Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
oitability is told to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.313641 - https://vuldb.com/?ctiid.313641 - https://vuldb.com/?submit.595444 - https://github.com/geo-chen/70mai/blob/main/README.md#finding-2-unauthenticated-file-storage-allowing-remote-dumping-of-video-footage-and-live-video-stream
CVE ID: CVE-2025-6525 State: PUBLISHED Published: 2025-06-23T21:31:05.407Z Last Updated: 2025-06-24T17:09:57.900Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RL:W/RC:R) Vendors: 70mai Products: 1S Problem Types: CWE-285, CWE-266 Description: A vulnerability classified as problematic was found in 70mai 1S up to 20250611. This vulnerability affects unknown code of the file /cgi-bin/Config.cgi?action=set of the component Configuration Handler. The manipulation leads to improper authorization. The attack needs to be approached within the local network. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosur
twork. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.313642 - https://vuldb.com/?ctiid.313642 - https://vuldb.com/?submit.595446 - https://github.com/geo-chen/70mai/blob/main/README.md#finding-3-unauthorised-configuration-change
CVE ID: CVE-2025-6526 State: PUBLISHED Published: 2025-06-23T22:00:13.932Z Last Updated: 2025-06-24T17:04:36.394Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:W/RC:R) Vendors: 70mai Products: M300 Problem Types: CWE-522 Description: A vulnerability, which was classified as problematic, has been found in 70mai M300 up to 20250611. This issue affects some unknown processing of the component HTTP Server. The manipulation leads to insufficiently protected credentials. The attack can only be done within the local network. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be use
k is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.313643 - https://vuldb.com/?ctiid.313643 - https://vuldb.com/?submit.595447 - https://github.com/geo-chen/70mai/blob/main/README.md#finding-4-exposed-root-password-via-unauthenticated-http-server
CVE ID: CVE-2025-6527 State: PUBLISHED Published: 2025-06-23T22:00:15.277Z Last Updated: 2025-06-24T17:01:19.583Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:W/RC:R) Vendors: 70mai Products: M300 Problem Types: CWE-284, CWE-266 Description: A vulnerability, which was classified as problematic, was found in 70mai M300 up to 20250611. Affected is an unknown function of the component Web Server. The manipulation leads to improper access controls. The attack can only be initiated within the local network. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The vendor
h. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.313644 - https://vuldb.com/?ctiid.313644 - https://vuldb.com/?submit.595448 - https://github.com/geo-chen/70mai/blob/main/README.md#finding-5-remotely-dump-all-sensitive-video--audio-recordings
CVE ID: CVE-2025-6528 State: PUBLISHED Published: 2025-06-23T22:31:06.024Z Last Updated: 2025-06-26T17:45:43.093Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:W/RC:R) Vendors: 70mai Products: M300 Problem Types: CWE-287 Description: A vulnerability has been found in 70mai M300 up to 20250611 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /livestream/12 of the component RTSP Live Video Stream Endpoint. The manipulation leads to improper authentication. The attack needs to be done within the local network. The exploit has been disclosed to the public and may be used. The vendor was contacted early about th
the local network. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.313645 - https://vuldb.com/?ctiid.313645 - https://vuldb.com/?submit.595449 - https://github.com/geo-chen/70mai/blob/main/README.md#finding-6-unauthenticated-live-video-stream
CVE ID: CVE-2025-6529 State: PUBLISHED Published: 2025-06-23T23:00:16.076Z Last Updated: 2025-06-24T16:11:53.492Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:W/RC:R) Vendors: 70mai Products: M300 Problem Types: CWE-1392 Description: A vulnerability was found in 70mai M300 up to 20250611 and classified as critical. Affected by this issue is some unknown functionality of the component Telnet Service. The manipulation leads to use of default credentials. The attack needs to be initiated within the local network. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Addit
o the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.313646 - https://vuldb.com/?ctiid.313646 - https://vuldb.com/?submit.595450 - https://github.com/geo-chen/70mai/blob/main/README.md#finding-7-remotely-upload-malicious-files-and-execute-code
CVE ID: CVE-2025-6530 State: PUBLISHED Published: 2025-06-23T23:00:17.364Z Last Updated: 2025-06-24T15:57:52.313Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H/E:P/RL:W/RC:R) Vendors: 70mai Products: M300 Problem Types: CWE-404 Description: A vulnerability was found in 70mai M300 up to 20250611. It has been classified as problematic. This affects an unknown part of the file demo.sh of the component Telnet Service. The manipulation leads to denial of service. Access to the local network is required for this attack. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The
her high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.313647 - https://vuldb.com/?ctiid.313647 - https://vuldb.com/?submit.595451 - https://github.com/geo-chen/70mai/blob/main/README.md#finding-8-remotely-crashing-the-dashcam
CVE ID: CVE-2025-6531 State: PUBLISHED Published: 2025-06-23T23:31:06.122Z Last Updated: 2025-06-26T14:39:22.401Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:W/RC:R) Vendors: SIFUSM, MZZYG Products: BD S1 Problem Types: CWE-284, CWE-266 Description: A vulnerability was found in SIFUSM/MZZYG BD S1 up to 20250611. It has been declared as problematic. This vulnerability affects unknown code of the component RTSP Live Video Stream Endpoint. The manipulation leads to improper access controls. Access to the local network is required for this attack to succeed. The exploit has been disclosed to the public and may be used. This dashcam is distributed by multiple re
ack to succeed. The exploit has been disclosed to the public and may be used. This dashcam is distributed by multiple resellers and different names. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.313648 - https://vuldb.com/?ctiid.313648 - https://vuldb.com/?submit.595452 - https://github.com/geo-chen/BD - https://github.com/geo-chen/BD?tab=readme-ov-file#finding-1-unauthenticated-access-of-livestream-and-download-of-video-recordings
CVE ID: CVE-2025-6532 State: PUBLISHED Published: 2025-06-24T00:00:08.696Z Last Updated: 2025-06-25T15:02:47.823Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:W/RC:R) Vendors: NOYAFA, Xiami Products: LF9 Pro Problem Types: CWE-284, CWE-266 Description: A vulnerability classified as problematic was found in NOYAFA/Xiami LF9 Pro up to 20250611. Affected by this vulnerability is an unknown functionality of the component RTSP Live Video Stream Endpoint. The manipulation leads to improper access controls. The attack can only be initiated within the local network. The exploit has been disclosed to the public and may be used. This dashcam is distributed by multiple
the local network. The exploit has been disclosed to the public and may be used. This dashcam is distributed by multiple resellers and different names. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.313651 - https://vuldb.com/?ctiid.313651 - https://vuldb.com/?submit.595453 - https://github.com/geo-chen/LF9 - https://github.com/geo-chen/LF9?tab=readme-ov-file#finding-1-unauthenticated-access-of-livestream-and-download-of-video-recordings
CVE ID: CVE-2025-6533 State: PUBLISHED Published: 2025-06-24T00:00:12.882Z Last Updated: 2025-06-25T15:02:40.680Z Severity: MEDIUM (CVSS 5.6 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R) Vendors: xxyopen, 201206030 Products: novel-plus Problem Types: CWE-294, CWE-287 Description: A vulnerability, which was classified as critical, has been found in xxyopen/201206030 novel-plus up to 5.1.3. Affected by this issue is the function ajaxLogin of the file novel-admin/src/main/java/com/java2nb/system/controller/LoginController.java of the component CATCHA Handler. The manipulation leads to authentication bypass by capture-replay. The attack may be launched remotely. The complexity of a
manipulation leads to authentication bypass by capture-replay. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.313652 - https://vuldb.com/?ctiid.313652 - https://vuldb.com/?submit.596481 - https://blog.0xd00.com/blog/captcha-replay-attack-lead-to-brute-force-protection-bypass - https://blog.0xd00.com/blog/captcha-replay-attack-lead-to-brute-force-protection-bypass#poc
CVE ID: CVE-2025-6534 State: PUBLISHED Published: 2025-06-24T00:31:05.097Z Last Updated: 2025-06-25T12:43:22.215Z Severity: MEDIUM (CVSS 4.2 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:R) Vendors: xxyopen, 201206030 Products: novel-plus Problem Types: CWE-99 Description: A vulnerability, which was classified as problematic, was found in xxyopen/201206030 novel-plus up to 5.1.3. This affects the function remove of the file novel-admin/src/main/java/com/java2nb/common/controller/FileController.java of the component File Handler. The manipulation leads to improper control of resource identifiers. It is possible to initiate the attack remotely. The complexity of an attack is rather
control of resource identifiers. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.313653 - https://vuldb.com/?ctiid.313653 - https://vuldb.com/?submit.596505 - https://blog.0xd00.com/blog/missing-authorization-leads-to-arbitrary-file-deletion - https://blog.0xd00.com/blog/missing-authorization-leads-to-arbitrary-file-deletion#poc
CVE ID: CVE-2025-6535 State: PUBLISHED Published: 2025-06-24T01:00:20.961Z Last Updated: 2025-06-24T13:31:39.305Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: xxyopen, 201206030 Products: novel-plus Problem Types: CWE-89, CWE-74 Description: A vulnerability has been found in xxyopen/201206030 novel-plus up to 5.1.3 and classified as critical. This vulnerability affects the function list of the file novel-admin/src/main/resources/mybatis/system/UserMapper.xml of the component User Management Module. The manipulation of the argument sort/order leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be
r leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.313654 - https://vuldb.com/?ctiid.313654 - https://vuldb.com/?submit.596573 - https://blog.0xd00.com/blog/sqli-in-user-list-leads-to-sensitive-data-disclosure - https://blog.0xd00.com/blog/sqli-in-user-list-leads-to-sensitive-data-disclosure#poc
CVE ID: CVE-2025-6536 State: PUBLISHED Published: 2025-06-24T01:31:06.497Z Last Updated: 2025-06-24T15:40:36.752Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R) Vendors: n/a Products: Tarantool Problem Types: CWE-617 Description: A vulnerability has been found in Tarantool up to 3.3.1 and classified as problematic. Affected by this vulnerability is the function tm_to_datetime in the library src/lib/core/datetime.c. The manipulation leads to reachable assertion. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.313663 - htt
lic and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.313663 - https://vuldb.com/?ctiid.313663 - https://vuldb.com/?submit.597454 - https://github.com/tarantool/tarantool/issues/11347 - https://github.com/user-attachments/files/19613858/tarantool_crash.txt
CVE ID: CVE-2025-6537 State: PUBLISHED Published: 2025-06-26T02:22:21.320Z Last Updated: 2025-06-26T13:24:07.247Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: mdesignfa Products: Namasha By Mdesign Problem Types: CWE-79 Description: The Namasha By Mdesign plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘playicon_title’ parameter in all versions up to, and including, 1.2.00 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additi
and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/3f7616d0-7b42-4b2e-8378-18c24c7bf22b?source=cve - https://wordpress.org/plugins/namasha-by-mdesign/#developers
CVE ID: CVE-2025-6538 State: PUBLISHED Published: 2025-06-26T02:06:32.835Z Last Updated: 2025-06-27T14:52:48.591Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: bourgesloic Products: Post Rating and Review Problem Types: CWE-79 Description: The Post Rating and Review plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘class’ parameter in all versions up to, and including, 1.3.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additi
and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/12a89b8f-554c-4d92-adb2-ec84138d568d?source=cve - https://wordpress.org/plugins/post-rating-and-review/#developers
CVE ID: CVE-2025-6539 State: PUBLISHED Published: 2025-07-24T09:22:20.169Z Last Updated: 2025-07-24T13:14:20.966Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: minutemedia Products: Voltax Video Player Problem Types: CWE-79 Description: The Voltax Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ parameter in all versions up to, and including, 1.6.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Anal
e, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/babc2e50-27a5-413b-8611-0e9e9db33deb?source=cve - https://wordpress.org/plugins/voltax-video-player/#developers
CVE ID: CVE-2025-6540 State: PUBLISHED Published: 2025-06-26T02:22:23.361Z Last Updated: 2025-06-26T13:03:29.563Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: murtuzamakda52 Products: web-cam Problem Types: CWE-79 Description: The web-cam plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘slug’ parameter in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP
y web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d2d2954c-762c-4bdc-8469-7fe19f4e980d?source=cve - https://wordpress.org/plugins/web-cam/#developers
CVE ID: CVE-2025-6541 State: PUBLISHED Published: 2025-10-21T00:21:42.535Z Last Updated: 2025-10-21T13:57:51.728Z Vendors: TP-Link Systems Inc. Products: Omada gateways, Festa gateways, Omada Pro gateways Problem Types: CWE-78 Description: An arbitrary OS command may be executed on the product by the user who can log in to the web management interface. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.omadanetworks.com/en/document/108455/ - https://www.omadanetworks.com/us/business-networking/all-omada-router/ - https://www.omadanetworks.com/us/business-networking/omada-pro-router-wired-router/ - https://www.tp-link.com/us/business-networking/soho-festa-gateway
s/business-networking/omada-pro-router-wired-router/ - https://www.tp-link.com/us/business-networking/soho-festa-gateway/
CVE ID: CVE-2025-6542 State: PUBLISHED Published: 2025-10-21T00:23:08.908Z Last Updated: 2025-10-21T14:15:13.774Z Vendors: TP-Link Systems Inc. Products: Omada gateways, Festa gateways, Omada Pro gateways Problem Types: CWE-78 Description: An arbitrary OS command may be executed on the product by a remote unauthenticated attacker. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.omadanetworks.com/en/document/108455/ - https://www.omadanetworks.com/us/business-networking/all-omada-router/ - https://www.omadanetworks.com/us/business-networking/omada-pro-router-wired-router/ - https://www.tp-link.com/us/business-networking/soho-festa-gateway/
CVE ID: CVE-2025-6543 State: PUBLISHED Published: 2025-06-25T12:49:57.896Z Last Updated: 2025-10-21T22:45:23.800Z Vendors: NetScaler Products: ADC, Gateway Problem Types: CWE-119 Description: Memory overflow vulnerability leading to unintended control flow and Denial of Service in NetScaler ADC and NetScaler Gateway when configured as Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX694788
CVE ID: CVE-2025-6544 State: PUBLISHED Published: 2025-09-21T09:00:09.724Z Last Updated: 2025-09-22T17:23:25.409Z Severity: CRITICAL (CVSS 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: h2oai Products: h2oai/h2o-3 Problem Types: CWE-502 Description: A deserialization vulnerability exists in h2oai/h2o-3 versions <= 3.46.0.8, allowing attackers to read arbitrary system files and execute arbitrary code. The vulnerability arises from improper handling of JDBC connection parameters, which can be exploited by bypassing regular expression checks and using double URL encoding. This issue impacts all users of the affected versions. Additional Analyst Notes: - CISA ADP Vulnrichment: Refere
coding. This issue impacts all users of the affected versions. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/53f35a0f-d644-4f82-93aa-89fe7e0aed40 - https://github.com/h2oai/h2o-3/commit/0298ee348f5c73673b7b542158081e79605f5f25
CVE ID: CVE-2025-6545 State: PUBLISHED Published: 2025-06-23T18:41:18.771Z Last Updated: 2025-06-23T19:26:40.223Z Problem Types: CWE-20 Description: Improper Input Validation vulnerability in pbkdf2 allows Signature Spoofing by Improper Validation. This vulnerability is associated with program files lib/to-buffer.Js. This issue affects pbkdf2: from 3.0.10 through 3.1.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/browserify/pbkdf2/security/advisories/GHSA-h7cp-r72f-jxh6 - https://github.com/browserify/pbkdf2/commit/9699045c37a07f8319cfb8d44e2ff4252d7a7078 - https://github.com/browserify/pbkdf2/commit/e3102a8cd4830a3ac85cd0dd011cc002fdde33bb
CVE ID: CVE-2025-6546 State: PUBLISHED Published: 2025-06-26T02:22:22.604Z Last Updated: 2025-06-26T13:23:12.904Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: azumbro Products: Drive Folder Embedder Problem Types: CWE-79 Description: The Drive Folder Embedder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘tablecssclass’ parameter in all versions up to, and including, 1.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Addi
ss and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/86b21472-6a76-4d7b-84ff-f8b79c052aba?source=cve - https://wordpress.org/plugins/drive-folder-embeder/#developers
CVE ID: CVE-2025-6547 State: PUBLISHED Published: 2025-06-23T19:00:45.472Z Last Updated: 2025-06-23T19:25:00.846Z Problem Types: CWE-20 Description: Improper Input Validation vulnerability in pbkdf2 allows Signature Spoofing by Improper Validation.This issue affects pbkdf2: <=3.1.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/browserify/pbkdf2/security/advisories/GHSA-v62p-rq8g-8h59 - https://github.com/browserify/pbkdf2/commit/e3102a8cd4830a3ac85cd0dd011cc002fdde33bb