Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-0950 State: PUBLISHED Published: 2025-02-01T20:00:12.431Z Last Updated: 2025-02-03T17:14:33.848Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: itsourcecode Products: Tailoring Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in itsourcecode Tailoring Management System 1.0 and classified as critical. This issue affects some unknown processing of the file staffview.php. The manipulation of the argument staffid leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.294305
e public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.294305 - https://vuldb.com/?ctiid.294305 - https://github.com/magic2353112890/cve/issues/7 - https://itsourcecode.com/
CVE ID: CVE-2025-0951 State: PUBLISHED Published: 2025-08-28T03:42:43.495Z Last Updated: 2025-08-28T14:18:21.398Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: LiquidThemes Products: AI Hub - Startup & Technology WordPress Theme, Hub - Responsive Multi-Purpose WordPress Theme, ArcHub - Architecture and Interior Design WordPress Theme Problem Types: CWE-862 Description: Multiple plugins and/or themes for WordPress by LiquidThemes are vulnerable to unauthorized access due to a missing capability check on the liquid_reset_wordpress_before AJAX in various versions. This makes it possible for authenticated attackers, with Subscriber-level access and above, to d
AX in various versions. This makes it possible for authenticated attackers, with Subscriber-level access and above, to deactivate all of a site's plugins. While we escalated this to Envato after not being able to establish contact, it appears the developer added a nonce check, however that is not sufficient protection as the nonce is exposed to all users with access to the dashboard. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/0099c700-e1af-4d97-a518-151a9139ea35?source=cve - https://themeforest.net/user/liquidthemes
CVE ID: CVE-2025-0952 State: PUBLISHED Published: 2025-03-14T05:24:03.281Z Last Updated: 2025-03-14T13:33:18.039Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) Vendors: cmsmasters Products: Eco Nature - Environment & Ecology WordPress Theme Problem Types: CWE-862 Description: The Eco Nature - Environment & Ecology WordPress Theme theme for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to a missing capability check on the 'cmsmasters_hide_admin_notice' AJAX action in all versions up to, and including, 2.0.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update opti
uding, 2.0.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update option values to 'hide' on the WordPress site. This can be leveraged to update an option that would create an error on the site and deny service to legitimate users or be used to set some values to true such as registration. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ba708a4f-d987-4d63-a218-2ed1c6daa010?source=cve - https://themeforest.net/item/eco-nature-environment-ecology-wordpress-theme/8497776
CVE ID: CVE-2025-0953 State: PUBLISHED Published: 2025-02-22T12:39:21.934Z Last Updated: 2025-02-24T12:50:51.828Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: yaycommerce Products: SMTP for Sendinblue – YaySMTP Problem Types: CWE-79 Description: The SMTP for Sendinblue – YaySMTP plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.1.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: -
will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e7ba65ac-e568-4c13-961d-6453f281d9fc?source=cve - https://wordpress.org/plugins/smtp-sendinblue/#developers - https://plugins.trac.wordpress.org/browser/smtp-sendinblue/trunk/includes/Helper/Utils.php - https://plugins.trac.wordpress.org/browser/smtp-sendinblue/trunk/includes/Functions.php - https://plugins.trac.wordpress.org/changeset/3234379/
CVE ID: CVE-2025-0954 State: PUBLISHED Published: 2025-03-05T09:21:47.168Z Last Updated: 2025-03-05T14:22:38.971Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: futuredesigngrp Products: WP Online Contract Problem Types: CWE-862 Description: The WP Online Contract plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the json_import() and json_export() functions in all versions up to, and including, 5.1.4. This makes it possible for unauthenticated attackers to import and export the plugin's settings. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabiliti
s. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/70f464ca-ff6c-4c2e-8b56-bf5e4bc6bd1f?source=cve - https://codecanyon.net/item/wp-online-contract/7698011
CVE ID: CVE-2025-0955 State: PUBLISHED Published: 2025-03-14T04:22:34.484Z Last Updated: 2025-03-14T13:46:39.891Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: beeteam368 Products: VidoRev Extensions Problem Types: CWE-862 Description: The VidoRev Extensions plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the 'vidorev_import_single_video' AJAX action in all versions up to, and including, 2.9.9.9.9.9.5. This makes it possible for unauthenticated attackers to import arbitrary youtube videos. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id
ditional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e8c15662-e4df-4a74-bb01-266eeb4879c5?source=cve - https://themeforest.net/item/vidorev-video-wordpress-theme/21798615
CVE ID: CVE-2025-0956 State: PUBLISHED Published: 2025-03-05T09:21:43.592Z Last Updated: 2025-03-05T15:01:42.954Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: FantasticPlugins Products: WooCommerce Recover Abandoned Cart Problem Types: CWE-20 Description: The WooCommerce Recover Abandoned Cart plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 24.3.0 via deserialization of untrusted input from the 'raccookie_guest_email' cookie. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless
HP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/067c974c-b3bb-4f06-8f7c-3963112c40d2?source=cve - https://codecanyon.net/item/woocommerce-recover-abandoned-cart/7715167
CVE ID: CVE-2025-0957 State: PUBLISHED Published: 2025-02-22T13:45:13.163Z Last Updated: 2025-02-24T12:48:08.070Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: yaycommerce Products: SMTP for Amazon SES – YaySMTP Problem Types: CWE-79 Description: The SMTP for Amazon SES – YaySMTP plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.7.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: -
will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f6424fc9-f118-4654-89a7-1f7e6efa2c02?source=cve - https://plugins.trac.wordpress.org/browser/smtp-amazon-ses/trunk/includes/Functions.php - https://wordpress.org/plugins/smtp-amazon-ses/#developers - https://plugins.trac.wordpress.org/browser/smtp-amazon-ses/trunk/includes/Helper/Utils.php - https://plugins.trac.wordpress.org/changeset/3234351/
CVE ID: CVE-2025-0958 State: PUBLISHED Published: 2025-03-04T09:22:36.847Z Last Updated: 2025-03-04T14:22:18.162Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: nitesh_singh Products: Ultimate WordPress Auction Plugin Problem Types: CWE-20 Description: The Ultimate WordPress Auction Plugin plugin for WordPress is vulnerable to unauthorized access to functionality in all versions up to, and including, 4.2.9. This makes it possible for authenticated attackers, with Contributor-level access and above, to delete arbitrary auctions, posts as well as pages and allows them to execute other actions related to auction handling. Additional Analyst Notes: - CISA ADP V
ll as pages and allows them to execute other actions related to auction handling. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/af3675c9-3a6b-4139-85e8-2fc57f290e82?source=cve - https://plugins.trac.wordpress.org/browser/ultimate-auction/trunk/ultimate-auction.php#L274 - https://plugins.trac.wordpress.org/browser/ultimate-auction/trunk/ultimate-auction.php#L219 - https://plugins.trac.wordpress.org/browser/ultimate-auction/trunk/ajax-actions/send-private-msg.php#L35 - https://plugins.trac.wordpress.org/changeset/3242416/ultimate-auction/trunk/ultimate-auction.php
CVE ID: CVE-2025-0959 State: PUBLISHED Published: 2025-03-07T08:21:27.417Z Last Updated: 2025-03-07T15:10:00.432Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: imithemes Products: Eventer - WordPress Event & Booking Manager Plugin Problem Types: CWE-564 Description: The Eventer - WordPress Event & Booking Manager Plugin plugin for WordPress is vulnerable to SQL Injection via the reg_id parameter in all versions up to, and including, 3.9.9.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to appe
existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/bd42c89e-57db-458f-910c-404a5615f280?source=cve - https://codecanyon.net/item/eventer-wordpress-event-manager-plugin/20972534
CVE ID: CVE-2025-0960 State: PUBLISHED Published: 2025-02-04T19:34:25.961Z Last Updated: 2025-02-04T19:50:52.268Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: AutomationDirect Products: C-more EA9 HMI EA9-T6CL, C-more EA9 HMI EA9-T7CL-R, C-more EA9 HMI EA9-T7CL, C-more EA9 HMI EA9-T8CL, C-more EA9 HMI EA9-T10CL, C-more EA9 HMI EA9-T10WCL, C-more EA9 HMI EA9-T12CL, C-more EA9 HMI EA9-T15CL-R, C-more EA9 HMI EA9-T15CL, C-more EA9 HMI EA9-RHMI Problem Types: CWE-120 Description: AutomationDirect C-more EA9 HMI contains a function with bounds checks that can be skipped, which could result in an attacker abusing the function to cause a denial-of-service cond
nds checks that can be skipped, which could result in an attacker abusing the function to cause a denial-of-service condition or achieving remote code execution on the affected device. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-25-035-08 - https://community.automationdirect.com/s/cybersecurity/security-advisories
CVE ID: CVE-2025-0961 State: PUBLISHED Published: 2025-02-01T22:31:05.284Z Last Updated: 2025-02-12T20:41:38.871Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: code-projects Products: Job Recruitment Problem Types: CWE-79, CWE-94 Description: A vulnerability, which was classified as problematic, has been found in code-projects Job Recruitment 1.0. Affected by this issue is some unknown functionality of the file /_parse/load_job-details.php. The manipulation of the argument business_stream_name/company_website_url leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP V
launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.294356 - https://vuldb.com/?ctiid.294356 - https://vuldb.com/?submit.491789 - https://github.com/J0hnFFFF/j0hn_upload_one/blob/main/xss.pdf - https://code-projects.org/
CVE ID: CVE-2025-0966 State: PUBLISHED Published: 2025-06-25T02:40:39.889Z Last Updated: 2025-08-24T11:41:45.088Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L) Vendors: IBM Products: InfoSphere Information Server Problem Types: CWE-89 Description: IBM InfoSphere Information Server 11.7 vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7236613
CVE ID: CVE-2025-0967 State: PUBLISHED Published: 2025-02-02T15:31:04.414Z Last Updated: 2025-02-12T20:41:38.730Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: code-projects Products: Chat System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in code-projects Chat System 1.0 and classified as critical. This issue affects some unknown processing of the file /user/add_chatroom.php. The manipulation of the argument chatname/chatpass leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.294359 - https://v
d may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.294359 - https://vuldb.com/?ctiid.294359 - https://vuldb.com/?submit.492911 - https://github.com/Team-intN18-SoybeanSeclab/CVE/blob/main/sqlinject1.md - https://code-projects.org/
CVE ID: CVE-2025-0968 State: PUBLISHED Published: 2025-02-19T11:10:39.448Z Last Updated: 2025-02-19T14:37:10.760Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: xpeedstudio Products: ElementsKit Elementor addons Problem Types: CWE-284 Description: The ElementsKit Elementor addons plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.4.0 due to a missing capability checks on the get_megamenu_content() function. This makes it possible for unauthenticated attackers to view any item created in Elementor, such as posts, pages and templates including drafts, trashed and private items. Additional Analyst Notes
d in Elementor, such as posts, pages and templates including drafts, trashed and private items. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/432ac3b1-8f1d-442f-8e8d-62a1f26ba259?source=cve - https://plugins.trac.wordpress.org/browser/elementskit-lite/trunk/modules/megamenu/api.php#L47 - https://wordpress.org/plugins/elementskit-lite/#developers - https://plugins.trac.wordpress.org/changeset/3237243/
CVE ID: CVE-2025-0970 State: PUBLISHED Published: 2025-02-02T23:00:13.554Z Last Updated: 2025-02-12T20:41:38.570Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N) Vendors: Zenvia Products: Movidesk Problem Types: CWE-601 Description: A vulnerability was found in Zenvia Movidesk up to 25.01.22. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /Account/Login. The manipulation of the argument ReturnUrl leads to open redirect. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 25.01.22.245a473c54 is able to address this issue. It is recommended to upgrade the affected
used. Upgrading to version 25.01.22.245a473c54 is able to address this issue. It is recommended to upgrade the affected component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.294361 - https://vuldb.com/?ctiid.294361 - https://vuldb.com/?submit.485985
CVE ID: CVE-2025-0971 State: PUBLISHED Published: 2025-02-02T23:31:03.808Z Last Updated: 2025-02-12T20:41:38.405Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: Zenvia Products: Movidesk Problem Types: CWE-79, CWE-94 Description: A vulnerability was found in Zenvia Movidesk up to 25.01.22. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /Account/EditProfile of the component Profile Editing. The manipulation of the argument username leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 25.01.22.245a473c54 is able to address this issue.
as been disclosed to the public and may be used. Upgrading to version 25.01.22.245a473c54 is able to address this issue. It is recommended to upgrade the affected component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.294362 - https://vuldb.com/?ctiid.294362 - https://vuldb.com/?submit.486023
CVE ID: CVE-2025-0972 State: PUBLISHED Published: 2025-02-03T00:00:12.149Z Last Updated: 2025-02-12T20:41:37.794Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: Zenvia Products: Movidesk Problem Types: CWE-79, CWE-94 Description: A vulnerability classified as problematic has been found in Zenvia Movidesk up to 25.01.22. This affects an unknown part of the component New Ticket Handler. The manipulation of the argument subject leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 25.01.22.245a473c54 is able to address this issue. It is recommended to upgrade the affected comp
. Upgrading to version 25.01.22.245a473c54 is able to address this issue. It is recommended to upgrade the affected component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.294363 - https://vuldb.com/?ctiid.294363 - https://vuldb.com/?submit.488106 - https://github.com/yago3008/cves/blob/main/Moviedesk%20-%20Stored%20Cross%20Site%20Script%20On%20Create%20TIcket%20Field.pdf
CVE ID: CVE-2025-0973 State: PUBLISHED Published: 2025-02-03T00:31:04.880Z Last Updated: 2025-02-12T20:41:37.613Z Severity: N/A (CVSS 5.5 AV:N/AC:L/Au:S/C:N/I:P/A:P) Vendors: n/a Products: CmsEasy Problem Types: CWE-22 Description: A vulnerability classified as critical was found in CmsEasy 7.7.7.9. This vulnerability affects the function backAll_action in the library lib/admin/database_admin.php of the file /index.php?case=database&act=backAll&admin_dir=admin&site=default. The manipulation of the argument select[] leads to path traversal. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure b
ly. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.294364 - https://vuldb.com/?ctiid.294364 - https://vuldb.com/?submit.487649 - https://github.com/Sinon2003/cve/blob/main/CmsEasy/CmsEasy-V7.7.7.9%2020240105-Directory%20Traversal.md
CVE ID: CVE-2025-0974 State: PUBLISHED Published: 2025-02-03T01:00:13.487Z Last Updated: 2025-02-12T20:41:37.430Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: MaxD Products: Lightning Module Problem Types: CWE-502, CWE-20 Description: A vulnerability, which was classified as critical, has been found in MaxD Lightning Module 4.43 on OpenCart. This issue affects some unknown processing. The manipulation of the argument li_op/md leads to deserialization. The attack may be initiated remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. Additional Analyst Not
loitation is known to be difficult. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.294365 - https://vuldb.com/?ctiid.294365 - https://vuldb.com/?submit.489672 - https://gist.github.com/mcdruid/f8153d7d535c0fcba920e83a64953d4e
CVE ID: CVE-2025-0975 State: PUBLISHED Published: 2025-02-28T02:20:36.466Z Last Updated: 2025-03-06T04:55:19.503Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: IBM Products: MQ Problem Types: CWE-150 Description: IBM MQ 9.3 LTS, 9.3 CD, 9.4 LTS, and 9.4 CD console could allow an authenticated user to execute code due to improper neutralization of escape characters. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7183467
CVE ID: CVE-2025-0981 State: PUBLISHED Published: 2025-02-18T09:33:54.210Z Last Updated: 2025-02-19T08:37:46.688Z Vendors: ChurchCRM Products: ChurchCRM Problem Types: CWE-287 Description: A vulnerability exists in ChurchCRM 5.13.0 and prior that allows an attacker to hijack a user's session by exploiting a Stored Cross Site Scripting (XSS) vulnerability in the Group Editor page. This allows admin users to inject malicious JavaScript in the description field, which captures the session cookie of authenticated users. The cookie can then be sent to an external server, enabling session hijacking. It can also lead to information disclosure, as exposed session cookies can be used to impersonate u
g session hijacking. It can also lead to information disclosure, as exposed session cookies can be used to impersonate users and gain unauthorised access to sensitive information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ChurchCRM/CRM/issues/7245
CVE ID: CVE-2025-0982 State: PUBLISHED Published: 2025-02-06T11:37:57.460Z Last Updated: 2025-02-12T19:51:10.116Z Vendors: Google Cloud Products: Application Integration Problem Types: CWE-829 Description: Sandbox escape in the JavaScript Task feature of Google Cloud Application Integration allows an actor to execute arbitrary unsandboxed code via crafted JavaScript code executed by the Rhino engine. Effective January 24, 2025, Application Integration will no longer support Rhino as the JavaScript execution engine. No further fix actions are needed. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cloud.google.com/application-integration/docs/release-notes#January_23_
: - CISA ADP Vulnrichment: References: - https://cloud.google.com/application-integration/docs/release-notes#January_23_2025