Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-8894 State: PUBLISHED Published: 2025-09-16T14:19:30.719Z Last Updated: 2025-10-06T15:19:39.631Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Autodesk Products: Revit, Revit LT, AutoCAD, AutoCAD Architecture, AutoCAD Electrical, AutoCAD Mechanical, AutoCAD MEP, AutoCAD Plant 3D, AutoCAD MAP 3D, Civil 3D, Advance Steel, AutoCAD LT Problem Types: CWE-122 Description: A maliciously crafted PDF file, when parsed through certain Autodesk products, can force a Heap-Based Overflow vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process.
s vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.autodesk.com/products/autodesk-access/overview - https://www.autodesk.com/trust/security-advisories/adsk-sa-2025-0018
CVE ID: CVE-2025-8895 State: PUBLISHED Published: 2025-08-21T07:26:35.909Z Last Updated: 2025-08-21T13:33:20.156Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: cozmoslabs Products: WP Webhooks – Automate repetitive tasks by creating powerful automation workflows directly within WordPress Problem Types: CWE-22 Description: The WP Webhooks plugin for WordPress is vulnerable to arbitrary file copy due to missing validation of user-supplied input in all versions up to, and including, 3.3.5. This makes it possible for unauthenticated attackers to copy arbitrary files on the affected site's server to arbitrary locations. This can be used to copy the contents o
rs to copy arbitrary files on the affected site's server to arbitrary locations. This can be used to copy the contents of wp-config.php into a text file which can then be accessed in a browser to reveal database credentials. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/de9c9e1e-3c3c-463a-a78c-d8bc7228da93?source=cve - https://wordpress.org/plugins/wp-webhooks - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3347509%40wp-webhooks%2Ftrunk&old=3327632%40wp-webhooks%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2025-8896 State: PUBLISHED Published: 2025-08-16T06:39:22.024Z Last Updated: 2025-08-18T13:15:59.724Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: cozmoslabs Products: User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor Problem Types: CWE-79 Description: The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'gdpr_communication_preferences[]' parameter in all versions up to, and including, 3.14.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticat
and including, 3.14.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is only exploitable when the GDPR Communication Preferences module is enabled and at least one GDPR Communication Preferences field has been added to the edit profile form. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/1d28e118-07d3-483e-87b8-66ccdb79e879?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&repona
8e118-07d3-483e-87b8-66ccdb79e879?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3344317%40profile-builder&new=3344317%40profile-builder&sfp_email=&sfph_mail=
CVE ID: CVE-2025-8897 State: PUBLISHED Published: 2025-08-28T01:46:29.543Z Last Updated: 2025-08-28T14:24:37.797Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: justinbusa Products: Beaver Builder – WordPress Page Builder Problem Types: CWE-79 Description: The Beaver Builder – WordPress Page Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘'fl_builder' parameter in all versions up to, and including, 2.9.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into perform
cated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/93504959-2154-4b8c-a7d1-c982bdc8d034?source=cve - https://plugins.trac.wordpress.org/changeset/3350565/beaver-builder-lite-version/trunk/includes/ui-iframe.php
CVE ID: CVE-2025-8898 State: PUBLISHED Published: 2025-08-16T06:39:23.123Z Last Updated: 2025-08-18T17:57:16.001Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: magepeopleteam Products: E-cab Taxi Booking Manager for Woocommerce Problem Types: CWE-862 Description: The Taxi Booking Manager for Woocommerce | E-cab plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.3.0. This is due to the plugin not properly validating a user's capabilities prior to updating a plugin setting or their identity prior to updating their details like email address. This makes it possible for unauthenticated atta
ng or their identity prior to updating their details like email address. This makes it possible for unauthenticated attackers to change arbitrary user's email addresses, including administrators, and leverage that to reset the user's password and gain access to their account. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/fd50ac2c-3049-4a44-b7f8-a5f87c42555c?source=cve - https://wordpress.org/plugins/ecab-taxi-booking-manager/ - https://plugins.trac.wordpress.org/changeset/3343878/ecab-taxi-booking-manager/trunk/inc/MPTBM_Rest_Api.php
CVE ID: CVE-2025-8900 State: PUBLISHED Published: 2025-11-03T14:26:38.140Z Last Updated: 2025-11-03T14:42:18.817Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: dreamstechnologies Products: Doccure Core Problem Types: CWE-269 Description: The Doccure Core plugin for WordPress is vulnerable to privilege escalation in versions up to, and excluding, 1.5.4. This is due to the plugin allowing users who are registering new accounts to set their own role or by supplying 'user_type' field. This makes it possible for unauthenticated attackers to gain elevated privileges by creating an account with the administrator role. Additional Analyst Notes: - CISA ADP Vulnri
gain elevated privileges by creating an account with the administrator role. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/49e133c9-5d3b-4a2a-8385-e2db44baa217?source=cve - https://themeforest.net/item/doccure-medical-wordpress-theme/34329202
CVE ID: CVE-2025-8901 State: PUBLISHED Published: 2025-08-13T02:43:44.252Z Last Updated: 2025-08-28T16:36:58.788Z Vendors: Google Products: Chrome Problem Types: CWE-787 Description: Out of bounds write in ANGLE in Google Chrome prior to 139.0.7258.127 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2025/08/stable-channel-update-for-desktop_12.html - https://issues.chromium.org/issues/435139154
CVE ID: CVE-2025-8902 State: PUBLISHED Published: 2025-09-23T03:34:34.894Z Last Updated: 2025-09-23T13:55:17.024Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: Marketing Fire, LLC Products: Widget Options - Extended Problem Types: CWE-79 Description: The Widget Options - Extended plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'do_sidebar' shortcode in all versions up to, and including, 5.2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will e
r authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/98f8a524-b0b8-4e11-b789-bed3bd257a10?source=cve - https://widget-options.com/changelog/
CVE ID: CVE-2025-8904 State: PUBLISHED Published: 2025-08-13T17:06:29.293Z Last Updated: 2025-10-14T17:52:00.391Z Severity: HIGH (CVSS 8.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Amazon Products: EMR Problem Types: CWE-257 Description: Amazon EMR Secret Agent creates a keytab file containing Kerberos credentials. This file is stored in the /tmp/ directory. A user with access to this directory and another account can potentially decrypt the keys and escalate to higher privileges. Users are advised to upgrade to Amazon EMR version 7.5 or higher. For Amazon EMR releases between 6.10 and 7.4, we strongly recommend that you run the bootstrap script and RPM files with the fix provid
releases between 6.10 and 7.4, we strongly recommend that you run the bootstrap script and RPM files with the fix provided in the location below. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.aws.amazon.com/emr/latest/ReleaseGuide/emr-750-release.html - https://aws.amazon.com/security/security-bulletins/AWS-2025-017/ - https://github.com/advisories/GHSA-hf8h-76fm-735v
CVE ID: CVE-2025-8905 State: PUBLISHED Published: 2025-08-15T08:25:41.084Z Last Updated: 2025-08-15T16:07:46.703Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: inpersttion Products: Inpersttion For Theme Problem Types: CWE-94 Description: The Inpersttion For Theme plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.0 via the theme_section_shortcode() function. This is due to the plugin not restricting what functions can be called. This makes it possible for authenticated attackers, with Contributor-level access and above, to execute code on the server which is limited to arbitrary functions without any user s
ributor-level access and above, to execute code on the server which is limited to arbitrary functions without any user supplied parameters. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/cd4dc8ab-792b-41ff-a7b9-77a11c02d91b?source=cve - https://plugins.trac.wordpress.org/browser/err-our-team/trunk/inc/inpersttion-for-shortcode.php#L8
CVE ID: CVE-2025-8906 State: PUBLISHED Published: 2025-09-26T01:47:26.080Z Last Updated: 2025-09-26T19:21:10.064Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: trustindex Products: Widgets for Tiktok Feed Problem Types: CWE-79 Description: The Widgets for Tiktok Feed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'trustindex-feed' shortcode in all versions up to, and including, 1.7.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute w
ticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/0b070542-83fc-4086-a40d-15a8d31fadc5?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3363725%40widgets-for-tiktok-video-feed&new=3363725%40widgets-for-tiktok-video-feed&sfp_email=&sfph_mail=
CVE ID: CVE-2025-8907 State: PUBLISHED Published: 2025-08-13T13:02:05.541Z Last Updated: 2025-08-13T19:56:16.523Z Severity: HIGH (CVSS 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R) Vendors: H3C Products: M2 NAS Problem Types: CWE-250 Description: A vulnerability was found in H3C M2 NAS V100R006. Affected by this vulnerability is an unknown functionality of the component Webserver Configuration. The manipulation leads to execution with unnecessary privileges. An attack has to be approached locally. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The vendor explains: "[T]he devic
appears to be difficult. The exploit has been disclosed to the public and may be used. The vendor explains: "[T]he device only has configuration files and does not actually have boa functionality. It is impossible to access or upload files anonymously to the device through boa services". This vulnerability only affects products that are no longer supported by the maintainer. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.319861 - https://vuldb.com/?ctiid.319861 - https://vuldb.com/?submit.624554 - https://www.notion.so/23f54a1113e7804bae88e76f9fb0cf5b
CVE ID: CVE-2025-8908 State: PUBLISHED Published: 2025-08-13T13:02:07.463Z Last Updated: 2025-08-13T19:55:55.230Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C) Vendors: Shanghai Lingdang Information Technology Products: Lingdang CRM Problem Types: CWE-89, CWE-74 Description: A vulnerability was determined in Shanghai Lingdang Information Technology Lingdang CRM up to 8.6.5.4. Affected by this issue is some unknown functionality of the file crm/WeiXinApp/yunzhijia/event.php. The manipulation of the argument openid leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 8.6.5 is able
be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 8.6.5 is able to address this issue. It is recommended to upgrade the affected component. The vendor explains: "All SQL injection vectors were patched via parameterized queries and input sanitization in v8.6.5+." Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.319862 - https://vuldb.com/?ctiid.319862 - https://vuldb.com/?submit.626276 - https://github.com/jackyliu666/blob2/blob/main/README.md - https://github.com/jackyliu666/event/
CVE ID: CVE-2025-8909 State: PUBLISHED Published: 2025-08-13T09:03:13.164Z Last Updated: 2025-08-13T19:57:57.085Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: WellChoose Products: Organization Portal System Problem Types: CWE-36 Description: Organization Portal System developed by WellChoose has an Arbitrary File Reading vulnerability, allowing remote attackers with regular privileges to exploit Absolute Path Traversal to download arbitrary system files. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-10321-3cae5-1.html - https://www.twcert.org.tw/en/cp-139-10325-70192-2.html
CVE ID: CVE-2025-8910 State: PUBLISHED Published: 2025-08-13T09:06:36.523Z Last Updated: 2025-08-13T19:57:47.288Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: WellChoose Products: Organization Portal System Problem Types: CWE-79 Description: Organization Portal System developed by WellChoose has a Reflected Cross-site Scripting vulnerability, allowing unauthenticated remote attackers to execute arbitrary JavaScript codes in user's browser through phishing attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-10321-3cae5-1.html - https://www.twcert.org.tw/en/cp-139-10325-70192-2.html
CVE ID: CVE-2025-8911 State: PUBLISHED Published: 2025-08-13T09:09:30.811Z Last Updated: 2025-08-13T19:57:33.544Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: WellChoose Products: Organization Portal System Problem Types: CWE-79 Description: Organization Portal System developed by WellChoose has a Reflected Cross-site Scripting vulnerability, allowing unauthenticated remote attackers to execute arbitrary JavaScript codes in user's browser through phishing attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-10321-3cae5-1.html - https://www.twcert.org.tw/en/cp-139-10325-70192-2.html
CVE ID: CVE-2025-8912 State: PUBLISHED Published: 2025-08-13T09:13:03.070Z Last Updated: 2025-08-13T13:27:52.799Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: WellChoose Products: Organization Portal System Problem Types: CWE-36 Description: Organization Portal System developed by WellChoose has an Arbitrary File Reading vulnerability, allowing unauthenticated remote attackers to exploit Absolute Path Traversal to download arbitrary system files. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-10321-3cae5-1.html - https://www.twcert.org.tw/en/cp-139-10325-70192-2.html
CVE ID: CVE-2025-8913 State: PUBLISHED Published: 2025-08-13T09:16:02.804Z Last Updated: 2025-08-13T13:21:43.069Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: WellChoose Products: Organization Portal System Problem Types: CWE-98 Description: Organization Portal System developed by WellChoose has a Local File Inclusion vulnerability, allowing unauthenticated remote attackers to execute arbitrary code on the server. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-10321-3cae5-1.html - https://www.twcert.org.tw/en/cp-139-10325-70192-2.html
CVE ID: CVE-2025-8914 State: PUBLISHED Published: 2025-08-13T09:18:55.270Z Last Updated: 2025-08-13T13:20:31.456Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: WellChoose Products: Organization Portal System Problem Types: CWE-89 Description: Organization Portal System developed by WellChoose has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read database contents. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-10321-3cae5-1.html - https://www.twcert.org.tw/en/cp-139-10325-70192-2.html
CVE ID: CVE-2025-8915 State: PUBLISHED Published: 2025-10-13T06:58:49.339Z Last Updated: 2025-10-14T13:17:19.180Z Vendors: Kiloview Products: N30 Problem Types: CWE-200 Description: Hardcoded TLS private key and certificate in firmware in Kiloview N30 2.02.246 allows malicious adversary to do a Mann-in-the-middle attack via the network Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.kiloview.com/en/support/download/n30-firmware-downloadlatest/
CVE ID: CVE-2025-8916 State: PUBLISHED Published: 2025-08-13T09:31:21.181Z Last Updated: 2025-09-12T11:17:08.609Z Vendors: Legion of the Bouncy Castle Inc. Products: BC Java, BCPKIX FIPS Problem Types: CWE-770 Description: Allocation of Resources Without Limits or Throttling vulnerability in Legion of the Bouncy Castle Inc. BC Java bcpkix on All (API modules), Legion of the Bouncy Castle Inc. BC Java bcprov on All (API modules), Legion of the Bouncy Castle Inc. BCPKIX FIPS bcpkix-fips on All (API modules) allows Excessive Allocation. This vulnerability is associated with program files https://github.Com/bcgit/bc-java/blob/main/pkix/src/main/java/org/bouncycastle/pkix/jcajce/PKIXCertPathRevie
ogram files https://github.Com/bcgit/bc-java/blob/main/pkix/src/main/java/org/bouncycastle/pkix/jcajce/PKIXCertPathReviewer.Java, https://github.Com/bcgit/bc-java/blob/main/prov/src/main/java/org/bouncycastle/x509/PKIXCertPathReviewer.Java. This issue affects BC Java: from 1.44 through 1.78; BC Java: from 1.44 through 1.78; BCPKIX FIPS: from 1.0.0 through 1.0.7, from 2.0.0 through 2.0.7. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902025%E2%80%908916
CVE ID: CVE-2025-8917 State: PUBLISHED Published: 2025-10-05T10:21:56.317Z Last Updated: 2025-10-06T14:15:59.384Z Severity: MEDIUM (CVSS 5.8 CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N) Vendors: allegroai Products: allegroai/clearml Problem Types: CWE-22 Description: A vulnerability in allegroai/clearml version v2.0.1 allows for path traversal due to improper handling of symbolic and hard links in the `safe_extract` function. This flaw can lead to arbitrary file writes outside the intended directory, potentially resulting in remote code execution if critical files are overwritten. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/588fcdd1-fea4-4cc2-
written. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/588fcdd1-fea4-4cc2-a9f8-851701dcb576 - https://github.com/allegroai/clearml/commit/64fb2bcbdbb87a74af90dd723d5ef4a99fceeb73
CVE ID: CVE-2025-8918 State: PUBLISHED Published: 2025-08-13T15:32:05.550Z Last Updated: 2025-08-13T16:54:36.428Z Severity: N/A (CVSS 3.3 AV:N/AC:L/Au:M/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: Portabilis Products: i-Educar Problem Types: CWE-79, CWE-94 Description: A vulnerability was found in Portabilis i-Educar up to 2.10. This issue affects some unknown processing of the file /intranet/educar_instituicao_cad.php of the component Editar Page. The manipulation of the argument neighborhood name leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not resp
has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.319877 - https://vuldb.com/?ctiid.319877 - https://vuldb.com/?submit.629164 - https://github.com/FeMarb/CVEs/blob/6eeefb2749bb6165557ed4664a0680456131e4de/i-educar/Cross-Site%20Scripting%20(XSS)%20Storage%20in%20endpoint%20_educar_instituicao_cad.php%20parameter%20neighborhood%20name.md
CVE ID: CVE-2025-8919 State: PUBLISHED Published: 2025-08-13T17:32:06.562Z Last Updated: 2025-08-15T21:09:03.695Z Severity: N/A (CVSS 3.3 AV:N/AC:L/Au:M/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: Portabilis Products: i-Diario Problem Types: CWE-79, CWE-94 Description: A vulnerability was determined in Portabilis i-Diario up to 1.6. Affected is an unknown function of the file /objetivos-de-aprendizagem-e-habilidades of the component History Page. The manipulation of the argument código/objetivo habilidade leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure b
ly. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.319878 - https://vuldb.com/?ctiid.319878 - https://vuldb.com/?submit.629166 - https://github.com/FeMarb/CVEs/tree/6eeefb2749bb6165557ed4664a0680456131e4de/I-diario - https://github.com/CVE-Hunters/CVE/blob/main/i-diario/CVE-2025-8919.md