Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
? __pfx_kthread+0x10/0x1 0 [ 16.461166] ret_from_fork_asm+0x1a/0x3 0 [ 16.461453] </TASK > [ 16.461616] Modules linked in: bpf_testmod(OE) [last unloaded: bpf_testmod(OE) ] [ 16.462134] CR2: 000000000000003 0 [ 16.462380] ---[ end trace 0000000000000000 ]--- [ 16.462710] RIP: 0010:smc_listen_work+0xc02/0x1590 The direct cause of this issue is that after smc_listen_out_connected(), newclcsock->sk may be NULL since it will releases the smcsk. Therefore, if the application closes the socket immediately after accept, newclcsock->sk can be NULL. A possible execution order could be as follows: smc_listen_work | userspace ----------------------------------------------------------------- lock_sock(
be as follows: smc_listen_work | userspace ----------------------------------------------------------------- lock_sock(sk) | smc_listen_out_connected() | | \- smc_listen_out | | | \- release_sock | | |- sk->sk_data_ready() | | fd = accept(); | close(fd); | \- socket->sk = NULL; /* newclcsock->sk is NULL now */ SMC_STAT_SERV_SUCC_INC(sock_net(newclcsock->sk)) Since smc_listen_out_connected() will not fail, simply swapping the order of the code can easily fix this issue. References: - https://git.kernel.org/stable/c/070b4af44c4b6e4c35fb1ca7001a6a88fd2d318f - https://git.kernel.org/stable/c/2e765ba0ee0eae35688b443e97108308a716773e - https://git.kernel.org/stable/c/85545f1525f9fa9bf44fec77ba011
el.org/stable/c/2e765ba0ee0eae35688b443e97108308a716773e - https://git.kernel.org/stable/c/85545f1525f9fa9bf44fec77ba011024f15da342 - https://git.kernel.org/stable/c/d9cef55ed49117bd63695446fb84b4b91815c0b4
CVE ID: CVE-2025-38735 State: PUBLISHED Published: 2025-09-05T17:20:35.459Z Last Updated: 2025-11-03T17:42:05.176Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: gve: prevent ethtool ops after shutdown A crash can occur if an ethtool operation is invoked after shutdown() is called. shutdown() is invoked during system shutdown to stop DMA operations without performing expensive deallocations. It is discouraged to unregister the netdev in this path, so the device may still be visible to userspace and kernel helpers. In gve, shutdown() tears down most internal data structures. If an ethtool operation is dispatched after shutdown()
ers. In gve, shutdown() tears down most internal data structures. If an ethtool operation is dispatched after shutdown(), it will dereference freed or NULL pointers, leading to a kernel panic. While graceful shutdown normally quiesces userspace before invoking the reboot syscall, forced shutdowns (as observed on GCP VMs) can still trigger this path. Fix by calling netif_device_detach() in shutdown(). This marks the device as detached so the ethtool ioctl handler will skip dispatching operations to the driver. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/48a4e89d50e8ea52e800bc7865970b92fcf4647c - https://git.kernel.org/stable/c/ba51d73408edf
https://git.kernel.org/stable/c/48a4e89d50e8ea52e800bc7865970b92fcf4647c - https://git.kernel.org/stable/c/ba51d73408edf815cbaeab148625576c2dd90192 - https://git.kernel.org/stable/c/a7efffeecb881b4649fdc30de020ef910f35d646 - https://git.kernel.org/stable/c/9d8a41e9a4ff83ff666de811e7f012167cdc00e9 - https://git.kernel.org/stable/c/75a9a46d67f46d608205888f9b34e315c1786345
CVE ID: CVE-2025-38736 State: PUBLISHED Published: 2025-09-05T17:20:36.546Z Last Updated: 2025-11-03T17:42:06.126Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: net: usb: asix_devices: Fix PHY address mask in MDIO bus initialization Syzbot reported shift-out-of-bounds exception on MDIO bus initialization. The PHY address should be masked to 5 bits (0-31). Without this mask, invalid PHY addresses could be used, potentially causing issues with MDIO bus operations. Fix this by masking the PHY address with 0x1f (31 decimal) to ensure it stays within the valid range. Additional Analyst Notes: - CVE Program Container: References: -
31 decimal) to ensure it stays within the valid range. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/fcb4ce9f729c1d08e53abf9d449340e24c3edee6 - https://git.kernel.org/stable/c/8f141f2a4f2ef8ca865d5921574c3d6535e00a49 - https://git.kernel.org/stable/c/748da80831221ae24b4bc8d7ffb22acd5712a341 - https://git.kernel.org/stable/c/22042ffedd8c2c6db08ccdd6d4273068eddd3c5c - https://git.kernel.org/stable/c/523eab02fce458fa6d3c51de5bb055800986953e - https://git.kernel.org/stable/c/24ef2f53c07f273bad99173e27ee88d44d135b1c
CVE ID: CVE-2025-38737 State: PUBLISHED Published: 2025-09-05T17:20:37.719Z Last Updated: 2025-09-29T05:57:06.934Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: cifs: Fix oops due to uninitialised variable Fix smb3_init_transform_rq() to initialise buffer to NULL before calling netfs_alloc_folioq_buffer() as netfs assumes it can append to the buffer it is given. Setting it to NULL means it should start a fresh buffer, but the value is currently undefined. References: - https://git.kernel.org/stable/c/4931fe2dbe1cc0e7d350a4b51b0b330e43971d98 - https://git.kernel.org/stable/c/6adaa9fae36f848afa7278945d725e197e33c496 - https://gi
be1cc0e7d350a4b51b0b330e43971d98 - https://git.kernel.org/stable/c/6adaa9fae36f848afa7278945d725e197e33c496 - https://git.kernel.org/stable/c/453a6d2a68e54a483d67233c6e1e24c4095ee4be
CVE ID: CVE-2025-38738 State: PUBLISHED Published: 2025-08-14T14:36:41.268Z Last Updated: 2025-08-15T03:55:59.518Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: Dell Products: SupportAssist for Home PCs Problem Types: CWE-266 Description: SupportAssist for Home PCs Installer exe version(s) 4.8.2.29006 and prior, contain(s) an Incorrect Privilege Assignment vulnerability in the Installer. A low privileged attacker with local access could potentially exploit this vulnerability, leading to elevation of privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000356690/dsa-2025-296-security-update-fo
CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000356690/dsa-2025-296-security-update-for-dell-supportassist-for-home-pcs-and-dell-supportassist-for-business-pcs-vulnerabilities
CVE ID: CVE-2025-38739 State: PUBLISHED Published: 2025-08-04T15:53:55.880Z Last Updated: 2025-08-04T16:50:20.705Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:L) Vendors: Dell Products: Dell Digital Delivery Problem Types: CWE-522 Description: Dell Digital Delivery, versions prior to 5.6.1.0, contains an Insufficiently Protected Credentials vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to Information Disclosure. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000349489/dsa-2025-302
CVE ID: CVE-2025-38741 State: PUBLISHED Published: 2025-08-04T18:22:00.580Z Last Updated: 2025-08-05T15:47:36.772Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Dell Products: Enterprise SONiC OS Problem Types: CWE-321 Description: Dell Enterprise SONiC OS, version 4.5.0, contains a cryptographic key vulnerability in SSH. An unauthenticated remote attacker could potentially exploit this vulnerability, leading to unauthorized access to communication. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000340083/dsa-2025-275-security-update-for-dell-enterprise-sonic-distribution-vulnerabilities
CVE ID: CVE-2025-38742 State: PUBLISHED Published: 2025-08-21T18:42:34.146Z Last Updated: 2025-08-22T03:55:50.524Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: Dell Products: iDRAC Service Module (iSM) Problem Types: CWE-732 Description: Dell iDRAC Service Module (iSM), versions prior to 6.0.3.0, contains an Incorrect Permission Assignment for Critical Resource vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000359617/dsa-2025-311-security-update-for-dell-idrac-service
nt: References: - https://www.dell.com/support/kbdoc/en-us/000359617/dsa-2025-311-security-update-for-dell-idrac-service-module-vulnerabilities
CVE ID: CVE-2025-38743 State: PUBLISHED Published: 2025-08-21T18:46:41.317Z Last Updated: 2025-08-22T03:55:45.858Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Dell Products: iDRAC Service Module (iSM) Problem Types: CWE-805 Description: Dell iDRAC Service Module (iSM), versions prior to 6.0.3.0, contains a Buffer Access with Incorrect Length Value vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Code execution and Elevation of privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000359617/dsa-2025-311-security-update-for-dell-
DP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000359617/dsa-2025-311-security-update-for-dell-idrac-service-module-vulnerabilities
CVE ID: CVE-2025-38745 State: PUBLISHED Published: 2025-08-14T14:29:37.815Z Last Updated: 2025-08-14T14:44:46.092Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N) Vendors: Dell Products: OpenManage Enterprise Problem Types: CWE-532 Description: Dell OpenManage Enterprise, versions 3.10, 4.0, 4.1, and 4.2, contains an Insertion of Sensitive Information into Log File vulnerability in the Backup and Restore. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information exposure. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000356351/dsa-2025-314-security-upda
es: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000356351/dsa-2025-314-security-update-for-dell-openmanage-enterprise-vulnerability
CVE ID: CVE-2025-38746 State: PUBLISHED Published: 2025-08-06T19:53:05.549Z Last Updated: 2025-08-06T19:59:14.486Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: Dell Products: SupportAssist OS Recovery Problem Types: CWE-200 Description: Dell SupportAssist OS Recovery, versions prior to 5.5.14.0, contains an Exposure of Sensitive Information to an Unauthorized Actor vulnerability. An unauthenticated attacker with physical access could potentially exploit this vulnerability, leading to Information Disclosure. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000353093/dsa-2025-315
CVE ID: CVE-2025-38747 State: PUBLISHED Published: 2025-08-06T19:48:46.676Z Last Updated: 2025-08-07T03:55:28.134Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Dell Products: SupportAssist OS Recovery Problem Types: CWE-378 Description: Dell SupportAssist OS Recovery, versions prior to 5.5.14.0, contain a Creation of Temporary File With Insecure Permissions vulnerability. A local authenticated attacker could potentially exploit this vulnerability, leading to Elevation of Privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000353093/dsa-2025-315
CVE ID: CVE-2025-39201 State: PUBLISHED Published: 2025-06-24T11:46:11.548Z Last Updated: 2025-06-25T12:42:30.293Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H) Vendors: Hitachi Energy Products: MicroSCADA X SYS600 Problem Types: CWE-276 Description: A vulnerability exists in MicroSCADA X SYS600 product. If exploited this could allow a local unauthenticated attacker to tamper a system file, making denial of Notify service. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://publisher.hitachienergy.com/preview?DocumentID=8DBD000218&LanguageCode=en&DocumentPartId=&Action=Launch
CVE ID: CVE-2025-39202 State: PUBLISHED Published: 2025-06-24T11:51:58.576Z Last Updated: 2025-06-25T12:42:25.143Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H) Vendors: Hitachi Energy Products: MicroSCADA X SYS600 Problem Types: CWE-269 Description: A vulnerability exists in in the Monitor Pro interface of the MicroSCADA X SYS600 product. An authenticated user with low privileges can see and overwrite files causing information leak and data corruption. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://publisher.hitachienergy.com/preview?DocumentID=8DBD000218&LanguageCode=en&DocumentPartId=&Action=Launch
CVE ID: CVE-2025-39203 State: PUBLISHED Published: 2025-06-24T11:57:04.229Z Last Updated: 2025-10-07T10:00:29.745Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: Hitachi Energy Products: MicroSCADA X SYS600 Problem Types: CWE-354 Description: A vulnerability exists in the IEC 61850 of the MicroSCADA X SYS600 product. An IEC 61850-8 crafted message content from IED or remote system can cause a denial of service resulting in disconnection loop. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://publisher.hitachienergy.com/preview?DocumentID=8DBD000218&LanguageCode=en&DocumentPartId=&Action=Launch
CVE ID: CVE-2025-39204 State: PUBLISHED Published: 2025-06-24T12:01:09.855Z Last Updated: 2025-06-25T12:42:14.761Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Hitachi Energy Products: MicroSCADA X SYS600 Problem Types: CWE-200 Description: A vulnerability exists in the Web interface of the MicroSCADA X SYS600 product. The filtering query in the Web interface can be malformed, so returning data can leak unauthorized information to the user. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://publisher.hitachienergy.com/preview?DocumentID=8DBD000218&LanguageCode=en&DocumentPartId=&Action=Launch
CVE ID: CVE-2025-39205 State: PUBLISHED Published: 2025-06-24T12:13:20.791Z Last Updated: 2025-10-01T14:58:20.730Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Hitachi Energy Products: MicroSCADA X SYS600 Problem Types: CWE-295 Description: A vulnerability exists in the IEC 61850 in MicroSCADA X SYS600 product. The certificate validation of the TLS protocol allows remote Man-in-the-Middle attack due to missing proper validation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://publisher.hitachienergy.com/preview?DocumentID=8DBD000218&LanguageCode=en&DocumentPartId=&Action=Launch
CVE ID: CVE-2025-39240 State: PUBLISHED Published: 2025-06-13T07:10:39.734Z Last Updated: 2025-06-17T17:24:32.221Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Hikvision Products: DS-3WAP622G-SI, DS-3WAP623E-SI, DS-3WAP521-SI, DS-3WAP522-SI, DS-3WAP621E-SI, DS-3WAP622E-SI Description: Some Hikvision Wireless Access Point are vulnerable to authenticated remote command execution due to insufficient input validation. Attackers with valid credentials can exploit this flaw by sending crafted packets containing malicious commands to affected devices, leading to arbitrary command execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://w
ices, leading to arbitrary command execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.hikvision.com/en/support/cybersecurity/security-advisory/remote-command-execution-vulnerability-in-some-hikvision-wireless-access-point/
CVE ID: CVE-2025-39245 State: PUBLISHED Published: 2025-08-29T01:38:46.917Z Last Updated: 2025-08-29T13:33:42.304Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:L) Vendors: Hikvision Products: HikCentral Master Lite Description: There is a CSV Injection Vulnerability in some HikCentral Master Lite versions. This could allow an attacker to inject executable commands via malicious CSV data. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.hikvision.com/en/support/cybersecurity/security-advisory/security-vulnerabilities-in-some-hikcentral-products/
CVE ID: CVE-2025-39246 State: PUBLISHED Published: 2025-08-29T01:39:53.653Z Last Updated: 2025-08-29T13:32:53.476Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: Hikvision Products: HikCentral FocSign Description: There is an Unquoted Service Path Vulnerability in some HikCentral FocSign versions. This could allow an authenticated user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.hikvision.com/en/support/cybersecurity/security-advisory/security-vulnerabilities-in-some-hikcentral-products/
CVE ID: CVE-2025-39247 State: PUBLISHED Published: 2025-08-29T01:40:31.553Z Last Updated: 2025-08-29T13:32:18.140Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) Vendors: Hikvision Products: HikCentral Professional Description: There is an Access Control Vulnerability in some HikCentral Professional versions. This could allow an unauthenticated user to obtain the admin permission. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.hikvision.com/en/support/cybersecurity/security-advisory/security-vulnerabilities-in-some-hikcentral-products/
CVE ID: CVE-2025-39348 State: PUBLISHED Published: 2025-05-19T19:52:27.046Z Last Updated: 2025-05-19T21:19:17.752Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: ThemeGoods Products: Grand Restaurant WordPress Problem Types: CWE-502 Description: Deserialization of Untrusted Data vulnerability in ThemeGoods Grand Restaurant WordPress allows Object Injection.This issue affects Grand Restaurant WordPress: from n/a through 7.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/theme/grandrestaurant/vulnerability/wordpress-grand-restaurant-wordpress-theme-7-0-php-object-injection-vulnerability?_s_id=cve
CVE ID: CVE-2025-39349 State: PUBLISHED Published: 2025-05-19T19:51:03.916Z Last Updated: 2025-05-19T21:19:26.172Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Potenzaglobalsolutions Products: CiyaShop Problem Types: CWE-502 Description: Deserialization of Untrusted Data vulnerability in Potenzaglobalsolutions CiyaShop allows Object Injection.This issue affects CiyaShop: from n/a through 4.18.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/theme/ciyashop/vulnerability/wordpress-ciyashop-theme-4-18-0-php-object-injection-vulnerability?_s_id=cve
CVE ID: CVE-2025-39350 State: PUBLISHED Published: 2025-05-19T19:50:15.064Z Last Updated: 2025-05-19T21:19:31.963Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H) Vendors: Rocket Apps Products: wProject Problem Types: CWE-862 Description: Missing Authorization vulnerability in Rocket Apps wProject.This issue affects wProject: from n/a before 5.8.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/theme/wproject/vulnerability/wordpress-wproject-theme-5-8-0-unauthenticated-post-comment-attachment-modification-deletion-vulnerability?_s_id=cve
CVE ID: CVE-2025-39351 State: PUBLISHED Published: 2025-05-19T16:30:03.073Z Last Updated: 2025-05-19T16:58:12.779Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: ThemeGoods Products: Grand Restaurant WordPress Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in ThemeGoods Grand Restaurant WordPress allows Cross Site Request Forgery.This issue affects Grand Restaurant WordPress: from n/a through 7.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/theme/grandrestaurant/vulnerability/wordpress-grand-restaurant-wordpress-theme-7-0-cross-site-request-forgery-csrf-vulne
theme/grandrestaurant/vulnerability/wordpress-grand-restaurant-wordpress-theme-7-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2025-39352 State: PUBLISHED Published: 2025-05-19T19:49:17.818Z Last Updated: 2025-05-19T21:19:40.246Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H) Vendors: ThemeGoods Products: Grand Restaurant WordPress Problem Types: CWE-862 Description: Missing Authorization vulnerability in ThemeGoods Grand Restaurant WordPress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Grand Restaurant WordPress: from n/a through 7.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/theme/grandrestaurant/vulnerability/wordpress-grand-restaurant-wordpress-theme-7-0-arbitrary-opt
.com/database/wordpress/theme/grandrestaurant/vulnerability/wordpress-grand-restaurant-wordpress-theme-7-0-arbitrary-options-deletion-vulnerability?_s_id=cve
CVE ID: CVE-2025-39353 State: PUBLISHED Published: 2025-05-19T16:30:53.171Z Last Updated: 2025-05-19T16:57:56.898Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: ThemeGoods Products: Grand Restaurant WordPress Problem Types: CWE-862 Description: Missing Authorization vulnerability in ThemeGoods Grand Restaurant WordPress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Grand Restaurant WordPress: from n/a through 7.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/theme/grandrestaurant/vulnerability/wordpress-grand-restaurant-wordpress-theme-7-0-broken-acce
ck.com/database/wordpress/theme/grandrestaurant/vulnerability/wordpress-grand-restaurant-wordpress-theme-7-0-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-39354 State: PUBLISHED Published: 2025-05-19T19:48:09.530Z Last Updated: 2025-05-19T21:19:46.638Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: ThemeGoods Products: Grand Conference Problem Types: CWE-502 Description: Deserialization of Untrusted Data vulnerability in ThemeGoods Grand Conference allows Object Injection.This issue affects Grand Conference: from n/a through 5.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/grandconference/vulnerability/wordpress-grand-conference-theme-5-2-php-object-injection-vulnerability?_s_id=cve
CVE ID: CVE-2025-39355 State: PUBLISHED Published: 2025-05-19T19:46:07.807Z Last Updated: 2025-05-19T21:19:55.131Z Severity: HIGH (CVSS 8.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L) Vendors: roninwp Products: FAT Services Booking Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in roninwp FAT Services Booking allows SQL Injection.This issue affects FAT Services Booking: from n/a through 5.6. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/fat-services-booking/vulnerability/wordpress-fat-services-booking-plugin-5-6-sql-injection-vulnerabili
/wordpress/plugin/fat-services-booking/vulnerability/wordpress-fat-services-booking-plugin-5-6-sql-injection-vulnerability?_s_id=cve
CVE ID: CVE-2025-39356 State: PUBLISHED Published: 2025-05-19T19:45:18.969Z Last Updated: 2025-05-19T21:20:01.084Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Chimpstudio Products: Foodbakery Sticky Cart Problem Types: CWE-502 Description: Deserialization of Untrusted Data vulnerability in Chimpstudio Foodbakery Sticky Cart allows Object Injection.This issue affects Foodbakery Sticky Cart: from n/a through 3.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/foodbakery-sticky-cart/vulnerability/wordpress-foodbakery-sticky-cart-plugin-3-2-php-object-injection-vulnerability?_s_id=cve