Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-12607 State: PUBLISHED Published: 2025-11-03T00:02:07.039Z Last Updated: 2025-11-03T14:14:23.841Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: itsourcecode Products: Online Loan Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability was identified in itsourcecode Online Loan Management System 1.0. Impacted is an unknown function of the file /manage_payment.php. Such manipulation of the argument ID leads to sql injection. The attack can be executed remotely. The exploit is publicly available and might be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.330897 - https://vuldb.co
e used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.330897 - https://vuldb.com/?ctiid.330897 - https://vuldb.com/?submit.678243 - https://github.com/cintahue/CVE/issues/4 - https://itsourcecode.com/
CVE ID: CVE-2025-12608 State: PUBLISHED Published: 2025-11-03T00:32:06.062Z Last Updated: 2025-11-03T15:00:44.154Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: itsourcecode Products: Online Loan Management System Problem Types: CWE-89, CWE-74 Description: A security flaw has been discovered in itsourcecode Online Loan Management System 1.0. The affected element is an unknown function of the file /manage_user.php. Performing manipulation of the argument ID results in sql injection. The attack is possible to be carried out remotely. The exploit has been released to the public and may be exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: References:
it has been released to the public and may be exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.330898 - https://vuldb.com/?ctiid.330898 - https://vuldb.com/?submit.678244 - https://github.com/cintahue/CVE/issues/5 - https://itsourcecode.com/
CVE ID: CVE-2025-12609 State: PUBLISHED Published: 2025-11-03T01:02:06.847Z Last Updated: 2025-11-03T14:57:00.643Z Severity: N/A (CVSS 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: CodeAstro Products: Gym Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in CodeAstro Gym Management System 1.0. Affected by this issue is some unknown functionality of the file /admin/update-progress.php. Performing manipulation of the argument id/ini_weight results in sql injection. The attack may be initiated remotely. The exploit has been made public and could be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.33090
e public and could be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.330904 - https://vuldb.com/?ctiid.330904 - https://vuldb.com/?submit.678402 - https://vuldb.com/?submit.678403 - https://github.com/iamzzzzz/iam/issues/1 - https://codeastro.com/
CVE ID: CVE-2025-12610 State: PUBLISHED Published: 2025-11-03T01:32:06.052Z Last Updated: 2025-11-03T14:40:24.631Z Severity: N/A (CVSS 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: CodeAstro Products: Gym Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability was determined in CodeAstro Gym Management System 1.0. This affects an unknown part of the file /admin/view-progress-report.php. Executing manipulation of the argument ID can lead to sql injection. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.330905 - https://vuldb
utilized. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.330905 - https://vuldb.com/?ctiid.330905 - https://vuldb.com/?submit.678450 - https://github.com/danz0424/loudong/issues/1 - https://codeastro.com/
CVE ID: CVE-2025-12611 State: PUBLISHED Published: 2025-11-03T02:02:09.734Z Last Updated: 2025-11-03T14:26:36.736Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR) Vendors: Tenda Products: AC21 Problem Types: CWE-120, CWE-119 Description: A vulnerability was identified in Tenda AC21 16.03.08.16. This vulnerability affects the function formSetPPTPServer of the file /goform/SetPptpServerCfg. The manipulation of the argument startIp leads to buffer overflow. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.330906 - https://vuldb.com/?ctiid.
dditional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.330906 - https://vuldb.com/?ctiid.330906 - https://vuldb.com/?submit.678491 - https://github.com/LX-LX88/cve/issues/10 - https://www.tenda.com.cn/
CVE ID: CVE-2025-12612 State: PUBLISHED Published: 2025-11-03T02:32:06.745Z Last Updated: 2025-11-12T12:37:26.335Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: Campcodes Products: School Fees Payment Management System Problem Types: CWE-89, CWE-74 Description: A security flaw has been discovered in Campcodes School Fees Payment Management System 1.0. This issue affects some unknown processing of the file /ajax.php?action=delete_course. The manipulation of the argument ID results in sql injection. The attack can be executed remotely. The exploit has been released to the public and may be exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: References
loit has been released to the public and may be exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.330907 - https://vuldb.com/?ctiid.330907 - https://vuldb.com/?submit.678547 - https://github.com/ProgramShowMaker/CVE/issues/1 - https://www.campcodes.com/
CVE ID: CVE-2025-12613 State: PUBLISHED Published: 2025-11-10T05:00:08.814Z Last Updated: 2025-11-10T16:00:21.663Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L) Vendors: n/a Products: cloudinary Problem Types: CWE-88 Description: Versions of the package cloudinary before 2.7.0 are vulnerable to Arbitrary Argument Injection due to improper parsing of parameter values containing an ampersand. An attacker can inject additional, unintended parameters. This could lead to a variety of malicious outcomes, such as bypassing security checks, altering data, or manipulating the application's behavior. **Note:** Following our established security policy, we attempted to contact
r manipulating the application's behavior. **Note:** Following our established security policy, we attempted to contact the maintainer regarding this vulnerability, but haven't received a response. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.snyk.io/vuln/SNYK-JS-CLOUDINARY-10495740 - https://github.com/cloudinary/cloudinary_npm/commit/ec4b65f2b3461365c569198ed6d2cfa61cca4050 - https://github.com/cloudinary/cloudinary_npm/pull/709
CVE ID: CVE-2025-12614 State: PUBLISHED Published: 2025-11-03T03:02:06.312Z Last Updated: 2025-11-03T14:04:22.875Z Severity: N/A (CVSS 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: SourceCodester Products: Best House Rental Management System Problem Types: CWE-89, CWE-74 Description: A weakness has been identified in SourceCodester Best House Rental Management System 1.0. Impacted is the function delete_payment of the file /admin_class.php. This manipulation of the argument ID causes sql injection. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: Referen
has been made available to the public and could be exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.330908 - https://vuldb.com/?ctiid.330908 - https://vuldb.com/?submit.678184 - https://github.com/321190176/Best-house-rental-management-system-3/blob/main/report.md - https://www.sourcecodester.com/
CVE ID: CVE-2025-12615 State: PUBLISHED Published: 2025-11-03T03:32:06.859Z Last Updated: 2025-11-03T20:35:20.857Z Severity: N/A (CVSS 5.1 AV:N/AC:H/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: PHPGurukul Products: News Portal Problem Types: CWE-321, CWE-320 Description: A security vulnerability has been detected in PHPGurukul News Portal 1.0. The affected element is an unknown function of the file /onps/settings.py. Such manipulation of the argument SECRET_KEY leads to use of hard-coded cryptographic key . The attack may be performed from remote. The attack requires a high level of complexity. The exploitability is described as difficult. The exploit has been disclosed publicly and may be u
level of complexity. The exploitability is described as difficult. The exploit has been disclosed publicly and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.330909 - https://vuldb.com/?ctiid.330909 - https://vuldb.com/?submit.678625 - https://github.com/NishantKumar-CSE/News-Portal-Python-Django-Project/blob/main/Hard-coded%20Cryptographic%20Key.md - https://phpgurukul.com/
CVE ID: CVE-2025-12616 State: PUBLISHED Published: 2025-11-03T04:02:06.308Z Last Updated: 2025-11-03T20:34:35.281Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R) Vendors: PHPGurukul Products: News Portal Problem Types: CWE-215, CWE-200 Description: A vulnerability was detected in PHPGurukul News Portal 1.0. The impacted element is an unknown function of the file /onps/settings.py. Performing manipulation results in insertion of sensitive information into debugging code. It is possible to initiate the attack remotely. The attack's complexity is rated as high. The exploitability is regarded as difficult. The exploit is now public and may be used. Additional
ity is rated as high. The exploitability is regarded as difficult. The exploit is now public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.330910 - https://vuldb.com/?ctiid.330910 - https://vuldb.com/?submit.678649 - https://github.com/NishantKumar-CSE/News-Portal-Python-Django-Project/blob/main/Information%20Disclosure%20via%20Debug%20Mode.md - https://phpgurukul.com/
CVE ID: CVE-2025-12617 State: PUBLISHED Published: 2025-11-03T04:32:08.832Z Last Updated: 2025-11-03T16:08:24.049Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: itsourcecode Products: Billing System Problem Types: CWE-89, CWE-74 Description: A flaw has been found in itsourcecode Billing System 1.0. This affects an unknown function of the file /admin/app/login_crud.php. Executing manipulation of the argument Password can lead to sql injection. It is possible to launch the attack remotely. The exploit has been published and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.330911 - https://vuldb.com/?ctiid.33091
onal Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.330911 - https://vuldb.com/?ctiid.330911 - https://vuldb.com/?submit.678665 - https://www.yuque.com/yuqueyonghuexlgkz/zepczx/py9oh6m1p7mx4eqr?singleDoc - https://itsourcecode.com/
CVE ID: CVE-2025-12618 State: PUBLISHED Published: 2025-11-03T06:32:13.198Z Last Updated: 2025-11-03T06:32:13.198Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR) Vendors: Tenda Products: AC8 Problem Types: CWE-120, CWE-119 Description: A vulnerability has been found in Tenda AC8 16.03.34.06. This impacts an unknown function of the file /goform/DatabaseIniSet. The manipulation of the argument Time leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. References: - https://vuldb.com/?id.330912 - https://vuldb.com/?ctiid.330912 - https://vuldb.com/?submit.678887 - https://www.yuque.com/ba1ma0-an29k/nnxo
id.330912 - https://vuldb.com/?ctiid.330912 - https://vuldb.com/?submit.678887 - https://www.yuque.com/ba1ma0-an29k/nnxoap/ow5xrpw56dqsgtdy?singleDoc - https://pan.baidu.com/s/11fdpTujKw6Xz0yPE2l4cMw - https://www.tenda.com.cn/
CVE ID: CVE-2025-12619 State: PUBLISHED Published: 2025-11-03T07:02:11.692Z Last Updated: 2025-11-03T16:06:25.502Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR) Vendors: Tenda Products: A15 Problem Types: CWE-120, CWE-119 Description: A vulnerability was found in Tenda A15 15.13.07.13. Affected is the function fromSetWirelessRepeat of the file /goform/openNetworkGateway. The manipulation of the argument wpapsk_crypto2_4g results in buffer overflow. The attack can be launched remotely. The exploit has been made public and could be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.330913 - https://vuldb.com/?ctiid.330913 - https:
st Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.330913 - https://vuldb.com/?ctiid.330913 - https://vuldb.com/?submit.678888 - https://www.yuque.com/ba1ma0-an29k/nnxoap/tzg68iadbmqx6esm?singleDoc - https://pan.baidu.com/s/1N5pzWOYFGl7KGuh9yjlDHg - https://www.tenda.com.cn/
CVE ID: CVE-2025-12620 State: PUBLISHED Published: 2025-11-13T05:30:39.612Z Last Updated: 2025-11-14T16:49:43.556Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: ays-pro Products: Poll Maker – Versus Polls, Anonymous Polls, Image Polls Problem Types: CWE-89 Description: The Poll Maker – Versus Polls, Anonymous Polls, Image Polls plugin for WordPress is vulnerable to generic SQL Injection via the ‘filterbyauthor’ parameter in all versions up to, and including, 6.0.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-le
ficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/56e0efba-4913-4772-8a5b-5cb5c84b5d48?source=cve - https://plugins.trac.wordpress.org/browser/poll-maker/tags/6.0.7/includes/lists/class-poll-maker-polls-list-table.php#L2033 - https://plugins.trac.wordpress.org/browser/poll-maker/tags/6.0.7/includes/lists/class-poll-maker-polls-list-table.php#L2053
CVE ID: CVE-2025-12621 State: PUBLISHED Published: 2025-11-08T07:26:28.151Z Last Updated: 2025-11-10T14:14:29.598Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: wpdesk Products: Flexible Refund and Return Order for WooCommerce Problem Types: CWE-863 Description: The Flexible Refund and Return Order for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a misconfigured capability check on the 'create_refund' function in all versions up to, and including, 1.0.42. This makes it possible for authenticated attackers, with Contributor-level access and above, to update the status of refund requests, including approving and
ed attackers, with Contributor-level access and above, to update the status of refund requests, including approving and refusing refunds. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/8498c671-b46e-420c-a482-7c6983596753?source=cve - https://plugins.trac.wordpress.org/browser/flexible-refund-and-return-order-for-woocommerce/trunk/vendor_prefixed/wpdesk/flexible-refunds-core/src/Integration/Ajax.php#L55 - https://plugins.trac.wordpress.org/changeset?old=3378649%40flexible-refund-and-return-order-for-woocommerce%2Ftags%2F1.0.42&new=3390898%40flexible-refund-and-return-order-for-woocommerce%2Ftags%2F1.0.43
CVE ID: CVE-2025-12622 State: PUBLISHED Published: 2025-11-03T07:32:13.624Z Last Updated: 2025-11-03T16:06:54.102Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR) Vendors: Tenda Products: AC10 Problem Types: CWE-120, CWE-119 Description: A vulnerability was determined in Tenda AC10 16.03.10.13. Affected by this vulnerability is the function formSysRunCmd of the file /goform/SysRunCmd. This manipulation of the argument getui causes buffer overflow. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.330914 - https://vuldb.com/?ctiid.330914 -
l Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.330914 - https://vuldb.com/?ctiid.330914 - https://vuldb.com/?submit.678889 - https://www.yuque.com/ba1ma0-an29k/nnxoap/rg8eug0zk8ep3zne?singleDoc - https://pan.baidu.com/s/1Jl1zy5niigg1XYm8ZCh_Lg - https://www.tenda.com.cn/
CVE ID: CVE-2025-12623 State: PUBLISHED Published: 2025-11-03T08:02:05.877Z Last Updated: 2025-11-03T13:07:17.008Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R) Vendors: fushengqian Products: fuint Problem Types: CWE-639, CWE-285 Description: A vulnerability was identified in fushengqian fuint up to 41e26be8a2c609413a0feaa69bdad33a71ae8032. Affected by this issue is some unknown functionality of the file fuint-application/src/main/java/com/fuint/module/clientApi/controller/ClientSignController.java of the component Authentication Token Handler. Such manipulation leads to authorization bypass. The attack may be launched remotely. Attacks of this nature ar
Handler. Such manipulation leads to authorization bypass. The attack may be launched remotely. Attacks of this nature are highly complex. The exploitation is known to be difficult. The exploit is publicly available and might be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.330915 - https://vuldb.com/?ctiid.330915 - https://vuldb.com/?submit.678911 - https://github.com/fushengqian/fuint/issues/67
CVE ID: CVE-2025-12626 State: PUBLISHED Published: 2025-11-03T13:02:06.078Z Last Updated: 2025-11-03T14:08:09.907Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R) Vendors: jeecgboot Products: jeewx-boot Problem Types: CWE-22 Description: A security flaw has been discovered in jeecgboot jeewx-boot up to 641ab52c3e1845fec39996d7794c33fb40dad1dd. This affects the function getImgUrl of the file WxActGoldeneggsPrizesController.java. Performing manipulation of the argument imgurl results in path traversal. Remote exploitation of the attack is possible. The exploit has been released to the public and may be exploited. This product follows a rolling release app
s possible. The exploit has been released to the public and may be exploited. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The root cause was initially fixed but can be evaded with additional encoding. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.330916 - https://vuldb.com/?ctiid.330916 - https://vuldb.com/?submit.678926 - https://github.com/jeecgboot/jeewx-boot/issues/17 - https://github.com/jeecgboot/jeewx-boot/issues/47
CVE ID: CVE-2025-12628 State: PUBLISHED Published: 2025-11-24T12:58:37.015Z Last Updated: 2025-11-24T15:09:10.780Z Vendors: Unknown Products: WP 2FA Problem Types: CWE-331 Insufficient Entropyy Description: The WP 2FA WordPress plugin does not generate backup codes with enough entropy, which could allow attackers to bypass the second factor by brute forcing them Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/5e2d033c-dde6-4774-8588-cbe268c0d797/
CVE ID: CVE-2025-12629 State: PUBLISHED Published: 2025-11-24T06:00:07.220Z Last Updated: 2025-11-24T10:52:46.566Z Vendors: Unknown Products: Broken Link Manager Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Broken Link Manager WordPress plugin through 0.6.5 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/528e9775-3a2d-4e52-92f7-f123ad787e7d/
CVE ID: CVE-2025-12631 State: PUBLISHED Published: 2025-11-11T03:30:47.001Z Last Updated: 2025-11-12T20:05:34.060Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: spokanetony Products: Squirrels Auto Inventory Problem Types: CWE-79 Description: The Squirrels Auto Inventory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.0.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. T
sions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/9f93ee42-c21d-47cf-b140-65809da75653?source=cve - https://wordpress.org/plugins/squirrels-auto-inventory/
CVE ID: CVE-2025-12632 State: PUBLISHED Published: 2025-11-11T03:30:36.992Z Last Updated: 2025-11-12T20:08:05.398Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: loveless Products: RandomQuotr Problem Types: CWE-79 Description: The RandomQuotr plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.0.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site i
bitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/42308a6e-cb04-42dc-90b0-9b40c264ad53?source=cve - https://it.wordpress.org/plugins/randomquotr/
CVE ID: CVE-2025-12633 State: PUBLISHED Published: 2025-11-12T07:27:40.738Z Last Updated: 2025-11-14T15:26:52.782Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: stellarwp Products: Booking Calendar | Appointment Booking | Bookit Problem Types: CWE-862 Description: The Booking Calendar | Appointment Booking | Bookit plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the '/wp-json/bookit/v1/commerce/stripe/return' REST API Endpoint in all versions up to, and including, 2.5.0. This makes it possible for unauthenticated attackers to connect their Stripe account and receive payments. Additional Analyst Not
s it possible for unauthenticated attackers to connect their Stripe account and receive payments. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/2263d356-b2ed-4e16-98ee-b01d4274d1d9?source=cve - https://plugins.trac.wordpress.org/changeset/3393159/bookit/tags/2.5.1/src/Bookit/Gateways/StripeConnect/REST/Return_Endpoint.php?old=3121677&old_path=bookit%2Ftags%2F2.5.0%2Fsrc%2FBookit%2FGateways%2FStripeConnect%2FREST%2FReturn_Endpoint.php