Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-3890 State: PUBLISHED Published: 2025-05-01T11:11:42.311Z Last Updated: 2025-05-01T13:39:53.098Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: mra13 Products: WordPress Simple Shopping Cart Problem Types: CWE-79 Description: The WordPress Simple Shopping Cart plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wp_cart_button' shortcode in all versions up to, and including, 5.1.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will e
r authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/93898bf8-cfed-44bf-9d68-a0167beba86a?source=cve - https://plugins.trac.wordpress.org/browser/wordpress-simple-paypal-shopping-cart/tags/5.1.2/includes/wpsc-shortcodes-related.php#L20 - https://www.tipsandtricks-hq.com/ecommerce/simple-wp-shopping-cart-installation-usage-290#step-1-inserting-an-add-to-cart-button - https://plugins.trac.wordpress.org/changeset/3284572/
CVE ID: CVE-2025-3891 State: PUBLISHED Published: 2025-04-29T11:56:50.808Z Last Updated: 2025-11-11T12:09:56.342Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Red Hat Products: Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 8.2 Advanced Update Support, Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.6 Telecommunications Update Service, Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions, Red Hat Enterprise Linux 8.8 Telecommunications Update Service, Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions, Red Hat
se Linux 8.8 Telecommunications Update Service, Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions, Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions, Red Hat Enterprise Linux 9.4 Extended Update Support, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7 Problem Types: CWE-248 Description: A flaw was found in the mod_auth_openidc module for Apache httpd. This flaw allows a remote, unauthenticated attacker to trigger a denial of service by sending an empty POST request when the OIDCPreservePost directive is enabled. The server crashes consistently, affecting availability.
ty POST request when the OIDCPreservePost directive is enabled. The server crashes consistently, affecting availability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2025:10002 - https://access.redhat.com/errata/RHSA-2025:10003 - https://access.redhat.com/errata/RHSA-2025:10004 - https://access.redhat.com/errata/RHSA-2025:10006 - https://access.redhat.com/errata/RHSA-2025:10007 - https://access.redhat.com/errata/RHSA-2025:10008 - https://access.redhat.com/errata/RHSA-2025:10010 - https://access.redhat.com/errata/RHSA-2025:4597 - https://access.redhat.com/errata/RHSA-2025:9396 - https://access.redhat.com/securi
ss.redhat.com/errata/RHSA-2025:4597 - https://access.redhat.com/errata/RHSA-2025:9396 - https://access.redhat.com/security/cve/CVE-2025-3891 - https://bugzilla.redhat.com/show_bug.cgi?id=2361633 - https://github.com/OpenIDC/mod_auth_openidc/commit/6a0b5f66c87184dfe0e4400f6bdd46a82dc0ec2b - https://github.com/OpenIDC/mod_auth_openidc/security/advisories/GHSA-x7cf-8wgv-5j86
CVE ID: CVE-2025-3892 State: PUBLISHED Published: 2025-08-12T05:14:43.655Z Last Updated: 2025-08-14T03:56:10.702Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Axis Communications AB Products: AXIS OS Problem Types: CWE-250 Description: ACAP applications can be executed with elevated privileges, potentially leading to privilege escalation. This vulnerability can only be exploited if the Axis device is configured to allow the installation of unsigned ACAP applications, and if an attacker convinces the victim to install a malicious ACAP application. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.axis.com/dam/public/ae/19/16/cve-
lication. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.axis.com/dam/public/ae/19/16/cve-2025-3892pdf-en-US-492760.pdf
CVE ID: CVE-2025-3893 State: PUBLISHED Published: 2025-05-23T10:20:02.391Z Last Updated: 2025-05-23T12:13:22.569Z Vendors: Jan Syski Products: MegaBIP Problem Types: CWE-89 Description: While editing pages managed by MegaBIP a user with high privileges is prompted to give a reasoning for performing this action. Input provided by the the user is not sanitized, leading to SQL Injection vulnerability. Version 5.20 of MegaBIP fixes this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert.pl/en/posts/2025/05/CVE-2025-3893 - https://megabip.pl/index.php?id=24,145 - https://www.gov.pl/web/cyfryzacja/rekomendacja-pelnomocnika-rzadu-ds-cyberbezpieczenstwa-dotyczaca-bi
ex.php?id=24,145 - https://www.gov.pl/web/cyfryzacja/rekomendacja-pelnomocnika-rzadu-ds-cyberbezpieczenstwa-dotyczaca-biuletynow-informacji-publicznej
CVE ID: CVE-2025-3894 State: PUBLISHED Published: 2025-05-23T10:20:03.081Z Last Updated: 2025-05-23T12:12:19.666Z Vendors: Jan Syski Products: MegaBIP Problem Types: CWE-79 Description: Text editor embedded into MegaBIP software does not neutralize user input allowing Stored XSS attacks on other users. In order to use the editor high privileges are required. Version 5.20 of MegaBIP fixes this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert.pl/en/posts/2025/05/CVE-2025-3893 - https://megabip.pl/index.php?id=24,145 - https://www.gov.pl/web/cyfryzacja/rekomendacja-pelnomocnika-rzadu-ds-cyberbezpieczenstwa-dotyczaca-biuletynow-informacji-publicznej
CVE ID: CVE-2025-3895 State: PUBLISHED Published: 2025-05-23T10:20:03.919Z Last Updated: 2025-05-23T12:07:48.408Z Vendors: Jan Syski Products: MegaBIP Problem Types: CWE-334 Description: Token used for resetting passwords in MegaBIP software are generated using a small space of random values combined with a queryable value. It allows an unauthenticated attacker who know user login names to brute force these tokens and change account passwords (including these belonging to administrators). Version 5.20 of MegaBIP fixes this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert.pl/en/posts/2025/05/CVE-2025-3893 - https://megabip.pl/index.php?id=24,145 - https://w
hment: References: - https://cert.pl/en/posts/2025/05/CVE-2025-3893 - https://megabip.pl/index.php?id=24,145 - https://www.gov.pl/web/cyfryzacja/rekomendacja-pelnomocnika-rzadu-ds-cyberbezpieczenstwa-dotyczaca-biuletynow-informacji-publicznej
CVE ID: CVE-2025-3896 State: REJECTED Published: N/A Last Updated: 2025-07-05T22:16:39.932Z Description: No description available.
CVE ID: CVE-2025-3897 State: PUBLISHED Published: 2025-05-09T11:11:19.819Z Last Updated: 2025-05-09T14:39:27.329Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: diego-la-monica Products: EUCookieLaw Problem Types: CWE-22 Description: The EUCookieLaw plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 2.7.2 via the 'file_get_contents' function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. The vulnerability can only be exploited if a caching plugin such as W3 Total Cache is installed and activated. Additional Anal
lnerability can only be exploited if a caching plugin such as W3 Total Cache is installed and activated. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d360de79-8490-4e70-b2d9-4f01a1ed3305?source=cve - https://plugins.trac.wordpress.org/browser/eucookielaw/trunk/templates/EUCookieCache.php#L26 - https://plugins.trac.wordpress.org/changeset/3288917/
CVE ID: CVE-2025-3898 State: PUBLISHED Published: 2025-06-10T08:22:02.228Z Last Updated: 2025-06-10T14:35:45.654Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: Schneider Electric Products: Modicon Controllers M241/M251, Modicon Controllers M262 Problem Types: CWE-20 Description: CWE-20: Improper Input Validation vulnerability exists that could cause Denial of Service when an authenticated malicious user sends HTTPS request containing invalid data type to the webserver. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2025-161-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=S
://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2025-161-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2025-161-02.pdf
CVE ID: CVE-2025-3899 State: PUBLISHED Published: 2025-06-10T08:25:39.254Z Last Updated: 2025-06-10T14:33:59.816Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: Schneider Electric Products: Modicon Controllers M241/M251 Problem Types: CWE-79 Description: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists in Certificates page on Webserver that could cause an unvalidated data injected by authenticated malicious user leading to modify or read data in a victim’s browser. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2025
Analyst Notes: - CISA ADP Vulnrichment: References: - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2025-161-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2025-161-02.pdf
CVE ID: CVE-2025-3900 State: PUBLISHED Published: 2025-04-23T17:07:37.137Z Last Updated: 2025-04-25T02:49:38.915Z Vendors: Drupal Products: Colorbox Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Colorbox allows Cross-Site Scripting (XSS).This issue affects Colorbox: from 0.0.0 before 2.1.3. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.drupal.org/sa-contrib-2025-041
CVE ID: CVE-2025-3901 State: PUBLISHED Published: 2025-04-23T17:07:53.321Z Last Updated: 2025-04-23T18:44:37.224Z Vendors: Drupal Products: Bootstrap Site Alert Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Bootstrap Site Alert allows Cross-Site Scripting (XSS).This issue affects Bootstrap Site Alert: from 0.0.0 before 1.13.0, from 3.0.0 before 3.0.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-contrib-2025-042
CVE ID: CVE-2025-3902 State: PUBLISHED Published: 2025-04-23T17:08:08.048Z Last Updated: 2025-04-23T18:45:16.583Z Vendors: Drupal Products: Block Class Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Block Class allows Cross-Site Scripting (XSS).This issue affects Block Class: from 4.0.0 before 4.0.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-contrib-2025-043
CVE ID: CVE-2025-3903 State: PUBLISHED Published: 2025-04-23T17:08:25.696Z Last Updated: 2025-04-23T18:53:56.720Z Vendors: Drupal Products: UEditor - 百度编辑器 Description: Vulnerability in Drupal UEditor - 百度编辑器.This issue affects UEditor - 百度编辑器: *.*. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-contrib-2025-044
CVE ID: CVE-2025-3904 State: PUBLISHED Published: 2025-04-23T17:08:41.205Z Last Updated: 2025-04-23T18:53:16.064Z Vendors: Drupal Products: Sportsleague Description: Vulnerability in Drupal Sportsleague.This issue affects Sportsleague: *.*. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-contrib-2025-045
CVE ID: CVE-2025-3905 State: PUBLISHED Published: 2025-06-10T08:32:09.065Z Last Updated: 2025-06-10T14:23:25.411Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: Schneider Electric Products: Modicon Controllers M241/M251, Modicon Controllers M258 / LMC058 Problem Types: CWE-79 Description: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists impacting PLC system variables that could cause an unvalidated data injected by authenticated malicious user leading to modify or read data in a victim’s browser. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://download.schneider-electr
n a victim’s browser. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2025-161-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2025-161-02.pdf
CVE ID: CVE-2025-3906 State: PUBLISHED Published: 2025-04-26T05:34:24.565Z Last Updated: 2025-04-28T15:34:41.450Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: felipe152 Products: Integração entre Eduzz e Woocommerce Problem Types: CWE-862 Description: The Integração entre Eduzz e Woocommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wep_opcoes' function in all versions up to, and including, 1.7.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to edit the default registration role within the plugin's registration flow to Administrator, which
l access and above, to edit the default registration role within the plugin's registration flow to Administrator, which allows any user to create an Administrator account. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/eb85ed32-c391-45d2-9e86-cb97009210cd?source=cve - https://plugins.trac.wordpress.org/browser/integracao-entre-eduzz-e-wc-powers/trunk/admin/class-wep-admin.php#L120 - https://plugins.trac.wordpress.org/browser/integracao-entre-eduzz-e-wc-powers/trunk/include/class-wep-webhook.php#L7 - https://plugins.trac.wordpress.org/browser/integracao-entre-eduzz-e-wc-powers/trunk/wep-powers.php#L19
CVE ID: CVE-2025-3907 State: PUBLISHED Published: 2025-04-23T17:08:59.452Z Last Updated: 2025-04-23T17:53:57.671Z Vendors: Drupal Products: Search API Solr Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Drupal Search API Solr allows Cross Site Request Forgery.This issue affects Search API Solr: from 0.0.0 before 4.3.9. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-contrib-2025-046
CVE ID: CVE-2025-3908 State: PUBLISHED Published: 2025-05-19T14:59:08.482Z Last Updated: 2025-05-20T18:04:08.335Z Vendors: OpenVPN Products: OpenVPN 3 Linux Problem Types: CWE-59 Description: The configuration initialization tool in OpenVPN 3 Linux v20 through v24 on Linux allows a local attacker to use symlinks pointing at an arbitrary directory which will change the ownership and permissions of that destination directory. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://community.openvpn.net/Security%20Announcements/CVE-2025-3908
CVE ID: CVE-2025-3909 State: PUBLISHED Published: 2025-05-14T16:56:43.630Z Last Updated: 2025-11-03T19:58:39.208Z Vendors: Mozilla Products: Thunderbird Problem Types: JavaScript Execution via Spoofed PDF Attachment and file:/// Link Description: Thunderbird's handling of the X-Mozilla-External-Attachment-URL header can be exploited to execute JavaScript in the file:/// context. By crafting a nested email attachment (message/rfc822) and setting its content type to application/pdf, Thunderbird may incorrectly render it as HTML when opened, allowing the embedded JavaScript to run without requiring a file download. This behavior relies on Thunderbird auto-saving the attachment to /tmp and linki
run without requiring a file download. This behavior relies on Thunderbird auto-saving the attachment to /tmp and linking to it via the file:/// protocol, potentially enabling JavaScript execution as part of the HTML. This vulnerability affects Thunderbird < 128.10.1 and Thunderbird < 138.0.1. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1958376 - https://www.mozilla.org/security/advisories/mfsa2025-34/ - https://www.mozilla.org/security/advisories/mfsa2025-35/
CVE ID: CVE-2025-3910 State: PUBLISHED Published: 2025-04-29T20:46:39.828Z Last Updated: 2025-11-20T20:24:18.031Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) Vendors: Red Hat Products: Red Hat Build of Keycloak, Red Hat build of Keycloak 26.0 Problem Types: CWE-287 Description: A flaw was found in Keycloak. The org.keycloak.authorization package may be vulnerable to circumventing required actions, allowing users to circumvent requirements such as setting up two-factor authentication. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.redhat.com/errata/RHSA-2025:4335 - https://access.redhat.com/errata/RHSA-2025:4336 - https://access.re
- https://access.redhat.com/errata/RHSA-2025:4335 - https://access.redhat.com/errata/RHSA-2025:4336 - https://access.redhat.com/security/cve/CVE-2025-3910 - https://bugzilla.redhat.com/show_bug.cgi?id=2361923 - https://github.com/keycloak/keycloak/issues/39349
CVE ID: CVE-2025-3911 State: PUBLISHED Published: 2025-04-29T17:20:34.740Z Last Updated: 2025-04-29T17:58:50.628Z Vendors: Docker Products: Docker Desktop Problem Types: CWE-532 Description: Recording of environment variables, configured for running containers, in Docker Desktop application logs could lead to unintentional disclosure of sensitive information such as api keys, passwords, etc. A malicious actor with read access to these logs could obtain sensitive credentials information and further use it to gain unauthorized access to other systems. Starting with version 4.41.0, Docker Desktop no longer logs environment variables set by the user. Additional Analyst Notes: - CISA ADP Vulnrich
41.0, Docker Desktop no longer logs environment variables set by the user. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.docker.com/desktop/troubleshoot-and-support/troubleshoot/#check-the-logs
CVE ID: CVE-2025-3912 State: PUBLISHED Published: 2025-04-25T11:12:52.021Z Last Updated: 2025-04-25T13:53:42.292Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: westguard Products: WS Form LITE – Drag & Drop Contact Form Builder for WordPress Problem Types: CWE-862 Description: The WS Form LITE – Drag & Drop Contact Form Builder for WordPress plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'get_config' function in all versions up to, and including, 1.10.35. This makes it possible for unauthenticated attackers to read the value of the plugin's settings, including API keys for integrated services. Add
or unauthenticated attackers to read the value of the plugin's settings, including API keys for integrated services. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/3f6058e2-a5ec-43b2-9cb7-9efcf0853ffc?source=cve - https://plugins.trac.wordpress.org/browser/ws-form/trunk/ws-form.php - https://plugins.trac.wordpress.org/browser/ws-form/trunk/api/class-ws-form-api.php - https://plugins.trac.wordpress.org/browser/ws-form/trunk/includes/class-ws-form-config.php - https://plugins.trac.wordpress.org/browser/ws-form/trunk/includes/class-ws-form-common.php - https://plugins.trac.wordpress.org/changeset/3280355/
CVE ID: CVE-2025-3913 State: PUBLISHED Published: 2025-05-29T15:10:36.914Z Last Updated: 2025-05-29T15:43:16.437Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Mattermost Products: Mattermost Problem Types: CWE-863 Description: Mattermost versions 10.7.x <= 10.7.0, 10.6.x <= 10.6.2, 10.5.x <= 10.5.3, 9.11.x <= 9.11.12 fail to properly validate permissions when changing team privacy settings, allowing team administrators without the 'invite user' permission to access and modify team invite IDs via the /api/v4/teams/:teamId/privacy endpoint. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://mattermost.com/security-updates
CVE ID: CVE-2025-3914 State: PUBLISHED Published: 2025-04-26T05:34:24.102Z Last Updated: 2025-04-28T15:34:48.483Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: aeropage Products: Aeropage Sync for Airtable Problem Types: CWE-434 Description: The Aeropage Sync for Airtable plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'aeropage_media_downloader' function in all versions up to, and including, 3.2.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. Additional A
ove, to upload arbitrary files on the affected site's server which may make remote code execution possible. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a501c2d6-cdcc-4003-99df-245f5253e20f?source=cve - https://plugins.trac.wordpress.org/browser/aeropage-sync-for-airtable/trunk/aeropage.php#L1214 - https://plugins.trac.wordpress.org/browser/aeropage-sync-for-airtable/trunk/aeropage.php#L1215 - https://plugins.trac.wordpress.org/browser/aeropage-sync-for-airtable/trunk/aeropage.php#L1250 - https://plugins.trac.wordpress.org/changeset/3281904/
CVE ID: CVE-2025-3915 State: PUBLISHED Published: 2025-04-26T05:34:25.018Z Last Updated: 2025-04-28T15:34:35.532Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: aeropage Products: Aeropage Sync for Airtable Problem Types: CWE-862 Description: The Aeropage Sync for Airtable plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'aeropageDeletePost' function in all versions up to, and including, 3.2.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary posts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/t
to delete arbitrary posts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f98aab54-877b-47df-9c8a-5e70ea985c1c?source=cve - https://plugins.trac.wordpress.org/browser/aeropage-sync-for-airtable/trunk/aeropage.php#L475 - https://plugins.trac.wordpress.org/browser/aeropage-sync-for-airtable/trunk/aeropage.php#L476 - https://plugins.trac.wordpress.org/changeset/3281904/
CVE ID: CVE-2025-3916 State: PUBLISHED Published: 2025-05-13T08:35:01.329Z Last Updated: 2025-05-13T13:12:28.231Z Vendors: Schneider Electric Products: EcoStruxure™ Power Build Rapsody software Problem Types: CWE-121 Description: CWE-121: Stack-based Buffer Overflow vulnerability exists that could cause local attackers being able to exploit these issues to potentially execute arbitrary code while the end user opens a malicious project file (SSD file) provided by the attacker. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2025-133-03&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2025-133-03.pdf