Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-4195 State: PUBLISHED Published: 2025-05-02T01:00:09.452Z Last Updated: 2025-05-02T12:00:18.019Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: itsourcecode Products: Gym Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in itsourcecode Gym Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /ajax.php?action=save_member. The manipulation of the argument umember_id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?
osed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.306808 - https://vuldb.com/?ctiid.306808 - https://vuldb.com/?submit.561876 - https://github.com/ARPANET-cybersecurity/vuldb/issues/6 - https://itsourcecode.com/
CVE ID: CVE-2025-4196 State: PUBLISHED Published: 2025-05-02T01:31:04.799Z Last Updated: 2025-05-02T17:07:46.988Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Patient Record Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in SourceCodester Patient Record Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /birthing.php. The manipulation of the argument comp_id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vul
en disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.306809 - https://vuldb.com/?ctiid.306809 - https://vuldb.com/?submit.561880 - https://github.com/zhxu147/CVE/blob/main/hcpms_birthing.php_sqli.pdf - https://www.sourcecodester.com/
CVE ID: CVE-2025-4197 State: PUBLISHED Published: 2025-05-02T01:31:06.560Z Last Updated: 2025-05-02T16:38:54.031Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: code-projects Products: Patient Record Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability classified as critical has been found in code-projects Patient Record Management System 1.0. Affected is an unknown function of the file /edit_xpatient.php. The manipulation of the argument lastname leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well. Additional Analyst Notes: - CISA A
disclosed to the public and may be used. Other parameters might be affected as well. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.306810 - https://vuldb.com/?ctiid.306810 - https://vuldb.com/?submit.561890 - https://github.com/zhxu147/CVE/blob/main/hcpms_edit_xpatient.php_sqli.pdf - https://code-projects.org/
CVE ID: CVE-2025-4198 State: PUBLISHED Published: 2025-05-03T01:43:06.514Z Last Updated: 2025-05-05T14:58:02.322Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: todoapuestas Products: Alink Tap Problem Types: CWE-352 Description: The Alink Tap plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.1. This is due to missing or incorrect nonce validation on the 'alink-tap' page. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additiona
rged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c856e06d-34f7-42e9-a72c-3d4e9207e07e?source=cve - https://wordpress.org/plugins/alink-tap/ - https://plugins.trac.wordpress.org/browser/alink-tap/trunk/admin/views/admin.php
CVE ID: CVE-2025-4199 State: PUBLISHED Published: 2025-05-03T01:43:07.311Z Last Updated: 2025-05-05T14:57:56.233Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: withinboredom Products: Abundatrade Plugin Problem Types: CWE-352 Description: The Abundatrade Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.8.02. This is due to missing or incorrect nonce validation on the 'abundatrade' page. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clickin
s web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ef828667-f241-4c5c-92a8-0a4f366e190f?source=cve - https://plugins.trac.wordpress.org/browser/abundatrade-plugin/tags/1.8.02/abundatrade_pugin.php - https://wordpress.org/plugins/abundatrade-plugin/
CVE ID: CVE-2025-4200 State: PUBLISHED Published: 2025-06-14T08:23:23.869Z Last Updated: 2025-06-17T18:39:27.320Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: BZOTheme Products: Zagg - Electronics & Accessories WooCommerce WordPress Theme Problem Types: CWE-98 Description: The Zagg - Electronics & Accessories WooCommerce WordPress Theme theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.4.1 via the load_view() function that is called via at least three AJAX actions: 'load_more_post', 'load_shop', and 'load_more_product. This makes it possible for unauthenticated attackers to include and execute arbitrary files
p', and 'load_more_product. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/327deb08-715f-4d54-b95b-18552c07cbc0?source=cve - https://themeforest.net/item/zagg-electronics-accessories-woocommerce-wordpress-theme/54636595
CVE ID: CVE-2025-4203 State: PUBLISHED Published: 2025-10-25T06:49:24.551Z Last Updated: 2025-10-27T15:37:26.760Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: tomdever Products: wpForo Forum Problem Types: CWE-89 Description: The wpForo Forum plugin for WordPress is vulnerable to error‐based or time-based SQL Injection via the get_members() function in all versions up to, and including, 2.4.8 due to missing integer validation on the 'offset' and 'row_count' parameters. The function blindly interpolates 'row_count' into a 'LIMIT offset,row_count' clause using esc_sql() rather than enforcing numeric values. MySQL 5.x’s grammar allows a 'PROCEDURE ANALYSE' cla
count' clause using esc_sql() rather than enforcing numeric values. MySQL 5.x’s grammar allows a 'PROCEDURE ANALYSE' clause immediately after a LIMIT clause. Unauthenticated attackers controlling 'row_count' can append a stored‐procedure call, enabling error‐based or time‐based blind SQL injection that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/bc406e8a-c4eb-45c3-a53c-37644e0dabfa?source=cve - https://plugins.trac.wordpress.org/browser/wpforo/tags/2.4.5/classes/Members.php#L1557 - https://wordpress.org/plugins/wpforo/#developers - https://plugins.tra
ser/wpforo/tags/2.4.5/classes/Members.php#L1557 - https://wordpress.org/plugins/wpforo/#developers - https://plugins.trac.wordpress.org/browser/wpforo/tags/2.4.9/classes/Members.php#L1557
CVE ID: CVE-2025-4204 State: PUBLISHED Published: 2025-05-02T12:23:39.077Z Last Updated: 2025-05-02T13:34:55.400Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Inception Software LLP Products: Ultimate Auction Pro Problem Types: CWE-89 Description: The Ultimate Auction Pro plugin for WordPress is vulnerable to SQL Injection via the ‘auction_id’ parameter in all versions up to, and including, 1.5.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract
for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e492029d-6613-4881-b986-9fe14cb2cf74?source=cve - https://auctionplugin.net/changelog/ultimate-woo-auction-pro/
CVE ID: CVE-2025-4205 State: PUBLISHED Published: 2025-06-03T11:22:26.281Z Last Updated: 2025-06-03T13:08:51.803Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: danieliser Products: Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popups Builder Problem Types: CWE-79 Description: The Popup Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘popupID' parameter in all versions up to, and including, 1.20.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages tha
sible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/58fe6f67-1139-4d3e-864d-3966cede5077?source=cve - https://plugins.trac.wordpress.org/browser/popup-maker/tags/1.20.4/assets/js/site.js#L869 - https://wordpress.org/plugins/popup-maker/#developers - https://plugins.trac.wordpress.org/changeset/3303770/
CVE ID: CVE-2025-4206 State: PUBLISHED Published: 2025-05-09T11:11:19.260Z Last Updated: 2025-05-09T16:10:24.557Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: trainingbusinesspros Products: WordPress CRM, Email & Marketing Automation for WordPress | Award Winner — Groundhogg Problem Types: CWE-22 Description: The WordPress CRM, Email & Marketing Automation for WordPress | Award Winner — Groundhogg plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'process_export_delete' and 'process_import_delete' functions in all versions up to, and including, 4.1.1.2. This makes it possible for authenticated atta
ss_import_delete' functions in all versions up to, and including, 4.1.1.2. This makes it possible for authenticated attackers, with Administrator-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/0256b4ad-6094-4062-bdf7-c3fc0410557b?source=cve - https://plugins.trac.wordpress.org/browser/groundhogg/trunk/admin/tools/tools-page.php#L912 - https://plugins.trac.wordpress.org/browser/groundhogg/trunk/admin/tools/tools-page.php#L701 - https://plugins.trac.word
https://plugins.trac.wordpress.org/browser/groundhogg/trunk/admin/tools/tools-page.php#L701 - https://plugins.trac.wordpress.org/changeset/3289364/
CVE ID: CVE-2025-4207 State: PUBLISHED Published: 2025-05-08T14:22:45.543Z Last Updated: 2025-05-09T18:03:35.540Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: n/a Products: PostgreSQL Problem Types: CWE-126 Description: Buffer over-read in PostgreSQL GB18030 encoding validation allows a database input provider to achieve temporary denial of service on platforms where a 1-byte over-read can elicit process termination. This affects the database server and also libpq. Versions before PostgreSQL 17.5, 16.9, 15.13, 14.18, and 13.21 are affected. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.postgresql.org
ed. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.postgresql.org/support/security/CVE-2025-4207/
CVE ID: CVE-2025-4208 State: PUBLISHED Published: 2025-05-08T11:13:44.068Z Last Updated: 2025-05-08T13:38:29.978Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: webaways Products: NEX-Forms – Ultimate Forms Plugin for WordPress Problem Types: CWE-94 Description: The NEX-Forms – Ultimate Form Builder – Contact forms and much more plugin for WordPress is vulnerable to Limited Code Execution in all versions up to, and including, 8.9.1 via the get_table_records function. This is due to the unsanitized use of user-supplied input in call_user_func(). This makes it possible for authenticated attackers, with Custom-level access, to execute arbitrary PHP functions t
nc(). This makes it possible for authenticated attackers, with Custom-level access, to execute arbitrary PHP functions that meet specific constraints (static methods or global functions accepting a single array parameter). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/1d2b7215-d3a7-4e5a-ae9b-65fecc26dceb?source=cve - https://plugins.trac.wordpress.org/browser/nex-forms-express-wp-form-builder/trunk/includes/classes/class.dashboard.php?rev=3226607#L3420
CVE ID: CVE-2025-4209 State: REJECTED Published: N/A Last Updated: 2025-05-15T22:15:50.074Z Description: No description available.
CVE ID: CVE-2025-4210 State: PUBLISHED Published: 2025-05-02T15:31:04.394Z Last Updated: 2025-05-02T16:49:19.177Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: n/a Products: Casdoor Problem Types: CWE-639, CWE-285 Description: A vulnerability classified as critical was found in Casdoor up to 1.811.0. This vulnerability affects the function HandleScim of the file controllers/scim.go of the component SCIM User Creation Endpoint. The manipulation leads to authorization bypass. The attack can be initiated remotely. Upgrading to version 1.812.0 is able to address this issue. The name of the patch is 3d12ac8dc2282369296c3386815c00a06c6a92fe. It is recommended to upgrade the affected
this issue. The name of the patch is 3d12ac8dc2282369296c3386815c00a06c6a92fe. It is recommended to upgrade the affected component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.307180 - https://vuldb.com/?ctiid.307180 - https://vuldb.com/?submit.556201 - https://github.com/casdoor/casdoor/commit/3d12ac8dc2282369296c3386815c00a06c6a92fe - https://github.com/casdoor/casdoor/releases/tag/v1.812.0
CVE ID: CVE-2025-4211 State: PUBLISHED Published: 2025-05-16T13:25:29.074Z Last Updated: 2025-05-16T13:54:00.528Z Vendors: The Qt Company Products: Qt Problem Types: CWE-59 Description: Improper Link Resolution Before File Access ('Link Following') vulnerability in QFileSystemEngine in the Qt corelib module on Windows which potentially allows Symlink Attacks and the use of Malicious Files. Issue originates from CVE-2024-38081. The vulnerability arises from the use of the GetTempPath API, which can be exploited by attackers to manipulate temporary file paths, potentially leading to unauthorized access and privilege escalation. The affected public API in the Qt Framework is QDir::tempPath() an
ding to unauthorized access and privilege escalation. The affected public API in the Qt Framework is QDir::tempPath() and anything that uses it, such as QStandardPaths with TempLocation, QTemporaryDir, and QTemporaryFile.This issue affects all version of Qt up to and including 5.15.18, from 6.0.0 through 6.5.8, from 6.6.0 through 6.8.1. It is fixed in Qt 5.15.19, Qt 6.5.9, Qt 6.8.2, 6.9.0 Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://codereview.qt-project.org/c/qt/qtbase/+/632231
CVE ID: CVE-2025-4212 State: PUBLISHED Published: 2025-11-18T09:27:35.729Z Last Updated: 2025-11-18T21:33:24.744Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: wpwham Products: Checkout Files Upload for WooCommerce Problem Types: CWE-79 Description: The Checkout Files Upload for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via file uploads in all versions up to, and including, 2.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in image files that will execute whenever a user accesses the injected page. Additional Analyst Notes:
trary web scripts in image files that will execute whenever a user accesses the injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/09d9785a-db71-4735-b86b-7fa10cf36a0b?source=cve - https://plugins.trac.wordpress.org/changeset?old_path=/checkout-files-upload-woocommerce/tags/2.2.1&new_path=/checkout-files-upload-woocommerce/tags/2.2.2
CVE ID: CVE-2025-4213 State: PUBLISHED Published: 2025-05-02T18:00:09.213Z Last Updated: 2025-05-02T18:23:10.239Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: PHPGurukul Products: Online Birth Certificate System Problem Types: CWE-89, CWE-74 Description: A vulnerability has been found in PHPGurukul Online Birth Certificate System 1.0 and classified as critical. This vulnerability affects unknown code of the file /admin/search.php. The manipulation of the argument searchdata leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.co
sclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.307192 - https://vuldb.com/?ctiid.307192 - https://vuldb.com/?submit.562291 - https://github.com/LoovvvE18/CVE/issues/1 - https://phpgurukul.com/
CVE ID: CVE-2025-4214 State: PUBLISHED Published: 2025-05-02T19:31:04.377Z Last Updated: 2025-05-02T20:08:28.595Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: PHPGuruku Products: Online DJ Booking Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in PHPGuruku Online DJ Booking Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /admin/booking-bwdates-reports-details.php. The manipulation of the argument fromdate leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well. Additional
ly. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.307193 - https://vuldb.com/?ctiid.307193 - https://vuldb.com/?submit.562295 - https://github.com/LoovvvE18/CVE/issues/2
CVE ID: CVE-2025-4215 State: PUBLISHED Published: 2025-05-02T20:31:05.334Z Last Updated: 2025-06-12T00:12:13.442Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L) Vendors: gorhill Products: uBlock Origin Problem Types: CWE-1333, CWE-400 Description: A vulnerability was found in gorhill uBlock Origin up to 1.63.3b16. It has been classified as problematic. Affected is the function currentStateChanged of the file src/js/1p-filters.js of the component UI. The manipulation leads to inefficient regular expression complexity. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been
k remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 1.63.3b17 is able to address this issue. The patch is identified as eaedaf5b10d2f7857c6b77fbf7d4a80681d4d46c. It is recommended to upgrade the affected component. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.307194 - https://vuldb.com/?ctiid.307194 - https://vuldb.com/?submit.562301 - https://github.com/gorhill/uBlock/commit/eaedaf5b10d2f7857c6b77fbf7d4a80681d4d46c - https://github.com/gorhill/uBlock/releases/tag/1.63.3b17
CVE ID: CVE-2025-4216 State: PUBLISHED Published: 2025-06-14T08:23:22.614Z Last Updated: 2025-06-17T18:39:45.364Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: scada Products: DIOT SCADA with MQTT Problem Types: CWE-79 Description: The DIOT SCADA with MQTT plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'diot' shortcode in all versions up to, and including, 1.0.5.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user acces
ith contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/1cf23d79-5bd3-4224-835d-174653ddd504?source=cve - https://plugins.trac.wordpress.org/browser/ecava-diot-scada/trunk/includes/shortcodes.php
CVE ID: CVE-2025-4217 State: PUBLISHED Published: 2025-05-21T09:21:51.423Z Last Updated: 2025-05-21T10:16:31.489Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: measuremarketing Products: WP YouTube Video Optimizer Problem Types: CWE-79 Description: The WP YouTube Video Optimizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ib_youtube' shortcode in all versions up to, and including, 1.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will exec
uthenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/71a933ef-f49d-4520-90d5-9957f72d7452?source=cve - https://plugins.trac.wordpress.org/browser/wp-youtube-video-optimizer/trunk/wp-youtube-video-optimizer.php#L20
CVE ID: CVE-2025-4218 State: PUBLISHED Published: 2025-05-02T20:31:06.936Z Last Updated: 2025-05-05T14:55:29.704Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: handrew Products: browserpilot Problem Types: CWE-94, CWE-74 Description: A vulnerability was found in handrew browserpilot up to 0.2.51. It has been declared as critical. Affected by this vulnerability is the function GPTSeleniumAgent of the file browserpilot/browserpilot/agents/gpt_selenium_agent.py. The manipulation of the argument instructions leads to code injection. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. Additional Analyst Notes