Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-49211 State: PUBLISHED Published: 2025-06-17T20:16:38.307Z Last Updated: 2025-06-20T13:12:22.833Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:H) Vendors: Trend Micro, Inc. Products: Trend Micro Endpoint Encryption Policy Server Problem Types: CWE-89 Description: A SQL injection vulnerability in the Trend Micro Endpoint Encryption PolicyServer could allow an attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system to exploit this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://success.trendmicro.com/en-US/
is vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://success.trendmicro.com/en-US/solution/KA-0019928 - https://www.zerodayinitiative.com/advisories/ZDI-25-368/
CVE ID: CVE-2025-49212 State: PUBLISHED Published: 2025-06-17T20:27:37.318Z Last Updated: 2025-06-18T14:57:32.331Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Trend Micro, Inc. Products: Trend Micro Endpoint Encryption Policy Server Problem Types: CWE-477 Description: An insecure deserialization operation in the Trend Micro Endpoint Encryption PolicyServer could lead to a pre-authentication remote code execution on affected installations. Note that this vulnerability is similar to CVE-2025-49220 but is in a different method. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://success.trendmicro.com/en-US/solution/KA-0019928 - https
l Analyst Notes: - CISA ADP Vulnrichment: References: - https://success.trendmicro.com/en-US/solution/KA-0019928 - https://www.zerodayinitiative.com/advisories/ZDI-25-369/
CVE ID: CVE-2025-49213 State: PUBLISHED Published: 2025-06-17T20:27:44.731Z Last Updated: 2025-06-18T14:42:21.550Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Trend Micro, Inc. Products: Trend Micro Endpoint Encryption Policy Server Problem Types: CWE-477 Description: An insecure deserialization operation in the Trend Micro Endpoint Encryption PolicyServer could lead to a pre-authentication remote code execution on affected installations. Note that this vulnerability is similar to CVE-2025-49212 but is in a different method. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://success.trendmicro.com/en-US/solution/KA-0019928 - https
l Analyst Notes: - CISA ADP Vulnrichment: References: - https://success.trendmicro.com/en-US/solution/KA-0019928 - https://www.zerodayinitiative.com/advisories/ZDI-25-370/
CVE ID: CVE-2025-49214 State: PUBLISHED Published: 2025-06-17T20:27:52.986Z Last Updated: 2025-06-18T14:16:36.955Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Trend Micro, Inc. Products: Trend Micro Endpoint Encryption Policy Server Problem Types: CWE-477 Description: An insecure deserialization operation in the Trend Micro Endpoint Encryption PolicyServer could lead to a post-authentication remote code execution on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system to exploit this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://success.t
system to exploit this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://success.trendmicro.com/en-US/solution/KA-0019928 - https://www.zerodayinitiative.com/advisories/ZDI-25-371/
CVE ID: CVE-2025-49215 State: PUBLISHED Published: 2025-06-17T20:28:00.564Z Last Updated: 2025-06-18T14:11:36.236Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Trend Micro, Inc. Products: Trend Micro Endpoint Encryption Policy Server Problem Types: CWE-242 Description: A post-auth SQL injection vulnerability in the Trend Micro Endpoint Encryption PolicyServer could allow an attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system to exploit this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://success.trendmicro
exploit this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://success.trendmicro.com/en-US/solution/KA-0019928 - https://www.zerodayinitiative.com/advisories/ZDI-25-372/
CVE ID: CVE-2025-49216 State: PUBLISHED Published: 2025-06-17T20:28:07.764Z Last Updated: 2025-06-18T14:05:54.493Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Trend Micro, Inc. Products: Trend Micro Endpoint Encryption Policy Server Problem Types: CWE-477 Description: An authentication bypass vulnerability in the Trend Micro Endpoint Encryption PolicyServer could allow an attacker to access key methods as an admin user and modify product configurations on affected installations. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://success.trendmicro.com/en-US/solution/KA-0019928 - https://www.zerodayinitiative.com/advisories/ZDI-25-
ences: - https://success.trendmicro.com/en-US/solution/KA-0019928 - https://www.zerodayinitiative.com/advisories/ZDI-25-373/
CVE ID: CVE-2025-49217 State: PUBLISHED Published: 2025-06-17T20:28:14.897Z Last Updated: 2025-06-18T15:53:47.899Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Trend Micro, Inc. Products: Trend Micro Endpoint Encryption Policy Server Problem Types: CWE-477 Description: An insecure deserialization operation in the Trend Micro Endpoint Encryption PolicyServer could lead to a pre-authentication remote code execution on affected installations. Note that this vulnerability is similar to CVE-2025-49213 but is in a different method. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://success.trendmicro.com/en-US/solution/KA-0019928 - https
l Analyst Notes: - CISA ADP Vulnrichment: References: - https://success.trendmicro.com/en-US/solution/KA-0019928 - https://www.zerodayinitiative.com/advisories/ZDI-25-374/
CVE ID: CVE-2025-49218 State: PUBLISHED Published: 2025-06-17T20:28:22.211Z Last Updated: 2025-06-18T03:56:12.865Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:H) Vendors: Trend Micro, Inc. Products: Trend Micro Endpoint Encryption Policy Server Problem Types: CWE-89 Description: A post-auth SQL injection vulnerability in the Trend Micro Endpoint Encryption PolicyServer could allow an attacker to escalate privileges on affected installations. This is similar to, but not identical to CVE-2025-49215. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system to exploit this vulnerability. Additional Analyst Notes: - CISA AD
y to execute low-privileged code on the target system to exploit this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://success.trendmicro.com/en-US/solution/KA-0019928 - https://www.zerodayinitiative.com/advisories/ZDI-25-375/
CVE ID: CVE-2025-49219 State: PUBLISHED Published: 2025-06-17T17:43:12.062Z Last Updated: 2025-06-18T03:56:06.490Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Trend Micro, Inc. Products: Trend Micro Apex Central Problem Types: CWE-477 Description: An insecure deserialization operation in Trend Micro Apex Central below versions 8.0.7007 could lead to a pre-authentication remote code execution on affected installations. Note that this vulnerability is similar to CVE-2025-49220 but is in a different method. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://success.trendmicro.com/en-US/solution/KA-0019926 - https://www.zerodayinitiat
SA ADP Vulnrichment: References: - https://success.trendmicro.com/en-US/solution/KA-0019926 - https://www.zerodayinitiative.com/advisories/ZDI-25-366/
CVE ID: CVE-2025-49220 State: PUBLISHED Published: 2025-06-17T17:43:23.501Z Last Updated: 2025-06-18T03:56:05.373Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Trend Micro, Inc. Products: Trend Micro Apex Central Problem Types: CWE-477 Description: An insecure deserialization operation in Trend Micro Apex Central below version 8.0.7007 could lead to a pre-authentication remote code execution on affected installations. Note that this vulnerability is similar to CVE-2025-49219 but is in a different method. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://success.trendmicro.com/en-US/solution/KA-0019926 - https://www.zerodayinitiati
A ADP Vulnrichment: References: - https://success.trendmicro.com/en-US/solution/KA-0019926 - https://www.zerodayinitiative.com/advisories/ZDI-25-367/
CVE ID: CVE-2025-49221 State: PUBLISHED Published: 2025-08-11T18:56:59.876Z Last Updated: 2025-08-11T19:35:51.769Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Mattermost Products: Mattermost Confluence Plugin Problem Types: CWE-862 Description: Mattermost Confluence Plugin version <1.5.0 fails to enforce authentication of the user to the Mattermost instance which allows unauthenticated attackers to access subscription details without via API call to GET subscription endpoint. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://mattermost.com/security-updates
CVE ID: CVE-2025-49222 State: PUBLISHED Published: 2025-08-21T07:59:45.057Z Last Updated: 2025-08-21T13:57:13.759Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N) Vendors: Mattermost Products: Mattermost Problem Types: CWE-434 Description: Mattermost versions 10.8.x <= 10.8.3, 10.5.x <= 10.5.8, 9.11.x <= 9.11.17, 10.9.x <= 10.9.2, 10.10.x <= 10.10.0 fail to validate upload types in remote cluster upload sessions which allows a system admin to upload non-attachment file types via shared channels that could potentially be placed in arbitrary filesystem directories. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://mattermost.com/security-updates
CVE ID: CVE-2025-49223 State: PUBLISHED Published: 2025-06-04T02:00:15.719Z Last Updated: 2025-06-04T13:33:44.239Z Vendors: NAVER Products: billboard.js Problem Types: CWE-1321 Description: billboard.js before 3.15.1 was discovered to contain a prototype pollution via the function generate, which could allow attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cve.naver.com/detail/cve-2025-49223.html
CVE ID: CVE-2025-49234 State: PUBLISHED Published: 2025-06-17T15:01:30.665Z Last Updated: 2025-06-17T18:38:02.881Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: Deepak anand Products: WP Dummy Content Generator Problem Types: CWE-862 Description: Missing Authorization vulnerability in Deepak anand WP Dummy Content Generator allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WP Dummy Content Generator: from n/a through 3.4.6. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wp-dummy-content-generator/vulnerability/wordpress-wp-dummy-content-generator-pl
atchstack.com/database/wordpress/plugin/wp-dummy-content-generator/vulnerability/wordpress-wp-dummy-content-generator-plugin-3-4-6-arbitrary-user-deletion-vulnerability?_s_id=cve
CVE ID: CVE-2025-49235 State: PUBLISHED Published: 2025-06-06T12:53:31.801Z Last Updated: 2025-06-06T16:07:32.049Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Rometheme Products: RTMKit Addons for Elementor Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rometheme RTMKit Addons for Elementor allows Stored XSS. This issue affects RTMKit Addons for Elementor: from n/a through 1.6.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/rometheme-for-elementor/vulnerability/wordpress-rtmkit-addons-for-elementor
s://patchstack.com/database/wordpress/plugin/rometheme-for-elementor/vulnerability/wordpress-rtmkit-addons-for-elementor-plugin-1-6-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-49236 State: PUBLISHED Published: 2025-06-06T12:53:32.500Z Last Updated: 2025-06-06T16:07:26.166Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: raychat Products: Raychat Problem Types: CWE-862 Description: Missing Authorization vulnerability in raychat Raychat allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Raychat: from n/a through 2.1.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/raychat/vulnerability/wordpress-raychat-2-1-0-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-49237 State: PUBLISHED Published: 2025-06-06T12:53:32.991Z Last Updated: 2025-06-06T16:07:20.642Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:H) Vendors: POEditor Products: POEditor Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in POEditor POEditor allows Path Traversal. This issue affects POEditor: from n/a through 0.9.10. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/poeditor/vulnerability/wordpress-poeditor-plugin-0-9-10-csrf-to-arbitrary-file-deletion-vulnerability?_s_id=cve
CVE ID: CVE-2025-49238 State: PUBLISHED Published: 2025-06-06T12:53:33.458Z Last Updated: 2025-06-06T16:07:13.414Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: everestthemes Products: Everest Backup Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in everestthemes Everest Backup allows Cross Site Request Forgery. This issue affects Everest Backup: from n/a through 2.3.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/everest-backup/vulnerability/wordpress-everest-backup-2-3-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2025-49239 State: PUBLISHED Published: 2025-06-06T12:53:33.930Z Last Updated: 2025-06-06T16:07:07.204Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: tychesoftwares Products: Print Invoice & Delivery Notes for WooCommerce Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in tychesoftwares Print Invoice & Delivery Notes for WooCommerce allows Cross Site Request Forgery. This issue affects Print Invoice & Delivery Notes for WooCommerce: from n/a through 5.5.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/woocommerce-delivery-notes/vulnerability/w
Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/woocommerce-delivery-notes/vulnerability/wordpress-print-invoice-delivery-notes-for-woocommerce-5-5-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2025-49240 State: PUBLISHED Published: 2025-06-06T12:53:34.419Z Last Updated: 2025-06-06T16:06:59.371Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: nK Products: DocsPress Problem Types: CWE-862 Description: Missing Authorization vulnerability in nK DocsPress allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects DocsPress: from n/a through 2.5.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/docspress/vulnerability/wordpress-docspress-2-5-2-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-49241 State: PUBLISHED Published: 2025-06-06T12:53:34.877Z Last Updated: 2025-06-06T16:06:53.301Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: bobbingwide Products: oik Problem Types: CWE-862 Description: Missing Authorization vulnerability in bobbingwide oik allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects oik: from n/a through 4.15.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/oik/vulnerability/wordpress-oik-4-15-1-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-49242 State: PUBLISHED Published: 2025-06-06T12:53:35.336Z Last Updated: 2025-06-06T16:06:47.867Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: sevenspark Products: Bellows Accordion Menu Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sevenspark Bellows Accordion Menu allows Stored XSS. This issue affects Bellows Accordion Menu: from n/a through 1.4.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/bellows-accordion-menu/vulnerability/wordpress-bellows-accordion-menu-1-4-3-cross-site-s
k.com/database/wordpress/plugin/bellows-accordion-menu/vulnerability/wordpress-bellows-accordion-menu-1-4-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-49243 State: PUBLISHED Published: 2025-06-06T12:53:35.789Z Last Updated: 2025-06-06T16:06:42.046Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: sevenspark Products: ShiftNav – Responsive Mobile Menu Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sevenspark ShiftNav – Responsive Mobile Menu allows Stored XSS. This issue affects ShiftNav – Responsive Mobile Menu: from n/a through 1.8. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/shiftnav-responsive-mobile-menu/vulnerability/wordpress-s
References: - https://patchstack.com/database/wordpress/plugin/shiftnav-responsive-mobile-menu/vulnerability/wordpress-shiftnav-responsive-mobile-menu-1-8-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-49244 State: PUBLISHED Published: 2025-06-06T12:53:36.275Z Last Updated: 2025-06-06T16:06:35.283Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Vova Products: Shortcodes Ultimate Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vova Shortcodes Ultimate allows Stored XSS. This issue affects Shortcodes Ultimate: from n/a through 7.3.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/shortcodes-ultimate/vulnerability/wordpress-shortcodes-ultimate-7-3-5-cross-site-scripting-xss-vulnerability?
ess/plugin/shortcodes-ultimate/vulnerability/wordpress-shortcodes-ultimate-7-3-5-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-49245 State: PUBLISHED Published: 2025-07-04T11:18:02.470Z Last Updated: 2025-07-07T14:59:44.242Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: cmoreira Products: Testimonials Showcase Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in cmoreira Testimonials Showcase allows Reflected XSS. This issue affects Testimonials Showcase: from n/a through 1.9.16. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/testimonials-showcase/vulnerability/wordpress-testimonials-showcase-plugin-1-9-16-reflected-c
/database/wordpress/plugin/testimonials-showcase/vulnerability/wordpress-testimonials-showcase-plugin-1-9-16-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-49246 State: PUBLISHED Published: 2025-06-06T12:53:36.737Z Last Updated: 2025-06-06T16:06:29.483Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: cmoreira Products: Testimonials Showcase Problem Types: CWE-862 Description: Missing Authorization vulnerability in cmoreira Testimonials Showcase allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Testimonials Showcase: from n/a through 1.9.16. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/testimonials-showcase/vulnerability/wordpress-testimonials-showcase-1-9-16-broken-access-control-vulne
/wordpress/plugin/testimonials-showcase/vulnerability/wordpress-testimonials-showcase-1-9-16-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-49247 State: PUBLISHED Published: 2025-07-04T11:18:01.892Z Last Updated: 2025-07-07T14:59:50.740Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: cmoreira Products: Team Showcase Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in cmoreira Team Showcase allows DOM-Based XSS. This issue affects Team Showcase: from n/a through n/a. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/team-showcase-cm/vulnerability/wordpress-team-showcase-plugin-25-05-13-reflected-cross-site-scripting-xss-vulnerability?
team-showcase-cm/vulnerability/wordpress-team-showcase-plugin-25-05-13-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-49248 State: PUBLISHED Published: 2025-06-06T12:53:37.200Z Last Updated: 2025-06-06T16:06:22.088Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: cmoreira Products: Team Showcase Problem Types: CWE-862 Description: Missing Authorization vulnerability in cmoreira Team Showcase allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Team Showcase: from n/a through n/a. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/team-showcase-cm/vulnerability/wordpress-team-showcase-25-05-13-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-49250 State: PUBLISHED Published: 2025-06-06T12:53:37.649Z Last Updated: 2025-06-06T16:06:13.048Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: cmoreira Products: Team Showcase Problem Types: CWE-94 Description: Improper Control of Generation of Code ('Code Injection') vulnerability in cmoreira Team Showcase allows Code Injection. This issue affects Team Showcase: from n/a through n/a. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/team-showcase-cm/vulnerability/wordpress-team-showcase-plugin-25-05-13-arbitrary-shortcode-execution-vulnerability?_s_id=cve
CVE ID: CVE-2025-49251 State: PUBLISHED Published: 2025-06-17T15:01:30.203Z Last Updated: 2025-06-17T18:38:10.458Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: thembay Products: Fana Problem Types: CWE-98 Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Fana allows PHP Local File Inclusion. This issue affects Fana: from n/a through 1.1.28. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/theme/fana/vulnerability/wordpress-fana-1-1-28-local-file-inclusion-vulnerability?_s_id=cve
CVE ID: CVE-2025-49252 State: PUBLISHED Published: 2025-06-17T15:01:29.742Z Last Updated: 2025-06-17T18:38:16.467Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: thembay Products: Besa Problem Types: CWE-98 Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Besa allows PHP Local File Inclusion. This issue affects Besa: from n/a through 2.3.8. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/theme/besa/vulnerability/wordpress-besa-2-3-8-local-file-inclusion-vulnerability?_s_id=cve