Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-3744 State: PUBLISHED Published: 2025-05-13T18:40:08.281Z Last Updated: 2025-05-13T19:21:33.581Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L) Vendors: HashiCorp Products: Nomad Enterprise Problem Types: CWE-266 Description: Nomad Enterprise (“Nomad”) jobs using the policy override option are bypassing the mandatory sentinel policies. This vulnerability, identified as CVE-2025-3744, is fixed in Nomad Enterprise 1.10.1, 1.9.9, and 1.8.13. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://discuss.hashicorp.com/t/hcsec-2025-08-nomad-enterprise-vulnerable-to-violation-of-mandatory-sentinel-policies-in-job-submissions-via-policy-ove
/hcsec-2025-08-nomad-enterprise-vulnerable-to-violation-of-mandatory-sentinel-policies-in-job-submissions-via-policy-override/74935
CVE ID: CVE-2025-3745 State: PUBLISHED Published: 2025-06-30T06:00:01.235Z Last Updated: 2025-06-30T18:52:02.699Z Vendors: Unknown Products: WP Lightbox 2 Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The WP Lightbox 2 WordPress plugin before 3.0.6.8 does not correctly sanitize the value of the title attribute of links before using them, which may allow malicious users to conduct XSS attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/1b50f686-c2e0-4963-95c8-b27137dcc059/
CVE ID: CVE-2025-3746 State: PUBLISHED Published: 2025-05-02T01:43:35.422Z Last Updated: 2025-05-12T15:53:02.851Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: thedrifted Products: OTP-less one tap Sign in Problem Types: CWE-862 Description: The OTP-less one tap Sign in plugin for WordPress is vulnerable to privilege escalation via account takeover in versions 2.0.14 to 2.0.59. This is due to the plugin not properly validating a user's identity prior to updating their details, like email. This makes it possible for unauthenticated attackers to change arbitrary users' email addresses, including administrators, and leverage that to reset the user's passwor
kers to change arbitrary users' email addresses, including administrators, and leverage that to reset the user's password and gain access to their account. Additionally, the plugin returns authentication cookies in the response, which can be used to access the account directly. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/63fab608-1a75-4b07-8d82-8ab87e197547?source=cve - https://plugins.trac.wordpress.org/browser/otpless/tags/2.0.59./includes/class-login.php
CVE ID: CVE-2025-3748 State: PUBLISHED Published: 2025-05-02T03:21:17.556Z Last Updated: 2025-05-02T14:59:31.059Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: realmag777 Products: Taxonomy Chain Menu Problem Types: CWE-79 Description: The Taxonomy Chain Menu plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's pn_chain_menu shortcode in all versions up to, and including, 1.0.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a us
ckers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/25afc28c-2814-4b49-add5-1d0ce5ff3a07?source=cve - https://plugins.trac.wordpress.org/browser/taxonomy-chain-menu/trunk/index.php#L190 - https://wordpress.org/plugins/taxonomy-chain-menu/#developers - https://plugins.trac.wordpress.org/changeset/3284354/
CVE ID: CVE-2025-3749 State: PUBLISHED Published: 2025-04-24T22:22:13.994Z Last Updated: 2025-04-25T19:25:31.349Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: mgyura Products: Breeze Display Problem Types: CWE-79 Description: The Breeze Display plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘cal_size’ parameter in all versions up to, and including, 1.2.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes
ect arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/527dd2c7-5bbb-4c79-aa3c-7d70ddd26163?source=cve - https://plugins.trac.wordpress.org/browser/wt-display-breeze/trunk/includes/shortcodes.php#L114 - https://wordpress.org/plugins/wt-display-breeze/#developers - https://plugins.trac.wordpress.org/changeset/3280146/
CVE ID: CVE-2025-3750 State: PUBLISHED Published: 2025-05-21T09:21:51.056Z Last Updated: 2025-05-21T10:16:59.816Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: johnzenausa Products: Network Posts Extended Problem Types: CWE-79 Description: The Network Posts Extended plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘post_height’ parameter in all versions up to, and including, 7.7.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/64a15397-0bd6-4be9-90e3-6cb1f56394ad?source=cve - https://plugins.trac.wordpress.org/browser/network-posts-extended/trunk/network-posts-extended.php#L663 - https://wordpress.org/plugins/network-posts-extended/#developers
CVE ID: CVE-2025-3751 State: PUBLISHED Published: 2025-05-21T18:12:59.133Z Last Updated: 2025-05-21T19:47:52.175Z Vendors: TIBCO Software Inc Products: TIBCO ActiveMatrix BusinessWorks Problem Types: CWE-89 Description: The component listed above contains a vulnerability that can be exploited by an attacker to perform a SQL Injection attack. This could lead to unauthorised access to the database and exposure of sensitive information Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://community.tibco.com/advisories/tibco-security-advisory-may-13-2025-tibco-activematrix-businessworks-cve-2025-3751-r221/
CVE ID: CVE-2025-3752 State: PUBLISHED Published: 2025-04-25T04:23:05.578Z Last Updated: 2025-04-25T19:24:58.156Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: terrillthompson Products: Able Player, accessible HTML5 media player Problem Types: CWE-79 Description: The Able Player, accessible HTML5 media player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘preload’ parameter in all versions up to, and including, 1.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whe
cated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/85c123ee-8de0-4800-b96b-68bb4d763560?source=cve - https://plugins.trac.wordpress.org/browser/ableplayer/trunk/ableplayer.php#L375 - https://wordpress.org/plugins/ableplayer/#developers - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3281106%40ableplayer&new=3281106%40ableplayer
CVE ID: CVE-2025-3753 State: PUBLISHED Published: 2025-07-17T19:14:20.486Z Last Updated: 2025-07-18T08:05:27.171Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Open Source Robotics Foundation Products: Robot Operating System (ROS) Problem Types: CWE-95, CWE-94 Description: A code execution vulnerability has been identified in the Robot Operating System (ROS) 'rosbag' tool, affecting ROS distributions Noetic Ninjemys and earlier. The vulnerability arises from the use of the eval() function to process unsanitized, user-supplied input in the 'rosbag filter' command. This flaw enables attackers to craft and execute arbitrary Python code. Additional Analyst Notes
rosbag filter' command. This flaw enables attackers to craft and execute arbitrary Python code. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ros.org/blog/noetic-eol/
CVE ID: CVE-2025-3755 State: PUBLISHED Published: 2025-05-29T04:47:52.187Z Last Updated: 2025-08-27T08:02:37.808Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H) Vendors: Mitsubishi Electric Corporation Products: MELSEC iQ-F Series FX5U-32MT/ES, MELSEC iQ-F Series FX5U-32MT/DS, MELSEC iQ-F Series FX5U-32MT/ESS, MELSEC iQ-F Series FX5U-32MT/DSS, MELSEC iQ-F Series FX5U-32MR/ES, MELSEC iQ-F Series FX5U-32MR/DS, MELSEC iQ-F Series FX5U-64MT/ES, MELSEC iQ-F Series FX5U-64MT/DS, MELSEC iQ-F Series FX5U-64MT/ESS, MELSEC iQ-F Series FX5U-64MT/DSS, MELSEC iQ-F Series FX5U-64MR/ES, MELSEC iQ-F Series FX5U-64MR/DS, MELSEC iQ-F Series FX5U-80MT/ES, MELSEC iQ-F Series FX5U-80M
iQ-F Series FX5U-64MR/ES, MELSEC iQ-F Series FX5U-64MR/DS, MELSEC iQ-F Series FX5U-80MT/ES, MELSEC iQ-F Series FX5U-80MT/DS, MELSEC iQ-F Series FX5U-80MT/ESS, MELSEC iQ-F Series FX5U-80MT/DSS, MELSEC iQ-F Series FX5U-80MR/ES, MELSEC iQ-F Series FX5U-80MR/DS, MELSEC iQ-F Series FX5UC-32MT/D, MELSEC iQ-F Series FX5UC-32MT/DSS, MELSEC iQ-F Series FX5UC-64MT/D, MELSEC iQ-F Series FX5UC-64MT/DSS, MELSEC iQ-F Series FX5UC-96MT/D, MELSEC iQ-F Series FX5UC-96MT/DSS, MELSEC iQ-F Series FX5UC-32MT/DS-TS, MELSEC iQ-F Series FX5UC-32MT/DSS-TS, MELSEC iQ-F Series FX5UC-32MR/DS-TS, MELSEC iQ-F Series FX5UJ-24MT/ES, MELSEC iQ-F Series FX5UJ-24MT/DS, MELSEC iQ-F Series FX5UJ-24MT/ESS, MELSEC iQ-F Series FX
EC iQ-F Series FX5UJ-24MT/ES, MELSEC iQ-F Series FX5UJ-24MT/DS, MELSEC iQ-F Series FX5UJ-24MT/ESS, MELSEC iQ-F Series FX5UJ-24MT/DSS, MELSEC iQ-F Series FX5UJ-24MR/ES, MELSEC iQ-F Series FX5UJ-24MR/DS, MELSEC iQ-F Series FX5UJ-40MT/ES, MELSEC iQ-F Series FX5UJ-40MT/DS, MELSEC iQ-F Series FX5UJ-40MT/ESS, MELSEC iQ-F Series FX5UJ-40MT/DSS, MELSEC iQ-F Series FX5UJ-40MR/ES, MELSEC iQ-F Series FX5UJ-40MR/DS, MELSEC iQ-F Series FX5UJ-60MT/ES, MELSEC iQ-F Series FX5UJ-60MT/DS, MELSEC iQ-F Series FX5UJ-60MT/ESS, MELSEC iQ-F Series FX5UJ-60MT/DSS, MELSEC iQ-F Series FX5UJ-60MR/ES, MELSEC iQ-F Series FX5UJ-60MR/DS, MELSEC iQ-F Series FX5UJ-24MT/ES-A, MELSEC iQ-F Series FX5UJ-24MR/ES-A, MELSEC iQ-F Se
MELSEC iQ-F Series FX5UJ-60MR/DS, MELSEC iQ-F Series FX5UJ-24MT/ES-A, MELSEC iQ-F Series FX5UJ-24MR/ES-A, MELSEC iQ-F Series FX5UJ-40MT/ES-A, MELSEC iQ-F Series FX5UJ-40MR/ES-A, MELSEC iQ-F Series FX5UJ-60MT/ES-A, MELSEC iQ-F Series FX5UJ-60MR/ES-A, MELSEC iQ-F Series FX5S-30MT/ES, MELSEC iQ-F Series FX5S-30MT/ESS, MELSEC iQ-F Series FX5S-30MR/ES, MELSEC iQ-F Series FX5S-40MT/ES, MELSEC iQ-F Series FX5S-40MT/ESS, MELSEC iQ-F Series FX5S-40MR/ES, MELSEC iQ-F Series FX5S-60MT/ES, MELSEC iQ-F Series FX5S-60MT/ESS, MELSEC iQ-F Series FX5S-60MR/ES, MELSEC iQ-F Series FX5S-80MT/ES, MELSEC iQ-F Series FX5S-80MT/ESS, MELSEC iQ-F Series FX5S-80MR/ES, MELSEC iQ-F Series FX5S-30MT/DS, MELSEC iQ-F Serie
S, MELSEC iQ-F Series FX5S-80MT/ESS, MELSEC iQ-F Series FX5S-80MR/ES, MELSEC iQ-F Series FX5S-30MT/DS, MELSEC iQ-F Series FX5S-30MT/DSS, MELSEC iQ-F Series FX5S-30MR/DS, MELSEC iQ-F Series FX5S-40MT/DS, MELSEC iQ-F Series FX5S-40MT/DSS, MELSEC iQ-F Series FX5S-40MR/DS, MELSEC iQ-F Series FX5S-60MT/DS, MELSEC iQ-F Series FX5S-60MT/DSS, MELSEC iQ-F Series FX5S-60MR/DS, MELSEC iQ-F Series FX5S-80MT/DS, MELSEC iQ-F Series FX5S-80MT/DSS, MELSEC iQ-F Series FX5S-80MR/DS Problem Types: CWE-1285 Description: Improper Validation of Specified Index, Position, or Offset in Input vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F Series CPU modules allows a remote unauthenticated attacker to r
rability in Mitsubishi Electric Corporation MELSEC iQ-F Series CPU modules allows a remote unauthenticated attacker to read information in the product, to cause a Denial-of-Service (DoS) condition in MELSOFT connection, or to stop the operation of the CPU module (causing a DoS condtion on the CPU module), by sending specially crafted packets. The product is needed to reset for recovery. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2025-003_en.pdf - https://jvn.jp/vu/JVNVU94070048/ - https://www.cisa.gov/news-events/ics-advisories/icsa-25-153-03
CVE ID: CVE-2025-3757 State: PUBLISHED Published: 2025-05-13T16:33:18.074Z Last Updated: 2025-05-13T20:12:58.087Z Vendors: OPKSSH Products: OPKSSH Problem Types: CWE-305 Description: Versions of OpenPubkey library prior to 0.10.0 contained a vulnerability that would allow a specially crafted JWS to bypass signature verification. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/openpubkey/openpubkey
CVE ID: CVE-2025-3758 State: PUBLISHED Published: 2025-05-08T10:05:00.716Z Last Updated: 2025-10-03T08:57:29.206Z Vendors: Netis Systems Products: WF2220 Problem Types: CWE-306, CWE-256 Description: WF2220 exposes endpoint /cgi-bin-igd/netcore_get.cgi that returns configuration of the device to unauthorized users. Returned configuration includes cleartext password. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert.pl/posts/2025/05/CVE-2025-3758 - https://cert.pl/en/posts/2025/05/CVE-2025-3758
CVE ID: CVE-2025-3759 State: PUBLISHED Published: 2025-05-08T10:05:07.131Z Last Updated: 2025-05-08T13:40:38.421Z Vendors: Netis Systems Products: WF2220 Problem Types: CWE-306 Description: Endpoint /cgi-bin-igd/netcore_set.cgi which is used for changing device configuration is accessible without authentication. This poses a significant security threat allowing for e.g: administrator account hijacking or AP password changing. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert.pl/posts/2025/05/CVE-2025-3758 - https://cert.pl/en/posts/2025/05/CVE-2025-3758
CVE ID: CVE-2025-3760 State: PUBLISHED Published: 2025-04-17T12:53:19.981Z Last Updated: 2025-09-04T15:27:05.788Z Vendors: Liferay Products: Portal, DXP Problem Types: CWE-79 Description: A stored cross-site scripting (XSS) vulnerability exists with radio button type custom fields in Liferay Portal 7.2.0 through 7.4.3.129, and Liferay DXP 2024.Q4.1 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.9, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, 7.3 GA through update 36, and 7.2 GA through fix pack 20 allows remote authenticated attackers to inject malicious JavaScript into a page. Additional Analy
A through fix pack 20 allows remote authenticated attackers to inject malicious JavaScript into a page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-3760
CVE ID: CVE-2025-3761 State: PUBLISHED Published: 2025-04-24T06:57:06.438Z Last Updated: 2025-04-24T13:06:47.777Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: joedolson Products: My Tickets – Accessible Event Ticketing Problem Types: CWE-269 Description: The My Tickets – Accessible Event Ticketing plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.0.16. This is due to the mt_save_profile() function not appropriately restricting access to unauthorized users to update roles. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update their role to that of an administrato
ble for authenticated attackers, with Subscriber-level access and above, to update their role to that of an administrator. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/6d875c23-3d8a-4f82-bea3-1c46b5045d94?source=cve - https://plugins.trac.wordpress.org/changeset/3280248/my-tickets/trunk/my-tickets.php
CVE ID: CVE-2025-3762 State: PUBLISHED Published: 2025-04-17T18:31:04.442Z Last Updated: 2025-04-18T20:36:41.481Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: PCMan Products: FTP Server Problem Types: CWE-120, CWE-119 Description: A vulnerability was found in PCMan FTP Server 2.0.7. It has been rated as critical. Affected by this issue is some unknown functionality of the component MPUT Command Handler. The manipulation leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.305396 - https://vuldb.com/?ctiid.305396 - https
yst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.305396 - https://vuldb.com/?ctiid.305396 - https://vuldb.com/?submit.553567 - https://fitoxs.com/exploit/exploit-8d31b9e55c1c3d8f2cbf62e3e218f50b.txt
CVE ID: CVE-2025-3763 State: PUBLISHED Published: 2025-04-17T18:31:07.035Z Last Updated: 2025-04-18T20:33:29.970Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: SourceCodester Products: Phone Management System Problem Types: CWE-120, CWE-119 Description: A vulnerability classified as critical has been found in SourceCodester Phone Management System 1.0. This affects the function main of the component Password Handler. The manipulation of the argument s leads to buffer overflow. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https
has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.305397 - https://vuldb.com/?ctiid.305397 - https://vuldb.com/?submit.553650 - https://github.com/eeeee-vul/CVE/issues/4 - https://www.sourcecodester.com/
CVE ID: CVE-2025-3764 State: PUBLISHED Published: 2025-04-17T19:31:04.968Z Last Updated: 2025-04-17T19:49:55.511Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Web-based Pharmacy Product Management System Problem Types: CWE-434, CWE-284 Description: A vulnerability classified as critical was found in SourceCodester Web-based Pharmacy Product Management System 1.0. This vulnerability affects unknown code of the file /edit-product.php. The manipulation of the argument Avatar leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: R
tely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.305398 - https://vuldb.com/?ctiid.305398 - https://vuldb.com/?submit.553721 - https://github.com/yaklang/IRifyScanResult/blob/main/Web-based%20Pharmacy%20Product%20Management%20System/upload_in_edit-product.md - https://www.sourcecodester.com/
CVE ID: CVE-2025-3765 State: PUBLISHED Published: 2025-04-17T19:31:07.368Z Last Updated: 2025-04-17T19:42:17.226Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Web-based Pharmacy Product Management System Problem Types: CWE-434, CWE-284 Description: A vulnerability, which was classified as critical, has been found in SourceCodester Web-based Pharmacy Product Management System 1.0. This issue affects some unknown processing of the file /edit-photo.php. The manipulation of the argument Avatar leads to unrestricted upload. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA A
be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.305399 - https://vuldb.com/?ctiid.305399 - https://vuldb.com/?submit.553722 - https://github.com/yaklang/IRifyScanResult/blob/main/Web-based%20Pharmacy%20Product%20Management%20System/upload_in_edit-photo.md - https://www.sourcecodester.com/
CVE ID: CVE-2025-3766 State: PUBLISHED Published: 2025-05-07T04:22:54.046Z Last Updated: 2025-05-07T13:20:26.527Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: webfactory Products: Login Lockdown & Protection Problem Types: CWE-862 Description: The Login Lockdown & Protection plugin for WordPress is vulnerable to unauthorized nonce access due to a missing capability check on the ajax_run_tool function in all versions up to, and including, 2.11. This makes it possible for authenticated attackers, with Subscriber-level access and above, to obtain a valid nonce that can be used to generate a global unlock key, which can in turn be used to add arbitrary IP add
obtain a valid nonce that can be used to generate a global unlock key, which can in turn be used to add arbitrary IP address to the plugin allowlist. This can only by exploited on new installations where the site administrator hasn't visited the loginlockdown page yet. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ac9a3848-f486-475b-b2c7-ea1007bb30d3?source=cve - https://plugins.trac.wordpress.org/browser/login-lockdown/trunk/libs/ajax.php#L17 - https://plugins.trac.wordpress.org/changeset/3286814/login-lockdown
CVE ID: CVE-2025-3767 State: PUBLISHED Published: 2025-04-22T15:16:24.312Z Last Updated: 2025-04-22T16:09:54.998Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Centreon Products: Centreon BAM Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Centreon BAM (Boolean KPi Listing modules) allows SQL Injection. This page is only accessible to authenticated users with high privileges. This issue affects Centreon BAM: from 24.10 before 24.10.1, from 24.04 before 24.04.5, from 23.10 before 23.10.10, from 23.04 before 23.04.10. Additional Analyst Notes: - CISA ADP Vulnrichment: Refe
24.04.5, from 23.10 before 23.10.10, from 23.04 before 23.04.10. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://thewatch.centreon.com/latest-security-bulletins-64/cve-2024-46924-cve-2025-3767-centreon-bam-high-severity-4459 - https://github.com/centreon/centreon/releases
CVE ID: CVE-2025-3768 State: PUBLISHED Published: 2025-06-05T13:36:41.991Z Last Updated: 2025-06-05T14:09:18.593Z Vendors: Devolutions Products: Server Problem Types: CWE-284 Description: Improper access control in Tor network blocking feature in Devolutions Server 2025.1.10.0 and earlier allows an authenticated user to bypass the tor blocking feature when the Devolutions hosted endpoint is not reachable. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://devolutions.net/security/advisories/DEVO-2025-0011/