Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-11817 State: PUBLISHED Published: 2025-10-22T08:27:10.519Z Last Updated: 2025-10-22T14:17:10.513Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: garyhukkeri Products: Simple Tableau Viz Problem Types: CWE-79 Description: The Simple Tableau Viz plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tableau' shortcode in all versions up to, and including, 2.0. This is due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user acc
with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/dbd33d03-81ba-468e-9e25-fe9f13914dbd?source=cve - https://wordpress.org/plugins/simple-tableau-viz/ - https://plugins.trac.wordpress.org/browser/simple-tableau-viz/tags/2.0/simple-tableau-viz.php#L24
CVE ID: CVE-2025-11818 State: PUBLISHED Published: 2025-10-22T08:27:06.247Z Last Updated: 2025-10-22T15:04:02.277Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: vobi Products: WP Responsive Meet The Team Problem Types: CWE-79 Description: The WP Responsive Meet The Team plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wprm_team' shortcode in all versions up to, and including, 1.0.1. This is due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute when
ated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/30d79f14-b70c-403b-9e55-66e40b18aca7?source=cve - https://plugins.trac.wordpress.org/browser/wp-responsive-meet-the-team/tags/1.0.1/admin/layouts.php#L64 - https://wordpress.org/plugins/wp-responsive-meet-the-team/
CVE ID: CVE-2025-11819 State: PUBLISHED Published: 2025-10-22T08:27:09.340Z Last Updated: 2025-10-30T18:21:49.232Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: robocasters Products: WP-Thumbnail Problem Types: CWE-79 Description: The WP-Thumbnail plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'roboshot' shortcode in all versions up to, and including, 1.1. This is due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an in
ibutor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/9c641d50-51ac-47ca-beaf-3e79f436e091?source=cve - https://wordpress.org/plugins/wp-thumbnail/ - https://plugins.trac.wordpress.org/browser/wp-thumbnail/tags/1.1/wp-thumbnail.php#L67
CVE ID: CVE-2025-11820 State: PUBLISHED Published: 2025-11-05T09:27:38.778Z Last Updated: 2025-11-05T15:44:24.788Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: iqonicdesign Products: Graphina – Charts and Graphs For Elementor Problem Types: CWE-79 Description: The Graphina – Elementor Charts and Graphs plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple chart widgets in all versions up to, and including, 3.1.8 due to insufficient input sanitization and output escaping on data attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will
for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vulnerability affects multiple chart widgets including Area Chart, Line Chart, Column Chart, Donut Chart, Heatmap Chart, Radar Chart, Polar Chart, Pie Chart, Radial Chart, and Advance Data Table widgets. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/0a576c71-615c-4333-8cd3-93343ce64f7b?source=cve - https://plugins.trac.wordpress.org/browser/graphina-elementor-charts-and-graphs/trunk/assets/elementor/js/apex-chart/AdvanceDataTable.js - https://
ess.org/browser/graphina-elementor-charts-and-graphs/trunk/assets/elementor/js/apex-chart/AdvanceDataTable.js - https://plugins.trac.wordpress.org/browser/graphina-elementor-charts-and-graphs/trunk/assets/elementor/js/apex-chart/LineChart.js - https://plugins.trac.wordpress.org/browser/graphina-elementor-charts-and-graphs/trunk/assets/elementor/js/apex-chart/AreaChart.js - https://plugins.trac.wordpress.org/browser/graphina-elementor-charts-and-graphs/tags/3.1.7/assets/elementor/js/apex-chart/GraphinaApexChartBase.js#L303 - https://gist.github.com/webber-naut/3c26ce96cc18d3b8387edb8482653bc3
CVE ID: CVE-2025-11821 State: PUBLISHED Published: 2025-11-11T03:30:48.891Z Last Updated: 2025-11-14T15:30:25.045Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: elvismdev Products: Woocommerce – Products By Custom Tax Problem Types: CWE-79 Description: The Woocommerce – Products By Custom Tax plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'woo_products_custom_tax' shortcode in all versions up to, and including, 2.2. This is due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scri
his makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/cbc26607-a588-4059-9a37-afede7c9e3f6?source=cve - https://wordpress.org/plugins/woocommerce-products-by-custom-tax/ - https://plugins.trac.wordpress.org/browser/woocommerce-products-by-custom-tax/tags/2.2/public/class-woocommerce-products-by-custom-tax-public.php#L90
CVE ID: CVE-2025-11822 State: PUBLISHED Published: 2025-11-11T03:30:32.378Z Last Updated: 2025-11-12T20:09:18.929Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: virtus-designs Products: WP Bootstrap Tabs Problem Types: CWE-79 Description: The WP Bootstrap Tabs plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'bootstrap_tab' shortcode in all versions up to, and including, 1.0.4. This is due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a
ttackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/173305ee-9c89-4192-8ccf-227947b142d1?source=cve - https://wordpress.org/plugins/wp-bootstrap-tabs/ - https://plugins.trac.wordpress.org/browser/wp-bootstrap-tabs/tags/1.0.4/wp-bootstrap-tabs.php#L120
CVE ID: CVE-2025-11823 State: PUBLISHED Published: 2025-10-25T04:22:44.973Z Last Updated: 2025-10-27T15:57:18.537Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: devitemsllc Products: ShopLentor – WooCommerce Builder for Elementor & Gutenberg +21 Modules – All in One Solution (formerly WooLentor) Problem Types: CWE-80 Description: The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +21 Modules – All in One Solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'button_exist_text' parameter in the 'wishsuite_button' shortcode in all versions up to, and including, 3.2.4 due to insufficient input sanitization and output e
hsuite_button' shortcode in all versions up to, and including, 3.2.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/2d45afd4-9a1f-402c-86e3-8e3d6d7178d3?source=cve - https://plugins.trac.wordpress.org/browser/woolentor-addons/tags/3.2.2/includes/modules/wishlist/includes/templates/wishsuite-button-exist.php#L1 - https://plugins.trac.wordpress.org/browser/woolentor-ad
ules/wishlist/includes/templates/wishsuite-button-exist.php#L1 - https://plugins.trac.wordpress.org/browser/woolentor-addons/tags/3.2.2/includes/modules/wishlist/includes/classes/Frontend/Shortcode.php#L107
CVE ID: CVE-2025-11824 State: PUBLISHED Published: 2025-10-22T08:27:08.952Z Last Updated: 2025-10-22T13:20:46.426Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: madebycinza Products: Cinza Grid Problem Types: CWE-79 Description: The Cinza Grid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'cgrid_skin_content' post meta field in all versions up to, and including, 1.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional
above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/9acec3df-84d6-4cea-8756-64fbb468e5e0?source=cve - https://plugins.trac.wordpress.org/browser/cinza-grid/tags/1.2.1/includes/backend-shortcodes.php#L511 - https://plugins.trac.wordpress.org/browser/cinza-grid/tags/1.2.1/includes/backend-cpts.php#L733
CVE ID: CVE-2025-11825 State: PUBLISHED Published: 2025-10-22T08:27:12.219Z Last Updated: 2025-10-22T13:59:53.657Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: pedrolaxe Products: Playerzbr Problem Types: CWE-79 Description: The Playerzbr plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'urlmeta' post meta field in all versions up to, and including, 1.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: -
arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ff065219-7f4f-4445-8dbe-11f4975f7bb9?source=cve - https://plugins.trac.wordpress.org/browser/playerzbr/tags/1.6/playerzbr.php#L193 - https://plugins.trac.wordpress.org/browser/playerzbr/tags/1.6/playerzbr.php#L229
CVE ID: CVE-2025-11826 State: PUBLISHED Published: 2025-11-21T08:28:12.495Z Last Updated: 2025-11-21T14:55:53.541Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: bdeleasa Products: WP Company Info Problem Types: CWE-79 Description: The WP Company Info plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'class' attribute of the 'social-networks' shortcode in all versions up to, and including, 1.9.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an in
ibutor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/6743a762-6d40-4ed9-95f2-f1b405683f26?source=cve - https://plugins.trac.wordpress.org/browser/wp-company-info/tags/1.9.0/classes/class-wp-company-info-social-links.php#L244
CVE ID: CVE-2025-11827 State: PUBLISHED Published: 2025-10-22T08:27:05.034Z Last Updated: 2025-10-22T15:35:10.202Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: oboxgroup Products: Oboxmedia Ads Problem Types: CWE-79 Description: The Oboxmedia Ads plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'before_widget' and 'after_widget' parameters of the oboxads-ad-widget shortcode in all versions up to, and including, 1.9.8. This is due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will exec
uthenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/1d8b79cc-287e-420b-8eb8-6345a62e9fb9?source=cve - https://wordpress.org/plugins/oboxmedia-ads - https://plugins.trac.wordpress.org/browser/oboxmedia-ads/tags/1.9.8/includes/oboxads-ad-widget.php#L156
CVE ID: CVE-2025-11828 State: PUBLISHED Published: 2025-11-11T03:30:44.964Z Last Updated: 2025-11-14T15:30:44.205Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: pubudu-malalasekara Products: Magazine Companion Problem Types: CWE-79 Description: The Magazine Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'headerHtmlTag' attribute in the bnm-blocks/featured-posts-1 block in all versions up to, and including, 1.2.3. This is due to insufficient input sanitization and output escaping when using user-supplied values as HTML tag names. This makes it possible for authenticated attackers, with contributor-level access and above,
d values as HTML tag names. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/8fa2e98b-5054-46fd-b22e-eac59b581a3c?source=cve - https://wordpress.org/plugins/bnm-blocks - https://plugins.trac.wordpress.org/browser/bnm-blocks/tags/1.2.3/src/blocks/posts/featured-posts-1/view.php#L34
CVE ID: CVE-2025-11829 State: PUBLISHED Published: 2025-11-11T03:30:34.777Z Last Updated: 2025-11-12T20:08:41.451Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: five9 Products: Five9 Live Chat Problem Types: CWE-79 Description: The Five9 Live Chat plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'toolbar' attribute of the [five9-chat] shortcode in all versions up to, and including, 1.1.2. This is due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an
ntributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/28548108-a004-4aeb-a0ad-269a73a71331?source=cve - https://plugins.trac.wordpress.org/browser/five9/tags/1.1.2/includes/class-widget.php#L151
CVE ID: CVE-2025-11830 State: PUBLISHED Published: 2025-10-22T08:27:08.157Z Last Updated: 2025-10-22T13:21:55.380Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: wpdrift Products: WP Restaurant Listings Problem Types: CWE-79 Description: The WP Restaurant Listings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'align' parameter of the restaurant_summary shortcode in all versions up to, and including, 1.0.2. This is due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute wheneve
d attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/572b584e-b580-4d90-88b6-ee5b25678d9b?source=cve - https://plugins.trac.wordpress.org/browser/wp-restaurant-listings/tags/1.0.2/includes/class-wp-restaurant-listings-shortcodes.php#L511
CVE ID: CVE-2025-11832 State: PUBLISHED Published: 2025-10-15T19:10:33.929Z Last Updated: 2025-10-15T19:17:08.350Z Vendors: Azure Access Technology Products: BLU-IC2, BLU-IC4 Problem Types: CWE-770 Description: Allocation of Resources Without Limits or Throttling vulnerability in Azure Access Technology BLU-IC2, Azure Access Technology BLU-IC4 allows Flooding.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://azure-access.com/security-advisories
CVE ID: CVE-2025-11833 State: PUBLISHED Published: 2025-11-01T03:34:35.794Z Last Updated: 2025-11-03T15:47:23.380Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: saadiqbal Products: Post SMTP – Complete SMTP Solution with Logs, Alerts, Backup SMTP & Mobile App Problem Types: CWE-862 Description: The Post SMTP – Complete SMTP Solution with Logs, Alerts, Backup SMTP & Mobile App plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the __construct function in all versions up to, and including, 3.6.0. This makes it possible for unauthenticated attackers to read arbitrary logged emails sent through the Post SMT
g, 3.6.0. This makes it possible for unauthenticated attackers to read arbitrary logged emails sent through the Post SMTP plugin, including password reset emails containing password reset links, which can lead to account takeover. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/491f44fc-712c-4f67-b5c2-a7396941afc1?source=cve - https://plugins.trac.wordpress.org/browser/post-smtp/tags/3.5.0/Postman/PostmanEmailLogs.php#L51 - https://plugins.trac.wordpress.org/changeset/3386160/post-smtp
CVE ID: CVE-2025-11834 State: PUBLISHED Published: 2025-10-22T08:27:02.620Z Last Updated: 2025-10-22T13:25:15.996Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: wiellyam Products: WP AD Gallery Problem Types: CWE-79 Description: The WP AD Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'startindex' parameter of the ad-gallery shortcode in all versions up to, and including, 1.3. This is due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an i
ributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/0144ae03-00ce-481d-8d29-7a484f1f6cbf?source=cve - https://plugins.trac.wordpress.org/browser/wp-ad-gallery/tags/1.3/shortcode/shortcode.php#L177
CVE ID: CVE-2025-11835 State: PUBLISHED Published: 2025-11-05T03:27:57.526Z Last Updated: 2025-11-07T14:26:27.092Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: cozmoslabs Products: Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction Problem Types: CWE-862 Description: The Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability and validation check on the PMS_AJAX_Checkout_Handler::process_payment() function in all versions up to, and including, 2.16.4. This makes it possib
PMS_AJAX_Checkout_Handler::process_payment() function in all versions up to, and including, 2.16.4. This makes it possible for unauthenticated attackers to trigger stored auto-renew charges for arbitrary members. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/eb1948bd-c5b4-4fbe-9aa6-19f24325e6bb?source=cve - https://plugins.trac.wordpress.org/changeset/3383182/paid-member-subscriptions
CVE ID: CVE-2025-11839 State: PUBLISHED Published: 2025-10-16T14:02:13.689Z Last Updated: 2025-10-16T14:15:03.591Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R) Vendors: GNU Products: Binutils Problem Types: CWE-252, CWE-253 Description: A security flaw has been discovered in GNU Binutils 2.45. Impacted is the function tg_tag_type of the file prdbg.c. Performing manipulation results in unchecked return value. The attack needs to be approached locally. The exploit has been released to the public and may be exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.328774 - https://vuldb.com/?ctiid.328774 - https://vu
otes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.328774 - https://vuldb.com/?ctiid.328774 - https://vuldb.com/?submit.661279 - https://sourceware.org/bugzilla/show_bug.cgi?id=33448 - https://sourceware.org/bugzilla/attachment.cgi?id=16344 - https://www.gnu.org/
CVE ID: CVE-2025-11840 State: PUBLISHED Published: 2025-10-16T15:32:11.651Z Last Updated: 2025-10-16T18:12:26.436Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C) Vendors: GNU Products: Binutils Problem Types: CWE-125, CWE-119 Description: A weakness has been identified in GNU Binutils 2.45. The affected element is the function vfinfo of the file ldmisc.c. Executing manipulation can lead to out-of-bounds read. The attack can only be executed locally. The exploit has been made available to the public and could be exploited. This patch is called 16357. It is best practice to apply a patch to resolve this issue. Additional Analyst Notes: - CISA ADP Vulnrichme
alled 16357. It is best practice to apply a patch to resolve this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.328775 - https://vuldb.com/?ctiid.328775 - https://vuldb.com/?submit.661281 - https://sourceware.org/bugzilla/show_bug.cgi?id=33455 - https://sourceware.org/bugzilla/attachment.cgi?id=16351 - https://sourceware.org/bugzilla/attachment.cgi?id=16357 - https://www.gnu.org/