Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-30472 State: PUBLISHED Published: 2025-03-22T00:00:00.000Z Last Updated: 2025-11-03T18:09:02.939Z Severity: CRITICAL (CVSS 9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Corosync Products: Corosync Problem Types: CWE-121 Description: Corosync through 3.1.9, if encryption is disabled or the attacker knows the encryption key, has a stack-based buffer overflow in orf_token_endian_convert in exec/totemsrp.c via a large UDP packet. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/corosync/corosync/blob/73ba225cc48ebb1903897c792065cb5e876613b0/exec/totemsrp.c#L4677 - https://github.com/corosync/corosync/issues/7
sync/blob/73ba225cc48ebb1903897c792065cb5e876613b0/exec/totemsrp.c#L4677 - https://github.com/corosync/corosync/issues/778 - https://corosync.org
CVE ID: CVE-2025-30473 State: PUBLISHED Published: 2025-04-07T08:31:57.220Z Last Updated: 2025-04-08T03:56:18.413Z Vendors: Apache Software Foundation Products: Apache Airflow Common SQL Provider Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Airflow Common SQL Provider. When using the partition clause in SQLTableCheckOperator as parameter (which was a recommended pattern), Authenticated UI User could inject arbitrary SQL command when triggering DAG exposing partition_clause to the user. This allowed the DAG Triggering user to escalate privileges to execute those arbitrary commands which they nor
the user. This allowed the DAG Triggering user to escalate privileges to execute those arbitrary commands which they normally would not have. This issue affects Apache Airflow Common SQL Provider: before 1.24.1. Users are recommended to upgrade to version 1.24.1, which fixes the issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/apache/airflow/pull/48098 - https://lists.apache.org/thread/53klkv790cylqcop0350w7nfq1y6h0t2
CVE ID: CVE-2025-30474 State: PUBLISHED Published: 2025-03-23T14:15:51.339Z Last Updated: 2025-04-01T18:04:55.401Z Vendors: Apache Software Foundation Products: Apache Commons VFS Problem Types: CWE-200 Description: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Commons VFS. The FtpFileObject class can throw an exception when a file is not found, revealing the original URI in its message, which may include a password. The fix is to mask the password in the exception message This issue affects Apache Commons VFS: before 2.10.0. Users are recommended to upgrade to version 2.10.0, which fixes the issue. Additional Analyst Notes: - CVE Program Container: - CIS
ecommended to upgrade to version 2.10.0, which fixes the issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://issues.apache.org/jira/browse/VFS-169 - https://lists.apache.org/thread/w6ztgnbk6ccry3470x191g3xwrpgy6f4
CVE ID: CVE-2025-30475 State: PUBLISHED Published: 2025-05-15T18:40:47.496Z Last Updated: 2025-05-16T18:25:38.459Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Dell Products: PowerScale InsightIQ Problem Types: CWE-269 Description: Dell PowerScale InsightIQ, versions 5.0 through 5.2, contains an improper privilege management vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to elevation of privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000317889/dsa-2025-186-security-update-for-dell-powerscale-inightiq-multiple-security-vu
ww.dell.com/support/kbdoc/en-us/000317889/dsa-2025-186-security-update-for-dell-powerscale-inightiq-multiple-security-vulnerabilities
CVE ID: CVE-2025-30476 State: PUBLISHED Published: 2025-05-15T18:45:20.520Z Last Updated: 2025-05-16T18:25:54.661Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: Dell Products: PowerScale InsightIQ Problem Types: CWE-400 Description: Dell PowerScale InsightIQ, version 5.2, contains an uncontrolled resource consumption vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to denial of service. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000317889/dsa-2025-186-security-update-for-dell-powerscale-inightiq-multiple-security-vulnerabilities
CVE ID: CVE-2025-30477 State: PUBLISHED Published: 2025-07-21T16:32:48.639Z Last Updated: 2025-07-21T17:53:42.835Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: Dell Products: PowerScale OneFS Problem Types: CWE-327 Description: Dell PowerScale OneFS, versions prior to 9.11.0.0, contains a use of a broken or risky cryptographic algorithm vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000317419/dsa-2025-192-security-update-for-dell-powerscale-onefs-for-multipl
- https://www.dell.com/support/kbdoc/en-us/000317419/dsa-2025-192-security-update-for-dell-powerscale-onefs-for-multiple-security-vulnerabilities
CVE ID: CVE-2025-30479 State: PUBLISHED Published: 2025-11-05T16:27:33.266Z Last Updated: 2025-11-06T04:55:37.459Z Severity: HIGH (CVSS 8.4 CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Dell Products: CloudLink Problem Types: CWE-78 Description: Dell CloudLink, versions prior to 8.2, contain a vulnerability where a privileged user with known password can run command injection to gain control of system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000384363/dsa-2025-374-security-update-for-dell-cloudlink-multiple-security-vulnerabilities
CVE ID: CVE-2025-30480 State: PUBLISHED Published: 2025-07-30T18:01:53.920Z Last Updated: 2025-07-30T18:21:24.665Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Dell Products: PowerProtect Data Manager Problem Types: CWE-20 Description: Dell PowerProtect Data Manager, versions prior to 19.19, contain(s) an Improper Input Validation vulnerability in PowerProtect Data Manager. A low privileged attacker with remote access could potentially exploit this vulnerability to read arbitrary files. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000349609/dsa-2025-304-security-update-for-dell-powerprotect-data
References: - https://www.dell.com/support/kbdoc/en-us/000349609/dsa-2025-304-security-update-for-dell-powerprotect-data-manager-multiple-security-vulnerabilities
CVE ID: CVE-2025-30483 State: PUBLISHED Published: 2025-07-15T14:30:20.106Z Last Updated: 2025-07-15T14:44:55.458Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Dell Products: ECS, ObjectScale Problem Types: CWE-532 Description: Dell ECS versions prior to 3.8.1.5/ ObjectScale version 4.0.0.0 contains an Insertion of Sensitive Information into Log File vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information disclosure. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000339124/dsa-2025-242-security-update-for-dell-ecs-and-dell-obj
References: - https://www.dell.com/support/kbdoc/en-us/000339124/dsa-2025-242-security-update-for-dell-ecs-and-dell-objectscale-insertion-of-sensitive-information-into-log-file-vulnerability
CVE ID: CVE-2025-30485 State: PUBLISHED Published: 2025-04-03T06:18:36.311Z Last Updated: 2025-04-03T13:41:26.206Z Severity: MEDIUM (CVSS 6.2 CVSS:3.0/AV:P/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Century Systems Co., Ltd. Products: FutureNet NXR-1420, FutureNet NXR-1300 series, FutureNet NXR-650, FutureNet NXR-610X series, FutureNet NXR-530, FutureNet NXR-350/C, FutureNet NXR-230/C, FutureNet NXR-160/LW, FutureNet NXR-G540 series, FutureNet NXR-G260 series, FutureNet NXR-G240 series, FutureNet NXR-G180/L-CA, FutureNet NXR-G120 series, FutureNet NXR-G110 series, FutureNet NXR-G100 series, FutureNet NXR-G060 series, FutureNet NXR-G050 series, FutureNet VXR-x64, FutureNet VXR-x86, FutureNet NX
XR-G100 series, FutureNet NXR-G060 series, FutureNet NXR-G050 series, FutureNet VXR-x64, FutureNet VXR-x86, FutureNet NXR-1200, FutureNet NXR-130/C, FutureNet NXR-155/C-L, FutureNet NXR-155/C-XW, FutureNet NXR-155/C-WM, FutureNet NXR-125/CX, FutureNet NXR-120/C, FutureNet NXR-G100/SLW, FutureNet NXR-G100/SL, FutureNet NXR-G100/S, FutureNet NXR-G100/N, FutureNet NXR-G100/F, FutureNet WXR-250 Problem Types: CWE-61 Description: UNIX symbolic link (Symlink) following issue exists in FutureNet NXR series, VXR series and WXR series routers. Attaching to the affected product an external storage containing malicious symbolic link files, a logged-in administrative user may obtain and/or destroy inter
ternal storage containing malicious symbolic link files, a logged-in administrative user may obtain and/or destroy internal files. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.centurysys.co.jp/backnumber/common/jvnvu92821536.html - https://jvn.jp/en/vu/JVNVU92821536/
CVE ID: CVE-2025-30506 State: PUBLISHED Published: 2025-11-11T16:50:37.590Z Last Updated: 2025-11-13T04:55:34.153Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: n/a Products: Intel Driver and Support Assistant Problem Types: Escalation of Privilege, CWE-427 Description: Uncontrolled search path for some Intel Driver and Support Assistant before version 25.2 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with an authenticated user combined with a high complexity attack may enable local code execution. This result may potentially occur via local access when attack requirements are not present without sp
l code execution. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires active user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01361.html
CVE ID: CVE-2025-30507 State: PUBLISHED Published: 2025-06-09T22:09:42.444Z Last Updated: 2025-06-10T15:28:44.822Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: CyberData Products: 011209 SIP Emergency Intercom Problem Types: CWE-89 Description: CyberData 011209 Intercom could allow an unauthenticated user to gather sensitive information through blind SQL injections. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-25-155-01
CVE ID: CVE-2025-30509 State: PUBLISHED Published: 2025-11-11T16:50:39.202Z Last Updated: 2025-11-13T04:55:28.351Z Severity: LOW (CVSS 3.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N) Vendors: n/a Products: Intel QuickAssist Technology software Problem Types: Escalation of Privilege, CWE-20 Description: Improper input validation for some Intel QuickAssist Technology software before version 2.6.0 within Ring 3: User Applications may allow an escalation of privilege. System software adversary with an authenticated user combined with a low complexity attack may enable data manipulation. This result may potentially occur via local access when attack requirements are not present without special
nipulation. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (low) and availability (none) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01373.html
CVE ID: CVE-2025-30510 State: PUBLISHED Published: 2025-04-15T21:36:07.191Z Last Updated: 2025-04-16T14:41:51.796Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Growatt Products: Cloud portal Problem Types: CWE-351 Description: An attacker can upload an arbitrary file instead of a plant image. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-25-105-04
CVE ID: CVE-2025-30511 State: PUBLISHED Published: 2025-04-15T20:12:09.876Z Last Updated: 2025-04-16T15:46:18.058Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Growatt Products: Cloud portal Problem Types: CWE-79 Description: An authenticated attacker can achieve stored XSS by exploiting improper sanitization of the plant name value while adding or editing a plant. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-25-105-04
CVE ID: CVE-2025-30512 State: PUBLISHED Published: 2025-04-15T21:45:46.649Z Last Updated: 2025-04-16T14:41:18.922Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) Vendors: Growatt Products: Cloud portal Problem Types: CWE-15 Description: Unauthenticated attackers can send configuration settings to device and possible perform physical actions remotely (e.g., on/off). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-25-105-04
CVE ID: CVE-2025-30514 State: PUBLISHED Published: 2025-04-15T21:05:11.863Z Last Updated: 2025-04-16T15:09:11.768Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Growatt Products: Cloud portal Problem Types: CWE-639 Description: Unauthenticated attackers can obtain restricted information about a user's smart device collections (i.e., "scenes"). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-25-105-04
CVE ID: CVE-2025-30515 State: PUBLISHED Published: 2025-06-09T22:31:50.355Z Last Updated: 2025-06-10T15:28:18.302Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: CyberData Products: 011209 SIP Emergency Intercom Problem Types: CWE-35 Description: CyberData 011209 Intercom could allow an authenticated attacker to upload arbitrary files to multiple locations within the system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-25-155-01
CVE ID: CVE-2025-30516 State: PUBLISHED Published: 2025-04-14T06:56:22.327Z Last Updated: 2025-04-14T14:01:51.133Z Severity: LOW (CVSS 2 CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Mattermost Products: Mattermost Problem Types: CWE-613 Description: Mattermost Mobile Apps versions <=2.25.0 fail to terminate sessions during logout under certain conditions (e.g. poor connectivity), allowing unauthorized users on shared devices to access sensitive notification content via continued mobile notifications Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://mattermost.com/security-updates
CVE ID: CVE-2025-30518 State: PUBLISHED Published: 2025-11-11T16:50:40.956Z Last Updated: 2025-11-14T04:55:31.159Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: n/a Products: Intel(R) PresentMon Problem Types: Escalation of Privilege, CWE-276 Description: Incorrect default permissions for some Intel(R) PresentMon before version 2.3.1 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with an authenticated user combined with a high complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are present without special internal knowledge
s result may potentially occur via local access when attack requirements are present without special internal knowledge and requires active user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01392.html
CVE ID: CVE-2025-30519 State: PUBLISHED Published: 2025-09-18T20:46:42.642Z Last Updated: 2025-09-19T13:05:20.889Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Dover Fueling Solutions Products: ProGauge MagLink LX 4, ProGauge MagLink LX Plus, ProGauge MagLink LX Ultimate Problem Types: CWE-1391 Description: Dover Fueling Solutions ProGauge MagLink LX4 Devices have default root credentials that cannot be changed through standard administrative means. An attacker with network access to the device can gain administrative access to the system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/ic
tem. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-25-261-07 - https://www.doverfuelingsolutions.com/mea/en/products-and-solutions/automatic-tank-gauging/consoles/progauge-maglink-lx-4-console.html
CVE ID: CVE-2025-30520 State: PUBLISHED Published: 2025-04-01T05:31:33.710Z Last Updated: 2025-04-01T13:29:51.725Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: crosstec Products: Breezing Forms Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in crosstec Breezing Forms allows Reflected XSS. This issue affects Breezing Forms: from n/a through 1.2.8.11. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/breezing-forms/vulnerability/wordpress-breezing-forms-plugin-1-2-8-11-reflected-cross-site-scripting-xss-vulnera
/plugin/breezing-forms/vulnerability/wordpress-breezing-forms-plugin-1-2-8-11-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-30521 State: PUBLISHED Published: 2025-03-24T13:46:36.103Z Last Updated: 2025-03-24T15:13:26.245Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: giangmd93 Products: GP Back To Top Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in giangmd93 GP Back To Top allows Cross Site Request Forgery. This issue affects GP Back To Top: from n/a through 3.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/gp-back-to-top/vulnerability/wordpress-gp-back-to-top-plugin-3-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2025-30522 State: PUBLISHED Published: 2025-03-24T13:46:36.766Z Last Updated: 2025-03-24T15:13:18.764Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Damian Orzol Products: Contact Form 7 Material Design Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Damian Orzol Contact Form 7 Material Design allows Stored XSS. This issue affects Contact Form 7 Material Design: from n/a through 1.0.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/cf7-material-design/vulnerability/wordpress-contact-form-7-material-design-plugin-1-0-0-csrf-to-stored-xss-vulne
/plugin/cf7-material-design/vulnerability/wordpress-contact-form-7-material-design-plugin-1-0-0-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-30523 State: PUBLISHED Published: 2025-03-24T13:46:37.509Z Last Updated: 2025-03-24T15:13:11.168Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L) Vendors: Marcel-NL Products: Super Simple Subscriptions Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Marcel-NL Super Simple Subscriptions allows SQL Injection. This issue affects Super Simple Subscriptions: from n/a through 1.1.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/super-simple-subscriptions/vulnerability/wordpress-super-simple-subscriptions
//patchstack.com/database/wordpress/plugin/super-simple-subscriptions/vulnerability/wordpress-super-simple-subscriptions-plugin-1-1-0-sql-injection-vulnerability?_s_id=cve
CVE ID: CVE-2025-30524 State: PUBLISHED Published: 2025-03-26T14:24:26.178Z Last Updated: 2025-03-26T14:53:27.560Z Severity: CRITICAL (CVSS 9.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L) Vendors: origincode Products: Product Catalog Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in origincode Product Catalog allows SQL Injection. This issue affects Product Catalog: from n/a through 1.0.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/displayproduct/vulnerability/wordpress-product-catalog-plugin-1-0-4-sql-injection-vulnerability?_s_id=cv
ordpress/plugin/displayproduct/vulnerability/wordpress-product-catalog-plugin-1-0-4-sql-injection-vulnerability?_s_id=cve
CVE ID: CVE-2025-30525 State: PUBLISHED Published: 2025-03-24T13:46:38.242Z Last Updated: 2025-03-24T15:12:54.389Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L) Vendors: ProfitShare.ro Products: WP Profitshare Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ProfitShare.ro WP Profitshare allows SQL Injection. This issue affects WP Profitshare: from n/a through 1.4.9. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wp-profitshare/vulnerability/wordpress-wp-profitshare-plugin-1-4-9-sql-injection-vulnerability?_s_id=cv
wordpress/plugin/wp-profitshare/vulnerability/wordpress-wp-profitshare-plugin-1-4-9-sql-injection-vulnerability?_s_id=cve
CVE ID: CVE-2025-30526 State: PUBLISHED Published: 2025-03-24T13:46:38.849Z Last Updated: 2025-03-24T15:10:38.382Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: lucksy Products: Typekit plugin for WordPress Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in lucksy Typekit plugin for WordPress allows Cross Site Request Forgery. This issue affects Typekit plugin for WordPress: from n/a through 1.2.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/typekit/vulnerability/wordpress-typekit-plugin-1-2-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2025-30527 State: PUBLISHED Published: 2025-03-24T13:46:39.622Z Last Updated: 2025-03-24T15:10:21.021Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: codetoolbox Products: My Bootstrap Menu Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in codetoolbox My Bootstrap Menu allows Stored XSS. This issue affects My Bootstrap Menu: from n/a through 1.2.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/my-bootstrap-menu/vulnerability/wordpress-my-bootstrap-menu-plugin-1-2-1-stored-cross-site-scripting-
e/wordpress/plugin/my-bootstrap-menu/vulnerability/wordpress-my-bootstrap-menu-plugin-1-2-1-stored-cross-site-scripting-xss-vulnerability?_s_id=cve