Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/97c100c3-8a96-4198-b38a-206268ff20ec?source=cve - https://plugins.trac.wordpress.org/browser/bdthemes-element-pack-lite/tags/8.2.4/includes/setup-wizard/init.php#L420
CVE ID: CVE-2025-11538 State: PUBLISHED Published: 2025-11-13T16:47:53.933Z Last Updated: 2025-11-13T22:32:47.598Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: Red Hat Products: Red Hat build of Keycloak 26.4, Red Hat build of Keycloak 26.4.4 Problem Types: CWE-1327 Description: A vulnerability exists in Keycloak's server distribution where enabling debug mode (--debug <port>) insecurely defaults to binding the Java Debug Wire Protocol (JDWP) port to all network interfaces (0.0.0.0). This exposes the debug port to the local network, allowing an attacker on the same network segment to attach a remote debugger and achieve remote code execution within the Ke
wing an attacker on the same network segment to attach a remote debugger and achieve remote code execution within the Keycloak Java virtual machine. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.redhat.com/errata/RHSA-2025:21370 - https://access.redhat.com/errata/RHSA-2025:21371 - https://access.redhat.com/security/cve/CVE-2025-11538 - https://bugzilla.redhat.com/show_bug.cgi?id=2402622
CVE ID: CVE-2025-11539 State: PUBLISHED Published: 2025-10-09T07:18:15.819Z Last Updated: 2025-10-10T05:57:46.542Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Grafana Products: grafana-image-renderer Problem Types: CWE-94 Description: Grafana Image Renderer is vulnerable to remote code execution due to an arbitrary file write vulnerability. This is due to the fact that the /render/csv endpoint lacked validation of the filePath parameter that allowed an attacker to save a shared object to an arbitrary location that is then loaded by the Chromium process. Instances are vulnerable if: 1. The default token ("authToken") is not changed, or is known to the a
e Chromium process. Instances are vulnerable if: 1. The default token ("authToken") is not changed, or is known to the attacker. 2. The attacker can reach the image renderer endpoint. This issue affects grafana-image-renderer: from 1.0.0 through 4.0.16. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://grafana.com/security/security-advisories/cve-2025-11539/ - https://github.com/grafana/grafana-image-renderer/releases/tag/v4.0.17
CVE ID: CVE-2025-11546 State: PUBLISHED Published: 2025-11-07T01:09:08.662Z Last Updated: 2025-11-07T18:29:57.236Z Vendors: NEC Corporation Products: CLUSTERPRO X for Linux (EXPRESSCLUSTER X for Linux), CLUSTERPRO X SingleServerSafe for Linux (EXPRESSCLUSTER X SingleServerSafe for Linux) Problem Types: CWE-78 Description: CLUSTERPRO X for Linux 4.0, 4.1, 4.2, 5.0, 5.1 and 5.2 and EXPRESSCLUSTER X for Linux 4.0, 4.1, 4.2, 5.0, 5.1 and 5.2, CLUSTERPRO X SingleServerSafe for Linux 4.0, 4.1, 4.2, 5.0, 5.1 and 5.2, EXPRESSCLUSTER X SingleServerSafe for Linux 4.0, 4.1, 4.2, 5.0, 5.1 and 5.2 allows an attacker sends specially crafted network packets to the product, arbitrary OS commands may be exec
5.1 and 5.2 allows an attacker sends specially crafted network packets to the product, arbitrary OS commands may be executed without authentication. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://jpn.nec.com/security-info/secinfo/nv25-006_en.html
CVE ID: CVE-2025-11548 State: PUBLISHED Published: 2025-10-14T16:45:08.673Z Last Updated: 2025-10-14T19:15:39.041Z Vendors: ibi Products: WebFOCUS Problem Types: CWE-94 Description: A remote, unauthenticated privilege escalation in ibi WebFOCUS allows an attacker to gain administrative access to the application which may lead to unauthenticated Remote Code Execution Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://community.tibco.com/advisories/ibi-security-advisory-october-14-2025-ibi-webfocus-cve-2025-11548-r222/
CVE ID: CVE-2025-11549 State: PUBLISHED Published: 2025-10-09T17:02:06.797Z Last Updated: 2025-10-09T19:35:18.954Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR) Vendors: Tenda Products: W12 Problem Types: CWE-121, CWE-119 Description: A vulnerability has been found in Tenda W12 3.0.0.6(3948). The affected element is the function wifiMacFilterSet of the file /goform/modules of the component HTTP Request Handler. The manipulation of the argument mac leads to stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vu
een disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.327708 - https://vuldb.com/?ctiid.327708 - https://vuldb.com/?submit.670110 - https://github.com/z472421519/BinaryAudit/blob/main/PoC/BOF/Tenda_W12/cgiWifiMacFilterSet/cgiWifiMacFilterSet.md - https://www.tenda.com.cn/
CVE ID: CVE-2025-11550 State: PUBLISHED Published: 2025-10-09T18:02:06.757Z Last Updated: 2025-10-09T19:23:52.962Z Severity: N/A (CVSS 6.8 AV:N/AC:L/Au:S/C:N/I:N/A:C/E:POC/RL:ND/RC:UR) Vendors: Tenda Products: W12 Problem Types: CWE-476, CWE-404 Description: A vulnerability was found in Tenda W12 3.0.0.6(3948). The impacted element is the function wifiScheduledSet of the file /goform/modules of the component HTTP Request Handler. The manipulation of the argument wifiScheduledSet results in null pointer dereference. The attack may be performed from remote. The exploit has been made public and could be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id
en made public and could be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.327709 - https://vuldb.com/?ctiid.327709 - https://vuldb.com/?submit.670118 - https://github.com/z472421519/BinaryAudit/blob/main/PoC/NPD/Tenda_W12/cgiWifiScheduledSet/cgiWifiScheduledSet.md - https://www.tenda.com.cn/
CVE ID: CVE-2025-11551 State: PUBLISHED Published: 2025-10-09T18:02:09.355Z Last Updated: 2025-10-09T19:16:08.650Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: Student Result Manager Problem Types: CWE-89, CWE-74 Description: A vulnerability was determined in code-projects Student Result Manager 1.0. This affects an unknown function of the file src/students/Database.java. This manipulation of the argument roll/name/gpa causes sql injection. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.3
disclosed and may be utilized. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.327710 - https://vuldb.com/?ctiid.327710 - https://vuldb.com/?submit.670256 - https://github.com/lakshayyverma/CVE-Discovery/blob/main/Student%20Result%20Manager.md - https://code-projects.org/
CVE ID: CVE-2025-11552 State: PUBLISHED Published: 2025-10-09T19:02:05.015Z Last Updated: 2025-10-09T19:17:07.957Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: Online Complaint Site Problem Types: CWE-89, CWE-74 Description: A vulnerability was identified in code-projects Online Complaint Site 1.0. This impacts an unknown function of the file /admin/category.php. Such manipulation of the argument Category leads to sql injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.327711 - https://vuldb.
be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.327711 - https://vuldb.com/?ctiid.327711 - https://vuldb.com/?submit.670285 - https://github.com/QuJun1/cve/issues/4 - https://code-projects.org/
CVE ID: CVE-2025-11553 State: PUBLISHED Published: 2025-10-09T19:32:06.159Z Last Updated: 2025-10-10T14:25:48.290Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: Courier Management System Problem Types: CWE-89, CWE-74 Description: A weakness has been identified in code-projects Courier Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /add-courier.php. Executing manipulation of the argument Shippername can lead to sql injection. The attack can be launched remotely. The exploit has been made available to the public and could be exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: Refer
t has been made available to the public and could be exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.327713 - https://vuldb.com/?ctiid.327713 - https://vuldb.com/?submit.670287 - https://github.com/QuJun1/cve/issues/5 - https://code-projects.org/
CVE ID: CVE-2025-11554 State: PUBLISHED Published: 2025-10-09T20:02:06.510Z Last Updated: 2025-10-11T21:02:09.590Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: Portabilis Products: i-Educar Problem Types: CWE-277, CWE-266 Description: A security vulnerability has been detected in Portabilis i-Educar up to 2.9.10. Affected by this issue is some unknown functionality of the file app/Http/Controllers/AccessLevelController.php of the component User Type Handler. The manipulation leads to insecure inherited permissions. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment:
ed remotely. The exploit has been disclosed publicly and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.327714 - https://vuldb.com/?ctiid.327714 - https://vuldb.com/?submit.671072 - https://github.com/m3m0o/portabilis-ieducar-user-type-privilege-escalation
CVE ID: CVE-2025-11555 State: PUBLISHED Published: 2025-10-09T20:32:05.595Z Last Updated: 2025-10-10T14:33:31.154Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: Campcodes Products: Online Learning Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability was detected in Campcodes Online Learning Management System 1.0. This affects an unknown part of the file /admin/calendar_of_events.php. The manipulation of the argument date_start results in sql injection. The attack may be launched remotely. The exploit is now public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.327715 - https://vu
may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.327715 - https://vuldb.com/?ctiid.327715 - https://vuldb.com/?submit.671276 - https://github.com/Rowantu/CVE/issues/2 - https://www.campcodes.com/
CVE ID: CVE-2025-11556 State: PUBLISHED Published: 2025-10-09T20:32:08.110Z Last Updated: 2025-10-10T14:31:47.753Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: Simple Leave Manager Problem Types: CWE-89, CWE-74 Description: A flaw has been found in code-projects Simple Leave Manager 1.0. This vulnerability affects unknown code of the file /user.php. This manipulation of the argument table causes sql injection. Remote exploitation of the attack is possible. The exploit has been published and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.327716 - https://vuldb.com/?ctiid.327716 - htt
alyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.327716 - https://vuldb.com/?ctiid.327716 - https://vuldb.com/?submit.671358 - https://github.com/asd1238525/cve/blob/main/SQL8.md - https://code-projects.org/
CVE ID: CVE-2025-11557 State: PUBLISHED Published: 2025-10-09T21:02:05.659Z Last Updated: 2025-10-10T14:16:49.004Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: projectworlds Products: Gate Pass Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability has been found in projectworlds Gate Pass Management System 1.0. This issue affects some unknown processing of the file /add-pass.php. Such manipulation of the argument fullname leads to sql injection. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.327717
e public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.327717 - https://vuldb.com/?ctiid.327717 - https://vuldb.com/?submit.671406 - https://github.com/QIU-DIE/CVE/issues/6
CVE ID: CVE-2025-11558 State: PUBLISHED Published: 2025-10-09T21:02:08.404Z Last Updated: 2025-10-10T14:17:35.809Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: E-Commerce Website Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in code-projects E-Commerce Website 1.0. Impacted is an unknown function of the file /pages/user_index_search.php. Performing manipulation of the argument Search results in sql injection. The attack is possible to be carried out remotely. The exploit has been made public and could be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.327718 - https:/
d could be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.327718 - https://vuldb.com/?ctiid.327718 - https://vuldb.com/?submit.671451 - https://github.com/cxm947/CVE-repoort-251008 - https://code-projects.org/
CVE ID: CVE-2025-11560 State: PUBLISHED Published: 2025-11-12T06:00:09.098Z Last Updated: 2025-11-13T18:02:15.035Z Vendors: Unknown Products: Team Members Showcase Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Team Members Showcase WordPress plugin before 3.5.0 does not sanitize and escape a parameter before outputting it back in the page, leading to reflected cross-site scripting, which could be used against high-privilege users such as admins. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/64d7a074-3f1d-4b09-8e96-d76b9fb3c41e/
CVE ID: CVE-2025-11561 State: PUBLISHED Published: 2025-10-09T13:37:53.089Z Last Updated: 2025-11-20T07:59:17.140Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Red Hat Products: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7 Extended Lifecycle Support, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 8.2 Advanced Update Support, Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On, Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.6 Telecommunications Update Service, Red Hat Enterprise Linux 8.6 Update Services
te Support, Red Hat Enterprise Linux 8.6 Telecommunications Update Service, Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions, Red Hat Enterprise Linux 8.8 Telecommunications Update Service, Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions, Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions, Red Hat Enterprise Linux 9.4 Extended Update Support, Red Hat Enterprise Linux 9.6 Extended Update Support, Red Hat OpenShift Container Platform 4.14, Red Hat Enterprise Linux 6 Problem Types: CWE-269 Description: A flaw was found in the integration of Active Directory and th
at Enterprise Linux 6 Problem Types: CWE-269 Description: A flaw was found in the integration of Active Directory and the System Security Services Daemon (SSSD) on Linux systems. In default configurations, the Kerberos local authentication plugin (sssd_krb5_localauth_plugin) is enabled, but a fallback to the an2ln plugin is possible. This fallback allows an attacker with permission to modify certain AD attributes (such as userPrincipalName or samAccountName) to impersonate privileged users, potentially resulting in unauthorized access or privilege escalation on domain-joined Linux hosts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.redhat.com/errata/RHSA-20
d Linux hosts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.redhat.com/errata/RHSA-2025:19610 - https://access.redhat.com/errata/RHSA-2025:19847 - https://access.redhat.com/errata/RHSA-2025:19848 - https://access.redhat.com/errata/RHSA-2025:19849 - https://access.redhat.com/errata/RHSA-2025:19850 - https://access.redhat.com/errata/RHSA-2025:19851 - https://access.redhat.com/errata/RHSA-2025:19852 - https://access.redhat.com/errata/RHSA-2025:19853 - https://access.redhat.com/errata/RHSA-2025:19854 - https://access.redhat.com/errata/RHSA-2025:19859 - https://access.redhat.com/errata/RHSA-2025:20954 - https://access.redhat.com/errata/RHSA-2025:21020 - https://
5:19859 - https://access.redhat.com/errata/RHSA-2025:20954 - https://access.redhat.com/errata/RHSA-2025:21020 - https://access.redhat.com/errata/RHSA-2025:21067 - https://access.redhat.com/errata/RHSA-2025:21329 - https://access.redhat.com/security/cve/CVE-2025-11561 - https://blog.async.sg/kerberos-ldr - https://bugzilla.redhat.com/show_bug.cgi?id=2402727
CVE ID: CVE-2025-11564 State: PUBLISHED Published: 2025-10-25T05:31:19.940Z Last Updated: 2025-10-27T15:49:09.061Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: themeum Products: Tutor LMS – eLearning and online course solution Problem Types: CWE-862 Description: The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check while verifying webhook signatures on the "verifyAndCreateOrderData" function in all versions up to, and including, 3.8.3. This makes it possible for unauthenticated attackers to bypass payment verification and mark orders as paid by submitt
. This makes it possible for unauthenticated attackers to bypass payment verification and mark orders as paid by submitting forged webhook requests with `payment_type` set to 'recurring'. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/26289a93-063b-469a-9d09-c286d76fce0c?source=cve - https://plugins.trac.wordpress.org/browser/tutor/tags/3.8.3/ecommerce/PaymentGateways/Paypal/src/Payments/Paypal/Paypal.php#L323
CVE ID: CVE-2025-11565 State: PUBLISHED Published: 2025-11-12T13:19:55.722Z Last Updated: 2025-11-12T18:45:10.615Z Vendors: Schneider Electric Products: PowerChute™ Serial Shutdown Problem Types: CWE-22 Description: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could cause elevated system access when a Web Admin user on the local network tampers with the POST /REST/UpdateJRE request payload. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2025-315-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2025-315-01.pdf
CVE ID: CVE-2025-11566 State: PUBLISHED Published: 2025-11-12T13:26:14.702Z Last Updated: 2025-11-12T18:46:45.992Z Vendors: Schneider Electric Products: PowerChute™ Serial Shutdown Problem Types: CWE-307 Description: CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists that would allow an attacker on the local network to gain access to the user account by performing an arbitrary number of authentication attempts with different credentials on the /REST/shutdownnow endpoint. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2025-315-01&p_enDocType=Security+and+Safety+Notice&p_File_Nam
tps://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2025-315-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2025-315-01.pdf
CVE ID: CVE-2025-11567 State: PUBLISHED Published: 2025-11-12T13:27:56.004Z Last Updated: 2025-11-12T18:50:03.699Z Vendors: Schneider Electric Products: PowerChute™ Serial Shutdown Problem Types: CWE-276 Description: CWE-276: Incorrect Default Permissions vulnerability exists that could cause elevated system access when the target installation folder is not properly secured. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2025-315-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2025-315-01.pdf
CVE ID: CVE-2025-11568 State: PUBLISHED Published: 2025-10-15T19:37:11.924Z Last Updated: 2025-11-06T23:20:18.306Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N) Vendors: Red Hat Products: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 Problem Types: CWE-1284 Description: A data corruption vulnerability has been identified in the luksmeta utility when used with the LUKS1 disk encryption format. An attacker with the necessary permissions can exploit this flaw by writing a large amount of metadata to an encrypted device. The utility fails to correctly validate the
oit this flaw by writing a large amount of metadata to an encrypted device. The utility fails to correctly validate the available space, causing the metadata to overwrite and corrupt the user's encrypted data. This action leads to a permanent loss of the stored information. Devices using the LUKS formats other than LUKS1 are not affected by this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.redhat.com/security/cve/CVE-2025-11568 - https://bugzilla.redhat.com/show_bug.cgi?id=2404244
CVE ID: CVE-2025-11569 State: REJECTED Published: 2025-10-10T05:00:06.193Z Last Updated: 2025-10-30T15:59:03.463Z Description: No description available.
CVE ID: CVE-2025-11570 State: PUBLISHED Published: 2025-10-10T05:00:07.320Z Last Updated: 2025-10-10T18:19:52.002Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N/E:P) Vendors: n/a Products: drupal-pattern-lab/unified-twig-extensions Problem Types: CWE-79 Description: Versions of the package drupal-pattern-lab/unified-twig-extensions from 0.0.0 are vulnerable to Cross-site Scripting (XSS) due to insufficient filtering of data. **Note:** This is exploitable only if the code is executed outside of Drupal; the function is intended to be shared between Drupal and Pattern Lab. The package drupal-pattern-lab/unified-twig-extensions is unmaintained, the fix for this issue ex
rupal and Pattern Lab. The package drupal-pattern-lab/unified-twig-extensions is unmaintained, the fix for this issue exists in version 1.1.1 of [drupal/unified_twig_ext](https://www.drupal.org/project/unified_twig_ext) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.snyk.io/vuln/SNYK-PHP-DRUPALPATTERNLABUNIFIEDTWIGEXTENSIONS-8400877 - https://github.com/drupal-pattern-lab/unified-twig-extensions/blob/862b9deccab544ca68e3aaaccc257d14acc9b1f6/example/_twig-components/functions/link.function.php%23L9 - https://www.drupal.org/sa-contrib-2023-041