Products: Blogbook Problem Types: CWE-89, CWE-74 Description: A vulnerability classified as critical has been found in chaitak-gorai Blogbook up to 92f5cf90f8a7e6566b576fe0952e14e1c6736513. This affects an unknown part of the file /admin/view_all_posts.php of the component GET Parameter Handler. The manipulation of the argument post_id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. T
e attack remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.310743 - https://vuldb.com/?ctiid.310743 - https://vuldb.com/?submit.582910 - https://github.com/rllvusgnzm98/Report/blob/main/blogbook/BlogBook%20posts.php%20delete_post%20delete%20Parameter%20SQL%20Injection.md
CVE ID: CVE-2025-5404 State: PUBLISHED Published: 2025-06-01T16:31:06.452Z Last Updated: 2025-06-02T03:43:57.013Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: chaitak-gorai Products: Blogbook Problem Types: CWE-404 Description: A vulnerability classified as problematic was found in chaitak-gorai Blogbook up to 92f5cf90f8a7e6566b576fe0952e14e1c6736513. This vulnerability affects unknown code of the file /search.php of the component GET Parameter Handler. The manipulation of the argument Search leads to denial of service. The exploit has been disclosed to the public and may be used. This product is using a rolling release to provide continious delivery. The
een disclosed to the public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.310744 - https://vuldb.com/?ctiid.310744 - https://vuldb.com/?submit.582915 - https://github.com/rllvusgnzm98/Report/blob/main/blogbook/BlogBook%20search.php%20search%20Parameter%20SQL%20Injection.md
CVE ID: CVE-2025-5405 State: PUBLISHED Published: 2025-06-01T18:00:17.947Z Last Updated: 2025-06-02T03:42:56.363Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: chaitak-gorai Products: Blogbook Problem Types: CWE-79, CWE-94 Description: A vulnerability, which was classified as problematic, has been found in chaitak-gorai Blogbook up to 92f5cf90f8a7e6566b576fe0952e14e1c6736513. This issue affects some unknown processing of the file /post.php. The manipulation of the argument comment_author/comment_email/comment_content leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. This product takes the approach o
y be initiated remotely. The exploit has been disclosed to the public and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.310745 - https://vuldb.com/?ctiid.310745 - https://vuldb.com/?submit.582925 - https://github.com/rllvusgnzm98/Report/blob/main/blogbook/BlogBook%20post.php%20Stored%20Cross-Site%20Scripting%20(XSS)%20in%20Comment%20Functionality%20Leading%20to%20Admin%20and%20User%20Account%20
0Stored%20Cross-Site%20Scripting%20(XSS)%20in%20Comment%20Functionality%20Leading%20to%20Admin%20and%20User%20Account%20Takeover.md
CVE ID: CVE-2025-5406 State: PUBLISHED Published: 2025-06-01T18:31:04.608Z Last Updated: 2025-06-02T03:42:12.239Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: chaitak-gorai Products: Blogbook Problem Types: CWE-434, CWE-284 Description: A vulnerability, which was classified as critical, was found in chaitak-gorai Blogbook up to 92f5cf90f8a7e6566b576fe0952e14e1c6736513. Affected is an unknown function of the file /admin/posts.php?source=add_post. The manipulation of the argument image leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this
The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.310746 - https://vuldb.com/?ctiid.310746 - https://vuldb.com/?submit.583427 - https://github.com/rllvusgnzm98/Report/blob/main/blogbook/BlogBook%20posts.php%20add_post%20post_image%20Parameter%20Unrestricted%20Upload.md
CVE ID: CVE-2025-5407 State: PUBLISHED Published: 2025-06-01T21:00:16.120Z Last Updated: 2025-06-02T03:41:06.375Z Severity: N/A (CVSS 3.3 AV:N/AC:L/Au:M/C:N/I:P/A:N) Vendors: chaitak-gorai Products: Blogbook Problem Types: CWE-79, CWE-94 Description: A vulnerability has been found in chaitak-gorai Blogbook up to 92f5cf90f8a7e6566b576fe0952e14e1c6736513 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /register_script.php. The manipulation of the argument fullname leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why
emotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. It is recommended to upgrade the affected component. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.310747 - https://vuldb.com/?ctiid.310747 - https://vuldb.com/?submit.583432 - https://github.com/rllvusgnzm98/Report/blob/main/blogbook/BlogBook%20Stored%20XSS%20in%20User%20Registration%20via%20fullname%20Parameter%20Leading%20to%20Admin%20Account%20Takeover.md
CVE ID: CVE-2025-5408 State: PUBLISHED Published: 2025-06-01T21:31:04.615Z Last Updated: 2025-06-02T03:39:40.779Z Severity: N/A (CVSS 10 AV:N/AC:L/Au:N/C:C/I:C/A:C) Vendors: WAVLINK Products: QUANTUM D2G, QUANTUM D3G, WL-WN530G3A, WL-WN530HG3, WL-WN532A3, WL-WN576K1 Problem Types: CWE-120, CWE-119 Description: A vulnerability was found in WAVLINK QUANTUM D2G, QUANTUM D3G, WL-WN530G3A, WL-WN530HG3, WL-WN532A3 and WL-WN576K1 up to V1410_240222 and classified as critical. Affected by this issue is the function sys_login of the file /cgi-bin/login.cgi of the component HTTP POST Request Handler. The manipulation of the argument login_page leads to buffer overflow. The attack may be launched remot
Request Handler. The manipulation of the argument login_page leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.310748 - https://vuldb.com/?ctiid.310748 - https://vuldb.com/?submit.583486 - https://github.com/CH13hh/tmp_store_cc/blob/main/wavlink/1.md
CVE ID: CVE-2025-5409 State: PUBLISHED Published: 2025-06-01T22:00:16.052Z Last Updated: 2025-06-02T03:38:52.683Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: Mist Products: Community Edition Problem Types: CWE-284, CWE-266 Description: A vulnerability was found in Mist Community Edition up to 4.7.1. It has been classified as critical. This affects the function create_token of the file src/mist/api/auth/views.py of the component API Token Handler. The manipulation leads to improper access controls. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 4.7.2 is able to address this issue. The identifi