Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-53572 State: PUBLISHED Published: 2025-08-28T12:37:29.520Z Last Updated: 2025-08-28T14:04:14.785Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: emarket-design Products: WP Easy Contact Problem Types: CWE-502 Description: Deserialization of Untrusted Data vulnerability in emarket-design WP Easy Contact allows Object Injection. This issue affects WP Easy Contact: from n/a through 4.0.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wp-easy-contact/vulnerability/wordpress-wp-easy-contact-plugin-4-0-1-php-object-injection-vulnerability?_s_id=cve
CVE ID: CVE-2025-53573 State: PUBLISHED Published: 2025-11-06T15:54:10.426Z Last Updated: 2025-11-13T10:33:42.429Z Vendors: jegtheme Products: Epic Review Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in jegtheme Epic Review epic-review allows Reflected XSS.This issue affects Epic Review: from n/a through <= 1.0.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/epic-review/vulnerability/wordpress-epic-review-plugin-1-0-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-53574 State: PUBLISHED Published: 2025-11-06T15:54:11.607Z Last Updated: 2025-11-13T10:33:42.482Z Vendors: ptibogxiv Products: Doliconnect Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ptibogxiv Doliconnect doliconnect allows Reflected XSS.This issue affects Doliconnect: from n/a through <= 9.3.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/doliconnect/vulnerability/wordpress-doliconnect-plugin-9-3-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-53575 State: PUBLISHED Published: 2025-08-14T18:21:53.588Z Last Updated: 2025-08-14T20:02:56.593Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: primersoftware Products: Primer MyData for Woocommerce Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in primersoftware Primer MyData for Woocommerce allows Reflected XSS. This issue affects Primer MyData for Woocommerce: from n/a through 4.2.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/primer-mydata/vulnerability/wordpress-primer-mydata-for-wo
eferences: - https://patchstack.com/database/wordpress/plugin/primer-mydata/vulnerability/wordpress-primer-mydata-for-woocommerce-plugin-plugin-4-2-5-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2025-53576 State: PUBLISHED Published: 2025-08-28T12:37:30.232Z Last Updated: 2025-08-28T18:36:29.222Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: ovatheme Products: Ovatheme Events Problem Types: CWE-98 Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ovatheme Ovatheme Events allows PHP Local File Inclusion. This issue affects Ovatheme Events: from n/a through 1.2.8. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/ova-events/vulnerability/wordpress-ovatheme-events-plugin-1-2-8-local-file-inclusi
chstack.com/database/wordpress/plugin/ova-events/vulnerability/wordpress-ovatheme-events-plugin-1-2-8-local-file-inclusion-vulnerability?_s_id=cve
CVE ID: CVE-2025-53577 State: PUBLISHED Published: 2025-08-20T08:03:10.517Z Last Updated: 2025-08-20T14:24:32.412Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: thehp Products: Global DNS Problem Types: CWE-94 Description: Improper Control of Generation of Code ('Code Injection') vulnerability in thehp Global DNS allows Remote Code Inclusion. This issue affects Global DNS: from n/a through 3.1.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/global-dns/vulnerability/wordpress-global-dns-plugin-3-1-0-remote-code-execution-rce-vulnerability?_s_id=cve
CVE ID: CVE-2025-53578 State: PUBLISHED Published: 2025-08-28T12:37:30.841Z Last Updated: 2025-08-28T14:19:26.136Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: gavias Products: Kipso Problem Types: CWE-98 Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in gavias Kipso allows PHP Local File Inclusion. This issue affects Kipso: from n/a through 1.3.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/theme/kipso/vulnerability/wordpress-kipso-theme-1-3-4-local-file-inclusion-vulnerability?_s_id=cve
CVE ID: CVE-2025-53579 State: PUBLISHED Published: 2025-08-28T12:37:31.389Z Last Updated: 2025-08-28T14:19:19.367Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: captcha.eu Products: Captcha.eu Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in captcha.eu Captcha.eu allows Reflected XSS. This issue affects Captcha.eu: from n/a through n/a. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/captcha-eu/vulnerability/wordpress-captcha-eu-plugin-1-0-61-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-53580 State: PUBLISHED Published: 2025-08-20T08:03:09.920Z Last Updated: 2025-08-20T14:30:50.364Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: quantumcloud Products: Simple Business Directory Pro Problem Types: CWE-266 Description: Incorrect Privilege Assignment vulnerability in quantumcloud Simple Business Directory Pro allows Privilege Escalation. This issue affects Simple Business Directory Pro: from n/a through n/a. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/simple-business-directory-pro/vulnerability/wordpress-simple-business-directory-pro-plugin-15-6-9-privileg
dpress/plugin/simple-business-directory-pro/vulnerability/wordpress-simple-business-directory-pro-plugin-15-6-9-privilege-escalation-vulnerability?_s_id=cve
CVE ID: CVE-2025-53581 State: PUBLISHED Published: 2025-08-14T18:21:53.038Z Last Updated: 2025-08-14T20:02:29.904Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: artiosmedia Products: RSS Feed Pro Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in artiosmedia RSS Feed Pro allows Stored XSS. This issue affects RSS Feed Pro: from n/a through 1.1.8. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/rss-feed-pro/vulnerability/wordpress-rss-feed-pro-plugin-plugin-1-1-8-cross-site-scripting-xss-vulnerability?_s_id=c
gin/rss-feed-pro/vulnerability/wordpress-rss-feed-pro-plugin-plugin-1-1-8-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-53582 State: PUBLISHED Published: 2025-08-14T18:21:52.363Z Last Updated: 2025-08-14T20:01:55.403Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: WordLift Products: WordLift Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WordLift WordLift allows Stored XSS. This issue affects WordLift: from n/a through 3.54.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wordlift/vulnerability/wordpress-wordlift-plugin-plugin-3-54-5-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-53583 State: PUBLISHED Published: 2025-08-28T12:37:32.036Z Last Updated: 2025-08-28T14:19:11.606Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: emarket-design Products: Employee Spotlight Problem Types: CWE-502 Description: Deserialization of Untrusted Data vulnerability in emarket-design Employee Spotlight allows Object Injection. This issue affects Employee Spotlight: from n/a through 5.1.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/employee-spotlight/vulnerability/wordpress-employee-spotlight-plugin-5-1-1-php-object-injection-vulnerability?_s_id=cve
CVE ID: CVE-2025-53584 State: PUBLISHED Published: 2025-08-28T12:37:32.675Z Last Updated: 2025-08-28T14:19:04.842Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: emarket-design Products: WP Ticket Customer Service Software & Support Ticket System Problem Types: CWE-502 Description: Deserialization of Untrusted Data vulnerability in emarket-design WP Ticket Customer Service Software & Support Ticket System allows Object Injection. This issue affects WP Ticket Customer Service Software & Support Ticket System: from n/a through 6.0.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wp-ticket/vulne
l Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wp-ticket/vulnerability/wordpress-wp-ticket-customer-service-software-support-ticket-system-plugin-6-0-2-php-object-injection-vulnerability?_s_id=cve
CVE ID: CVE-2025-53585 State: PUBLISHED Published: 2025-11-06T15:54:12.787Z Last Updated: 2025-11-13T10:33:42.568Z Vendors: NooTheme Products: WeMusic Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NooTheme WeMusic noo-wemusic allows Reflected XSS.This issue affects WeMusic: from n/a through <= 1.9.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Theme/noo-wemusic/vulnerability/wordpress-wemusic-theme-1-9-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-53586 State: PUBLISHED Published: 2025-11-06T15:54:13.387Z Last Updated: 2025-11-13T10:33:42.588Z Vendors: NooTheme Products: WeMusic Problem Types: CWE-502 Description: Deserialization of Untrusted Data vulnerability in NooTheme WeMusic noo-wemusic allows Object Injection.This issue affects WeMusic: from n/a through <= 1.9.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Theme/noo-wemusic/vulnerability/wordpress-wemusic-theme-1-9-1-php-object-injection-vulnerability?_s_id=cve
CVE ID: CVE-2025-53587 State: PUBLISHED Published: 2025-08-14T18:21:51.256Z Last Updated: 2025-08-14T20:01:28.731Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: ApusTheme Products: Findgo Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in ApusTheme Findgo allows Cross Site Request Forgery. This issue affects Findgo: from n/a through 1.3.57. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/theme/findgo/vulnerability/wordpress-findgo-theme-theme-1-3-57-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2025-53588 State: PUBLISHED Published: 2025-08-28T12:37:33.246Z Last Updated: 2025-08-28T14:18:56.774Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H) Vendors: Dmitry V. (CEO of "UKR Solution") Products: UPC/EAN/GTIN Code Generator Problem Types: CWE-22 Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Dmitry V. (CEO of "UKR Solution") UPC/EAN/GTIN Code Generator allows Path Traversal. This issue affects UPC/EAN/GTIN Code Generator: from n/a through 2.0.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/upc-ean-barcode-generator/vulne
- CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/upc-ean-barcode-generator/vulnerability/wordpress-upc-ean-gtin-code-generator-plugin-2-0-2-arbitrary-file-deletion-vulnerability?_s_id=cve
CVE ID: CVE-2025-53595 State: PUBLISHED Published: 2025-10-03T18:14:49.578Z Last Updated: 2025-10-03T19:09:43.678Z Vendors: QNAP Systems Inc. Products: Qsync Central Problem Types: CWE-89 Description: An SQL injection vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to execute unauthorized code or commands. We have already fixed the vulnerability in the following version: Qsync Central 5.0.0.2 ( 2025/07/31 ) and later Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.qnap.com/en/security-advisory/qsa-25-35
CVE ID: CVE-2025-53599 State: PUBLISHED Published: 2025-07-04T07:20:11.124Z Last Updated: 2025-07-08T17:39:15.377Z Vendors: NAVER Products: NAVER Whale browser Problem Types: CWE-79 Description: Whale browser for iOS before 3.9.1.4206 allow an attacker to execute malicious scripts in the browser via a crafted javascript scheme. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cve.naver.com/detail/cve-2025-53599.html
CVE ID: CVE-2025-53600 State: PUBLISHED Published: 2025-07-04T07:20:26.014Z Last Updated: 2025-07-08T17:39:08.750Z Vendors: NAVER Products: NAVER Whale browser Problem Types: CWE-346 Description: Whale browser before 4.32.315.22 allow an attacker to bypass the Same-Origin Policy in a dual-tab environment. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cve.naver.com/detail/cve-2025-53600.html
CVE ID: CVE-2025-53602 State: PUBLISHED Published: 2025-07-04T00:00:00.000Z Last Updated: 2025-07-08T14:36:13.017Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Open Zipkin Products: Zipkin Problem Types: CWE-1188 Description: Zipkin through 3.5.1 has a /heapdump endpoint (associated with the use of Spring Boot Actuator), a similar issue to CVE-2025-48927. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://zipkin.io/ - https://github.com/openzipkin/zipkin/commit/3c7605dfdfab2dd341cf0ea121a56cefcd580d9e - https://github.com/openzipkin/zipkin/pull/3804
CVE ID: CVE-2025-53603 State: PUBLISHED Published: 2025-07-05T00:00:00.000Z Last Updated: 2025-11-04T21:11:50.201Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Alinto Products: SOPE Problem Types: CWE-476 Description: In Alinto SOPE SOGo 2.0.2 through 5.12.2, sope-core/NGExtensions/NGHashMap.m allows a NULL pointer dereference and SOGo crash via a request in which a parameter in the query string is a duplicate of a parameter in the POST body. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/Alinto/sope/compare/SOGo-2.0.1...SOGo-2.0.2 - https://www.openwall.com/lists/oss-security/2025/07/02/3 - http
github.com/Alinto/sope/compare/SOGo-2.0.1...SOGo-2.0.2 - https://www.openwall.com/lists/oss-security/2025/07/02/3 - https://github.com/Alinto/sope/blob/3146fbdb6ff3314e37e5c3682deeeef7d0f32064/sope-core/NGExtensions/NGHashMap.m#L790 - https://github.com/Alinto/sope/pull/69
CVE ID: CVE-2025-53604 State: PUBLISHED Published: 2025-07-05T00:00:00.000Z Last Updated: 2025-07-08T14:35:55.692Z Severity: MEDIUM (CVSS 4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:L) Vendors: pimeys Products: web-push Problem Types: CWE-130 Description: The web-push crate before 0.10.3 for Rust allows a denial of service (memory consumption) in the built-in clients via a large integer in a Content-Length header. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://rustsec.org/advisories/RUSTSEC-2025-0015.html - https://github.com/pimeys/rust-web-push/pull/68 - https://crates.io/crates/web-push
CVE ID: CVE-2025-53605 State: PUBLISHED Published: 2025-07-05T00:00:00.000Z Last Updated: 2025-07-08T14:35:48.796Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: stepancheg Products: protobuf Problem Types: CWE-674 Description: The protobuf crate before 3.7.2 for Rust allows uncontrolled recursion in the protobuf::coded_input_stream::CodedInputStream::skip_group parsing of unknown fields in untrusted input. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/stepancheg/rust-protobuf/issues/749 - https://rustsec.org/advisories/RUSTSEC-2024-0437 - https://crates.io/crates/protobuf
CVE ID: CVE-2025-53606 State: PUBLISHED Published: 2025-08-08T09:22:55.040Z Last Updated: 2025-11-04T21:11:51.516Z Vendors: Apache Software Foundation Products: Apache Seata (incubating) Problem Types: CWE-502 Description: Deserialization of Untrusted Data vulnerability in Apache Seata (incubating). This issue affects Apache Seata (incubating): 2.4.0. Users are recommended to upgrade to version 2.5.0, which fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://lists.apache.org/thread/ggfd72vvvxjozs81zbcls45zxg64pphx
CVE ID: CVE-2025-53609 State: PUBLISHED Published: 2025-09-09T13:50:41.345Z Last Updated: 2025-09-09T14:10:35.494Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N/E:P/RL:X/RC:C) Vendors: Fortinet Products: FortiWeb Problem Types: CWE-23 Description: A Relative Path Traversal vulnerability [CWE-23] in FortiWeb 7.6.0 through 7.6.4, 7.4.0 through 7.4.8, 7.2.0 through 7.2.11, 7.0.2 through 7.0.11 may allow an authenticated attacker to perform an arbitrary file read on the underlying system via crafted requests. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fortiguard.fortinet.com/psirt/FG-IR-25-512
CVE ID: CVE-2025-53610 State: REJECTED Published: N/A Last Updated: 2025-07-08T02:55:08.410Z Description: No description available.
CVE ID: CVE-2025-53611 State: REJECTED Published: N/A Last Updated: 2025-07-08T02:55:07.965Z Description: No description available.
CVE ID: CVE-2025-53612 State: REJECTED Published: N/A Last Updated: 2025-07-08T02:55:07.530Z Description: No description available.
CVE ID: CVE-2025-53613 State: REJECTED Published: N/A Last Updated: 2025-07-08T02:55:07.091Z Description: No description available.
CVE ID: CVE-2025-53614 State: REJECTED Published: N/A Last Updated: 2025-07-08T02:55:06.659Z Description: No description available.
CVE ID: CVE-2025-53615 State: REJECTED Published: N/A Last Updated: 2025-07-08T02:55:06.210Z Description: No description available.
CVE ID: CVE-2025-53616 State: REJECTED Published: N/A Last Updated: 2025-07-08T02:55:05.747Z Description: No description available.
CVE ID: CVE-2025-53617 State: REJECTED Published: N/A Last Updated: 2025-07-08T02:55:05.242Z Description: No description available.
CVE ID: CVE-2025-53620 State: PUBLISHED Published: 2025-07-09T18:45:28.947Z Last Updated: 2025-07-09T19:14:41.333Z Vendors: QwikDev Products: qwik Problem Types: CWE-248 Description: @builder.io/qwik-city is the meta-framework for Qwik. When a Qwik Server Action QRL is executed it dynamically load the file containing the symbol. When an invalid qfunc is sent, the server does not handle the thrown error. The error then causes Node JS to exit. This vulnerability is fixed in 1.13.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/QwikDev/qwik/security/advisories/GHSA-qr9h-j6xg-2j72
CVE ID: CVE-2025-53621 State: PUBLISHED Published: 2025-07-15T14:44:01.435Z Last Updated: 2025-07-15T14:57:15.848Z Severity: MEDIUM (CVSS 6.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:N/A:L) Vendors: DSpace Products: DSpace Problem Types: CWE-611 Description: DSpace open source software is a repository application which provides durable access to digital resources. Two related XML External Entity (XXE) injection possibilities impact all versions of DSpace prior to 7.6.4, 8.2, and 9.1. External entities are not disabled when parsing XML files during import of an archive (in Simple Archive Format), either from command-line (`./dspace import` command) or from the "Batch Import (Zip)" user interfac
ple Archive Format), either from command-line (`./dspace import` command) or from the "Batch Import (Zip)" user interface feature. External entities are also not explicitly disabled when parsing XML responses from some upstream services (ArXiv, Crossref, OpenAIRE, Creative Commons) used in import from external sources via the user interface or REST API. An XXE injection in these files may result in a connection being made to an attacker's site or a local path readable by the Tomcat user, with content potentially being injected into a metadata field. In the latter case, this may result in sensitive content disclosure, including retrieving arbitrary files or configurations from the server wher
may result in sensitive content disclosure, including retrieving arbitrary files or configurations from the server where DSpace is running. The Simple Archive Format (SAF) importer / Batch Import (Zip) is only usable by site administrators (from user interface / REST API) or system administrators (from command-line). Therefore, to exploit this vulnerability, the malicious payload would have to be provided by an attacker and trusted by an administrator, who would trigger the import. The fix is included in DSpace 7.6.4, 8.2, and 9.1. Please upgrade to one of these versions. For those who cannot upgrade immediately, it is possible to manually patch the DSpace backend. One may also apply some b
For those who cannot upgrade immediately, it is possible to manually patch the DSpace backend. One may also apply some best practices, though the protection provided is not as complete as upgrading. Administrators must carefully inspect any SAF archives (they did not construct themselves) before importing. As necessary, affected external services can be disabled to mitigate the ability for payloads to be delivered via external service APIs. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/DSpace/DSpace/security/advisories/GHSA-jjwr-5cfh-7xwh - https://github.com/DSpace/DSpace/pull/11032 - https://github.com/DSpace/DSpace/pull/11032.patch - https://github.co
wh - https://github.com/DSpace/DSpace/pull/11032 - https://github.com/DSpace/DSpace/pull/11032.patch - https://github.com/DSpace/DSpace/pull/11034 - https://github.com/DSpace/DSpace/pull/11034.patch - https://github.com/DSpace/DSpace/pull/11035 - https://github.com/DSpace/DSpace/pull/11035.patch
CVE ID: CVE-2025-53622 State: PUBLISHED Published: 2025-07-15T14:47:45.342Z Last Updated: 2025-07-15T15:47:46.242Z Severity: MEDIUM (CVSS 5.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:L) Vendors: DSpace Products: DSpace Problem Types: CWE-22 Description: DSpace open source software is a repository application which provides durable access to digital resources. Prior to versions 7.6.4, 8.2, and 9.1, a path traversal vulnerability is possible during the import of an archive (in Simple Archive Format), either from command-line (`./dspace import` command) or from the "Batch Import (Zip)" user interface feature. An attacker may craft a malicious Simple Archive Format (SAF) package where the `con
port (Zip)" user interface feature. An attacker may craft a malicious Simple Archive Format (SAF) package where the `contents` file references any system files (using relative traversal sequences) which are readable by the Tomcat user. If such a package is imported, this will result in sensitive content disclose, including retrieving arbitrary files or configurations from the server where DSpace is running. The Simple Archive Format (SAF) importer / Batch Import (Zip) is only usable by site administrators (from user interface / REST API) or system administrators (from command-line). Therefore, to exploit this vulnerability, the malicious payload would have to be provided by an attacker and t