Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-3090 State: PUBLISHED Published: 2025-06-24T08:05:15.547Z Last Updated: 2025-06-24T14:18:57.831Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H) Vendors: MB connect line, Helmholz Products: mbCONNECT24, mymbCONNECT24, myREX24, myREX24.virtual Problem Types: CWE-306 Description: An unauthenticated remote attacker can obtain limited sensitive information and/or DoS the device due to missing authentication for critical function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://certvde.com/en/advisories/VDE-2025-034 - https://certvde.com/en/advisories/VDE-2025-037
CVE ID: CVE-2025-3091 State: PUBLISHED Published: 2025-06-24T08:10:29.717Z Last Updated: 2025-06-24T13:56:13.121Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: MB connect line, Helmholz Products: mbCONNECT24, mymbCONNECT24, myREX24, myREX24.virtual Problem Types: CWE-639 Description: An low privileged remote attacker in possession of the second factor for another user can login as that user without knowledge of the other user`s password. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://certvde.com/en/advisories/VDE-2025-035 - https://certvde.com/en/advisories/VDE-2025-038
CVE ID: CVE-2025-3092 State: PUBLISHED Published: 2025-06-24T08:14:31.864Z Last Updated: 2025-06-24T13:55:34.477Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Helmholz, MB connect line Products: myREX24, myREX24.virtual, mbCONNECT24, mymbCONNECT24 Problem Types: CWE-204 Description: An unauthenticated remote attacker can enumerate valid user names from an unprotected endpoint. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://certvde.com/en/advisories/VDE-2025-035 - https://certvde.com/en/advisories/VDE-2025-038
CVE ID: CVE-2025-3094 State: REJECTED Published: N/A Last Updated: 2025-07-05T22:16:39.368Z Description: No description available.
CVE ID: CVE-2025-3096 State: PUBLISHED Published: 2025-04-01T18:24:30.184Z Last Updated: 2025-04-02T15:10:13.403Z Vendors: SourceCodester Products: Clinic's Patient Management System Problem Types: CWE-89 Description: Clinic’s Patient Management System versions 2.0 suffers from a SQL injection vulnerability in the login page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.sourcecodester.com/php-clinics-patient-management-system-source-code - https://www.cve.org/CVERecord?id=CVE-2022-2297
CVE ID: CVE-2025-3097 State: PUBLISHED Published: 2025-04-02T09:21:45.939Z Last Updated: 2025-04-02T13:54:34.479Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: paulgpetty Products: wp Time Machine Problem Types: CWE-79 Description: The wp Time Machine plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.4.0. This is due to missing or incorrect nonce validation on the 'wpTimeMachineCore.php' page. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking
web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f44fdbb2-abb8-488f-bdc0-ec6eea93d92a?source=cve - https://plugins.trac.wordpress.org/browser/wp-time-machine/trunk/includes/wpTimeMachineCore.php#L86 - https://wordpress.org/plugins/wp-time-machine/
CVE ID: CVE-2025-3098 State: PUBLISHED Published: 2025-04-02T09:21:43.601Z Last Updated: 2025-04-02T14:47:01.260Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: ulshamim Products: Video Url Problem Types: CWE-79 Description: The Video Url plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'id' parameter in all versions up to, and including, 1.0.0.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - C
f they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/587e28ea-b3f4-4e40-a7d2-c6a01ac905bf?source=cve - https://plugins.trac.wordpress.org/browser/video-sidebar-widget/tags/1.0.0.3/delete.php - https://plugins.trac.wordpress.org/browser/video-sidebar-widget/tags/1.0.0.3/video_edit.php - https://wordpress.org/plugins/video-sidebar-widget/
CVE ID: CVE-2025-3099 State: PUBLISHED Published: 2025-04-02T09:21:43.235Z Last Updated: 2025-04-02T14:47:24.978Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: dbejean Products: Advanced Search by My Solr Server Problem Types: CWE-352 Description: The Advanced Search by My Solr Server plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.5. This is due to missing or incorrect nonce validation on the 'MySolrServerSettings' page. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into perf
ate settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/250d1bea-793d-4c13-976b-bfc3ff7d9160?source=cve - https://plugins.trac.wordpress.org/browser/advanced-search-by-my-solr-server/tags/2.0.5/advanced-search-by-my-solr-server.php#L1008 - https://plugins.trac.wordpress.org/browser/advanced-search-by-my-solr-server/tags/2.0.5/advanced-search-by-my-solr-server-options-page.php#L76 - https://plugins.trac.wordpress.org/browser/advanced-search-by-my-solr-server/tags/2
y-solr-server-options-page.php#L76 - https://plugins.trac.wordpress.org/browser/advanced-search-by-my-solr-server/tags/2.0.5/advanced-search-by-my-solr-server.inc.php#L66 - https://wordpress.org/plugins/advanced-search-by-my-solr-server/#developers
CVE ID: CVE-2025-3100 State: PUBLISHED Published: 2025-04-09T04:21:20.345Z Last Updated: 2025-04-09T19:22:45.249Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: wedevs Products: WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts Problem Types: CWE-79 Description: The WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 2.6.22 due to insufficient input sanitization and output escaping in tasks discussion. This makes it possible for aut
g, 2.6.22 due to insufficient input sanitization and output escaping in tasks discussion. This makes it possible for authenticated attackers, with Subscriber-level access and above, and permissions granted by an Administrator, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/4d62b087-b0ca-4fa8-921b-5eeb3fa76596?source=cve - https://plugins.trac.wordpress.org/browser/wedevs-project-manager/trunk/src/File/Helper/File.php#L56 - https://plugins.trac.wordpress.org/changeset/3268509/wedevs-project-manager/trunk/bootstrap/loaders
elper/File.php#L56 - https://plugins.trac.wordpress.org/changeset/3268509/wedevs-project-manager/trunk/bootstrap/loaders.php
CVE ID: CVE-2025-3101 State: PUBLISHED Published: 2025-04-24T08:23:48.158Z Last Updated: 2025-04-24T15:22:51.170Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: wp-configurator Products: Configurator Theme Core Problem Types: CWE-269 Description: The Configurator Theme Core plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.4.7. This is due to the plugin not properly validating user meta fields prior to updating them in the database. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change escalate their privileges to Administrator. Additional Analyst Notes: - CISA AD
criber-level access and above, to change escalate their privileges to Administrator. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/535aa061-479f-415e-bee6-3151c42b917e?source=cve - https://themeforest.net/item/configurator-woocommerce-wordpress-theme/20474230
CVE ID: CVE-2025-3102 State: PUBLISHED Published: 2025-04-10T04:22:05.560Z Last Updated: 2025-04-10T13:10:32.671Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: brainstormforce Products: OttoKit: All-in-One Automation Platform (Formerly SureTriggers) Problem Types: CWE-697 Description: The SureTriggers: All-in-One Automation Platform plugin for WordPress is vulnerable to an authentication bypass leading to administrative account creation due to a missing empty value check on the 'secret_key' value in the 'autheticate_user' function in all versions up to, and including, 1.0.78. This makes it possible for unauthenticated attackers to create administrator accoun
rsions up to, and including, 1.0.78. This makes it possible for unauthenticated attackers to create administrator accounts on the target website when the plugin is installed and activated but not configured with an API key. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ec017311-f150-4a14-a4b4-b5634f574e2b?source=cve - https://plugins.trac.wordpress.org/browser/suretriggers/trunk/src/Controllers/RestController.php#L59 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3266499%40suretriggers%2Ftrunk&old=3264905%40suretriggers%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2025-3103 State: PUBLISHED Published: 2025-04-19T04:21:14.601Z Last Updated: 2025-04-21T02:40:44.904Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: LambertGroup Products: CLEVER - HTML5 Radio Player With History - Shoutcast and Icecast - Elementor Widget Addon Problem Types: CWE-73 Description: The CLEVER - HTML5 Radio Player With History - Shoutcast and Icecast - Elementor Widget Addon plugin for WordPress is vulnerable to arbitrary file read due to insufficient file path validation in the 'history.php' file in all versions up to, and including, 2.4. This makes it possible for unauthenticated attackers to read arbitrary files on the affected sit
to, and including, 2.4. This makes it possible for unauthenticated attackers to read arbitrary files on the affected site's server, which may contain sensitive information including database credentials. The vulnerability was partially patched in version 2.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/0733261f-a2e1-4bd1-a57d-fdaaa8c904db?source=cve - https://codecanyon.net/item/clever-html5-radio-player-with-history-shoutcast-and-icecast-elementor-widget-addon/26708087#item-description__updates-release-log
CVE ID: CVE-2025-3104 State: PUBLISHED Published: 2025-04-16T08:22:17.436Z Last Updated: 2025-04-16T14:34:09.724Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: WPStaging Products: WP STAGING Pro WordPress Backup Plugin Problem Types: CWE-200 Description: The WP STAGING Pro WordPress Backup Plugin for WordPress is vulnerable to Information Exposure in all versions up to and including 6.1.2 due to missing capability checks on the getOutdatedPluginsRequest() function. This makes it possible for unauthenticated attackers to reveal outdated installed active or inactive plugins. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfen
stalled active or inactive plugins. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/572e290e-9324-4c17-8c3b-fa67233b15c4?source=cve - https://wp-staging.com/wp-staging-pro-changelog/
CVE ID: CVE-2025-3105 State: PUBLISHED Published: 2025-04-04T07:27:41.997Z Last Updated: 2025-04-04T13:15:56.126Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: TangibleWP Products: Vehica Core Problem Types: CWE-269 Description: The Vehica Core plugin for WordPress, used by the Vehica - Car Dealer & Listing WordPress Theme, is vulnerable to privilege escalation in all versions up to, and including, 1.0.97. This is due to the plugin not properly validating user meta fields prior to updating them in the database. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change escalate their privileges to Administrator. Add
thenticated attackers, with Subscriber-level access and above, to change escalate their privileges to Administrator. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/0b787d6f-d002-4f09-8336-ebb91321e20b?source=cve - https://support.vehica.com/support/solutions/articles/101000393710
CVE ID: CVE-2025-3106 State: PUBLISHED Published: 2025-04-18T09:21:49.199Z Last Updated: 2025-04-18T11:59:49.558Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: choijun Products: LA-Studio Element Kit for Elementor Problem Types: CWE-79 Description: The LA-Studio Element Kit for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Table of Contents widget in all versions up to, and including, 1.4.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages t
ossible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/7c633419-e231-437f-a2af-6f564cffc2df?source=cve - https://plugins.trac.wordpress.org/browser/lastudio-element-kit/trunk/assets/js/addons/tablet-contents.min.js - https://wordpress.org/plugins/lastudio-element-kit/#developers - https://plugins.trac.wordpress.org/changeset/3275257/
CVE ID: CVE-2025-3107 State: PUBLISHED Published: 2025-05-13T06:40:55.404Z Last Updated: 2025-05-13T13:24:50.688Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: contrid Products: Newsletters Problem Types: CWE-89 Description: The Newsletters plugin for WordPress is vulnerable to time-based SQL Injection via the ‘orderby' parameter in all versions up to, and including, 4.9.9.8 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can
ackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/397555cf-0b0c-4ce5-97ad-59f135f9d195?source=cve - https://plugins.trac.wordpress.org/browser/newsletters-lite/tags/4.9.9.8/helpers/shortcode.php#L1094 - https://wordpress.org/plugins/newsletters-lite/#developers - https://tribulant.com/docs/wordpress-mailing-list-plugin/31/#doc6:~:text=snippets%20and%20more.-,Release%20Notes,-The%20changelogs%20below - https://plugins.trac.wordpress.org/change
oc6:~:text=snippets%20and%20more.-,Release%20Notes,-The%20changelogs%20below - https://plugins.trac.wordpress.org/changeset/3290691/newsletters-lite/trunk/helpers/shortcode.php - https://plugins.trac.wordpress.org/changeset/3290691/
CVE ID: CVE-2025-3108 State: PUBLISHED Published: 2025-07-06T22:47:25.655Z Last Updated: 2025-07-07T13:43:12.649Z Severity: MEDIUM (CVSS 5 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L) Vendors: run-llama Products: run-llama/llama_index Problem Types: CWE-1112 Description: A critical deserialization vulnerability exists in the run-llama/llama_index library's JsonPickleSerializer component, affecting versions v0.12.27 through v0.12.40. This vulnerability allows remote code execution due to an insecure fallback to Python's pickle module. JsonPickleSerializer prioritizes deserialization using pickle.loads(), which can execute arbitrary code when processing untrusted data. Attackers can exploit t
alization using pickle.loads(), which can execute arbitrary code when processing untrusted data. Attackers can exploit this by crafting malicious payloads to achieve full system compromise. The root cause includes an insecure fallback mechanism, lack of validation or safeguards, misleading design, and violation of Python security guidelines. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/9b55a5e8-74e6-4241-b323-e360dc8b110a - https://github.com/run-llama/llama_index/commit/702e4340623092fac4cf2fe95eb9465034856da3
CVE ID: CVE-2025-3111 State: PUBLISHED Published: 2025-05-22T13:30:43.544Z Last Updated: 2025-05-22T14:51:11.125Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: GitLab Products: GitLab Problem Types: CWE-770 Description: An issue has been discovered in GitLab CE/EE affecting all versions from 10.2 before 17.10.7, 17.11 before 17.11.3, and 18.0 before 18.0.1. A lack of input validation in the Kubernetes integration could allow an authenticated user to cause denial of service.. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/533313 - https://hackerone.com/reports/3045424
CVE ID: CVE-2025-3112 State: PUBLISHED Published: 2025-06-10T08:28:31.391Z Last Updated: 2025-06-10T14:24:46.175Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: Schneider Electric Products: Modicon Controllers M241/M251 Problem Types: CWE-400 Description: CWE-400: Uncontrolled Resource Consumption vulnerability exists that could cause Denial of Service when an authenticated malicious user sends manipulated HTTPS Content-Length header to the webserver. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2025-161-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2025-161-02.pdf
CVE ID: CVE-2025-3113 State: PUBLISHED Published: 2025-04-17T06:41:47.667Z Last Updated: 2025-04-17T19:00:48.208Z Vendors: Perforce Products: Delphix Problem Types: CWE-284 Description: A valid, authenticated user with sufficient privileges and who is aware of Continuous Compliance’s internal database configurations can leverage the application’s built-in Connector functionality to access Continuous Compliance’s internal database. This allows the user to explore the internal database schema and export its data, including the properties of Connecters and Rule Sets. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://portal.perforce.com/s/detail/a91PA000001SeefYAC
CVE ID: CVE-2025-3114 State: PUBLISHED Published: 2025-04-09T17:29:48.612Z Last Updated: 2025-04-15T20:29:11.223Z Vendors: Spotfire Products: Spotfire Enterprise Runtime for R, Spotfire Statistics Services, Spotfire Analyst, Deployment Kit used in Spotfire Server, Spotfire Desktop, Spotfire for AWS Marketplace, Spotfire Enterprise Runtime for R - Server Edition Description: Code Execution via Malicious Files: Attackers can create specially crafted files with embedded code that may execute without adequate security validation, potentially leading to system compromise. Sandbox Bypass Vulnerability: A flaw in the TERR security mechanism allows attackers to bypass sandbox restrictions, enabling
x Bypass Vulnerability: A flaw in the TERR security mechanism allows attackers to bypass sandbox restrictions, enabling the execution of untrusted code without appropriate controls. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://community.spotfire.com/articles/spotfire/spotfire-security-advisory-april-08-2025-spotfire-cve-2025-3114-r3484/
CVE ID: CVE-2025-3115 State: PUBLISHED Published: 2025-04-09T18:12:28.348Z Last Updated: 2025-11-11T11:47:58.064Z Vendors: Spotfire Products: Spotfire Statistics Services, Spotfire Analyst, Deployment Kit used in Spotfire Server, Spotfire Desktop, Spotfire for AWS Marketplace, Spotfire Enterprise Runtime for R - Server Edition, Spotfire Service for Python, Spotfire Service for R Description: Injection Vulnerabilities: Attackers can inject malicious code, potentially gaining control over the system executing these functions. Additionally, insufficient validation of filenames during file uploads can enable attackers to upload and execute malicious files, leading to arbitrary code execution Add
during file uploads can enable attackers to upload and execute malicious files, leading to arbitrary code execution Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://community.spotfire.com/articles/spotfire/spotfire-security-advisory-april-08-2025-spotfire-cve-2025-3115-r3485/
CVE ID: CVE-2025-3116 State: PUBLISHED Published: 2025-06-10T08:34:50.585Z Last Updated: 2025-06-10T14:21:34.597Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: Schneider Electric Products: Modicon Controllers M241/M251, Modicon Controllers M258 / LMC058 Problem Types: CWE-20 Description: CWE-20: Improper Input Validation vulnerability exists that could cause Denial of Service when an authenticated malicious user sends special malformed HTTPS request containing improper formatted body data to the controller. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2025-161-02&p_enDocType=S
A ADP Vulnrichment: References: - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2025-161-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2025-161-02.pdf
CVE ID: CVE-2025-3117 State: PUBLISHED Published: 2025-06-10T08:43:15.540Z Last Updated: 2025-06-10T14:19:52.530Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: Schneider Electric Products: Modicon Controllers M241/M251, Modicon Controllers M262 Problem Types: CWE-79 Description: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists impacting configuration file paths that could cause an unvalidated data injected by authenticated malicious user leading to modify or read data in a victim’s browser. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://download.schneider-electric.co
ictim’s browser. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2025-161-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2025-161-02.pdf