Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-8388 State: PUBLISHED Published: 2025-09-10T04:22:37.666Z Last Updated: 2025-09-10T13:03:20.716Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: ideaboxcreations Products: PowerPack Elementor Addons (Free Widgets, Extensions and Templates) Problem Types: CWE-79 Description: The PowerPack Elementor Addons (Free Widgets, Extensions and Templates) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘cursor_url’ parameter in all versions up to, and including, 2.9.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to injec
d output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/3cd8bed0-fcfe-4927-b393-ddabbe8c3e6b?source=cve - https://plugins.trac.wordpress.org/browser/powerpack-lite-for-elementor/trunk/extensions/custom-cursor.php#L402 - https://plugins.trac.wordpress.org/changeset/3357005/
CVE ID: CVE-2025-8391 State: PUBLISHED Published: 2025-08-02T08:24:48.161Z Last Updated: 2025-08-04T13:39:10.041Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: awssoft Products: Magic Edge – Lite Problem Types: CWE-79 Description: The Magic Edge – Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘height’ parameter in all versions up to, and including, 1.1.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst
o inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/fe456de4-4bf3-45aa-938d-8d4561fac44e?source=cve - https://plugins.svn.wordpress.org/magic-edge-lite-image-background-remover/tags/1.1.6/MagicEdgeFrontend.php - https://wordpress.org/plugins/magic-edge-lite-image-background-remover/#developers
CVE ID: CVE-2025-8392 State: PUBLISHED Published: 2025-09-11T07:24:57.220Z Last Updated: 2025-09-11T14:38:43.849Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: bessermitfahren Products: Mitfahrgelegenheit Problem Types: CWE-79 Description: The Mitfahrgelegenheit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘date’ parameter in all versions up to, and including, 1.1.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional
above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/9cd819c2-45ab-4e0d-b29a-d92722db7164?source=cve - https://plugins.svn.wordpress.org/mitfahrgelegenheit/tags/v1.1.5/mitfahrgelegenheit.php - https://wordpress.org/plugins/mitfahrgelegenheit/#developers
CVE ID: CVE-2025-8393 State: PUBLISHED Published: 2025-08-08T16:23:19.199Z Last Updated: 2025-08-08T19:14:14.004Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N) Vendors: Dreame Technology Products: Dreamehome iOS app, Dreamehome Android app, MOVAhome iOS app Problem Types: CWE-295 Description: A TLS vulnerability exists in the phone application used to manage a connected device. The phone application accepts self-signed certificates when establishing TLS communication which may result in man-in-the-middle attacks on untrusted networks. Captured communications may include user credentials and sensitive session tokens. Additional Analyst Notes: - CISA ADP Vulnrichment:
nications may include user credentials and sensitive session tokens. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-25-219-06 - https://support.dreametech.com/hc/en-us
CVE ID: CVE-2025-8394 State: PUBLISHED Published: 2025-09-17T01:49:14.947Z Last Updated: 2025-09-17T13:17:19.241Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: productiveminds Products: Productive Style – Optimisations & Content Publishing Support Problem Types: CWE-79 Description: The Productive Style plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's display_productive_breadcrumb shortcode in all versions up to, and including, 1.1.23 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject a
ied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/358a1a87-a87c-41b9-addc-d4945cd8fb40?source=cve - https://plugins.svn.wordpress.org/productive-style/tags/1.1.23/includes/common/module/breadcrumb.php - https://wordpress.org/plugins/productive-style/#developers - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3341842%40productive-style&new=3341842%40productive-style&sfp_email=&sf
rg/changeset?sfp_email=&sfph_mail=&reponame=&old=3341842%40productive-style&new=3341842%40productive-style&sfp_email=&sfph_mail=
CVE ID: CVE-2025-8395 State: REJECTED Published: N/A Last Updated: 2025-08-12T22:19:07.161Z Description: No description available.
CVE ID: CVE-2025-8396 State: PUBLISHED Published: 2025-09-15T14:13:26.507Z Last Updated: 2025-09-15T14:52:27.444Z Vendors: Temporal Products: OSS Server Problem Types: CWE-770 Description: Insufficiently specific bounds checking on authorization header could lead to denial of service in the Temporal server on all platforms due to excessive memory allocation.This issue affects all platforms and versions of OSS Server prior to 1.26.3, 1.27.3, and 1.28.1 (i.e., fixed in 1.26.3, 1.27.3, and 1.28.1 and later). Temporal Cloud services are not impacted. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/temporalio/temporal/releases/tag/v1.26.3 - https://github.com/t
CISA ADP Vulnrichment: References: - https://github.com/temporalio/temporal/releases/tag/v1.26.3 - https://github.com/temporalio/temporal/releases/tag/v1.27.3 - https://github.com/temporalio/temporal/releases/tag/v1.28.1
CVE ID: CVE-2025-8397 State: PUBLISHED Published: 2025-11-13T08:27:46.825Z Last Updated: 2025-11-13T19:17:43.024Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: restpack Products: Save as PDF Button Problem Types: CWE-79 Description: The Save as PDF Button plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's restpackpdfbutton shortcode in all versions up to, and including, 1.9.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a us
ckers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/2c648fca-c36f-41a0-9d29-3f669f3669d9?source=cve - https://plugins.svn.wordpress.org/save-as-pdf/trunk/save-as-pdf.php - https://wordpress.org/plugins/save-as-pdf/#developers
CVE ID: CVE-2025-8398 State: PUBLISHED Published: 2025-09-11T07:25:03.105Z Last Updated: 2025-09-11T14:36:57.156Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: azurecurve Products: azurecurve BBCode Problem Types: CWE-79 Description: The azurecurve BBCode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'url' shortcode in all versions up to, and including, 2.0.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses
contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f4eb61dd-f28e-4d8a-8f97-958b6a356309?source=cve - https://plugins.svn.wordpress.org/azurecurve-bbcode/tags/2.0.4/azurecurve-bbcode.php - https://wordpress.org/plugins/azurecurve-bbcode/#developers
CVE ID: CVE-2025-8399 State: PUBLISHED Published: 2025-08-02T08:24:46.584Z Last Updated: 2025-08-04T13:43:32.614Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: mmanifesto Products: Mmm Unity Loader Problem Types: CWE-79 Description: The Mmm Unity Loader plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘attributes’ parameter in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analy
, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/2cee1d75-278c-45c6-915d-60aae6a4d3a2?source=cve - https://plugins.svn.wordpress.org/mmm-unity-loader/trunk/mmm-unity-loader.php - https://wordpress.org/plugins/mmm-unity-loader/#developers
CVE ID: CVE-2025-8400 State: PUBLISHED Published: 2025-08-02T08:24:47.582Z Last Updated: 2025-08-04T13:39:34.651Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: aumsrini Products: Image Gallery Problem Types: CWE-79 Description: The Image Gallery plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com
er accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ef52026b-1bfc-481c-8eb7-511d1910a35e?source=cve - https://plugins.svn.wordpress.org/bee-quick-gallery/trunk/includes/bee-quick-gallery-functions.php - https://wordpress.org/plugins/bee-quick-gallery/#developers
CVE ID: CVE-2025-8401 State: PUBLISHED Published: 2025-07-31T11:19:12.771Z Last Updated: 2025-07-31T14:09:28.317Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: devitemsllc Products: HT Mega – Absolute Addons For Elementor Problem Types: CWE-285 Description: The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.9.1 via the 'get_post_data' function. This makes it possible for authenticated attackers, with Author-level access and above, to extract sensitive data including the content of private, password-protected, and draft posts and pages. Additional Analyst N
act sensitive data including the content of private, password-protected, and draft posts and pages. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/9540b339-3386-4ee8-8141-acb9f3d83772?source=cve - https://plugins.trac.wordpress.org/browser/ht-mega-for-elementor/tags/2.9.1/htmega-blocks/includes/classes/Manage_Styles.php#L99 - https://plugins.trac.wordpress.org/changeset/3336533/
CVE ID: CVE-2025-8402 State: PUBLISHED Published: 2025-08-21T17:01:43.420Z Last Updated: 2025-08-21T17:30:38.422Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H) Vendors: Mattermost Products: Mattermost Problem Types: CWE-1287, CWE-476 Description: Mattermost versions 10.8.x <= 10.8.3, 10.5.x <= 10.5.8, 9.11.x <= 9.11.17, 10.10.x <= 10.10.0, 10.9.x <= 10.9.3 fail to validate import data which allows a system admin to crash the server via the bulk import feature. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://mattermost.com/security-updates
CVE ID: CVE-2025-8404 State: PUBLISHED Published: 2025-11-18T07:43:15.191Z Last Updated: 2025-11-19T16:49:08.007Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H) Vendors: SMCI Products: MBD-X13SEDW-F Problem Types: CWE-121 Description: Stack buffer overflow vulnerability exists in the Supermicro BMC Shared library. An authenticated attacker with access to the BMC exploit stack buffer via a crafted header and achieve arbitrary code execution of the BMC’s firmware operating system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.supermicro.com/zh_tw/support/security_BMC_IPMI_Nov_2025
CVE ID: CVE-2025-8406 State: PUBLISHED Published: 2025-10-05T09:00:36.838Z Last Updated: 2025-10-06T14:16:06.622Z Severity: MEDIUM (CVSS 6.3 CVSS:3.0/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H) Vendors: zenml-io Products: zenml-io/zenml Problem Types: CWE-22 Description: ZenML version 0.83.1 is affected by a path traversal vulnerability in the `PathMaterializer` class. The `load` function uses `is_path_within_directory` to validate files during `data.tar.gz` extraction, which fails to effectively detect symbolic and hard links. This vulnerability can lead to arbitrary file writes, potentially resulting in arbitrary command execution if critical files are overwritten. Additional Analyst Notes: - CIS
potentially resulting in arbitrary command execution if critical files are overwritten. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/a0880d64-9928-45bf-9663-2cd81582d9e7 - https://github.com/zenml-io/zenml/commit/5d22a48d7bf6c7f10b748577c2be79cc7969d398
CVE ID: CVE-2025-8407 State: PUBLISHED Published: 2025-07-31T14:02:05.917Z Last Updated: 2025-07-31T14:16:40.311Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: Vehicle Management Problem Types: CWE-89, CWE-74 Description: A vulnerability, which was classified as critical, has been found in code-projects Vehicle Management 1.0. This issue affects some unknown processing of the file /filter2.php. The manipulation of the argument from leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/
losed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.318395 - https://vuldb.com/?ctiid.318395 - https://vuldb.com/?submit.624009 - https://github.com/wllovemy/cve/issues/3 - https://code-projects.org/
CVE ID: CVE-2025-8408 State: PUBLISHED Published: 2025-07-31T15:02:05.653Z Last Updated: 2025-07-31T20:07:31.662Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: Vehicle Management Problem Types: CWE-89, CWE-74 Description: A vulnerability, which was classified as critical, was found in code-projects Vehicle Management 1.0. Affected is an unknown function of the file /filter1.php. The manipulation of the argument vehicle leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.3
to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.318396 - https://vuldb.com/?ctiid.318396 - https://vuldb.com/?submit.624010 - https://github.com/wllovemy/cve/issues/2 - https://code-projects.org/
CVE ID: CVE-2025-8409 State: PUBLISHED Published: 2025-07-31T15:32:06.674Z Last Updated: 2025-07-31T16:06:28.458Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: Vehicle Management Problem Types: CWE-89, CWE-74 Description: A vulnerability has been found in code-projects Vehicle Management 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /filter.php. The manipulation of the argument from leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuld
n disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.318397 - https://vuldb.com/?ctiid.318397 - https://vuldb.com/?submit.624011 - https://github.com/wllovemy/cve/issues/1 - https://code-projects.org/
CVE ID: CVE-2025-8410 State: PUBLISHED Published: 2025-09-23T17:52:26.769Z Last Updated: 2025-09-23T18:36:51.356Z Vendors: RTI Products: Connext Professional Problem Types: CWE-416 Description: Use After Free vulnerability in RTI Connext Professional (Security Plugins) allows File Manipulation.This issue affects Connext Professional: from 7.5.0 before 7.6.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.rti.com/vulnerabilities/#cve-2025-8410
CVE ID: CVE-2025-8411 State: PUBLISHED Published: 2025-09-17T11:17:57.500Z Last Updated: 2025-09-17T13:06:28.627Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Dokuzsoft Technology Products: E-Commerce Web Design Product Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Dokuzsoft Technology E-Commerce Web Design Product allows XSS Through HTTP Headers.This issue affects E-Commerce Web Design Product: before 11.08.2025. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-25-0267
CVE ID: CVE-2025-8413 State: PUBLISHED Published: 2025-10-25T05:31:18.515Z Last Updated: 2025-10-27T15:46:49.140Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: purethemes Products: Listeo - Directory & Listings With Booking - WordPress Theme Problem Types: CWE-79 Description: The Listeo theme for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `soundcloud` shortcode in version less than, or equal to, 2.0.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that wil
for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/17301be2-f2bc-4b59-b0ab-65591ffcfa3e?source=cve - https://themeforest.net/item/listeo-directory-listings-wordpress-theme/23239259
CVE ID: CVE-2025-8414 State: PUBLISHED Published: 2025-10-17T16:02:55.583Z Last Updated: 2025-10-17T17:20:32.188Z Vendors: silabs.com Products: Simplicity SDK, Gecko SDK Problem Types: CWE-20 Description: Due to improper input validation, a buffer overflow vulnerability is present in Zigbee EZSP Host Applications. If the buffer overflows, stack corruption is possible. In certain conditions, this could lead to arbitrary code execution. Access to a network key is required to exploit this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://community.silabs.com/068Vm00000WJZED
CVE ID: CVE-2025-8415 State: PUBLISHED Published: 2025-08-20T16:14:33.566Z Last Updated: 2025-11-20T20:59:58.255Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N) Vendors: Red Hat Products: Cryostat 4 on RHEL 9, Cryostat 4 Problem Types: CWE-289 Description: A vulnerability was found in the Cryostat HTTP API. Cryostat's HTTP API binds to all network interfaces, allowing possible external visibility and access to the API port if Network Policies are disabled, allowing an unauthenticated, malicious attacker to jeopardize the environment. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.redhat.com/errata/RHSA-2025:14919 - https://access.red
lyst Notes: - CISA ADP Vulnrichment: References: - https://access.redhat.com/errata/RHSA-2025:14919 - https://access.redhat.com/security/cve/CVE-2025-8415 - https://bugzilla.redhat.com/show_bug.cgi?id=2385773
CVE ID: CVE-2025-8416 State: PUBLISHED Published: 2025-10-25T06:49:24.974Z Last Updated: 2025-10-27T15:35:36.633Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: woobewoo Products: Product Filter by WBW Problem Types: CWE-89 Description: The Product Filter by WBW plugin for WordPress is vulnerable to SQL Injection via the 'filtersDataBackend' parameter in all versions up to, and including, 2.9.7. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to ex
ible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d1533e9a-dcb9-4fbb-a1a7-7f4dafd3a1c8?source=cve - https://plugins.trac.wordpress.org/browser/woo-product-filter/tags/2.8.6/modules/woofilters/mod.php#L2056 - https://plugins.trac.wordpress.org/browser/woo-product-filter/tags/2.8.6/modules/woofilters/controller.php#L136 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3370655%40woo-product-filter&new=3370655%40woo-product-fi
ac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3370655%40woo-product-filter&new=3370655%40woo-product-filter&sfp_email=&sfph_mail=
CVE ID: CVE-2025-8417 State: PUBLISHED Published: 2025-09-11T07:24:52.519Z Last Updated: 2025-09-11T14:40:32.368Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: idiatech Products: Catalog Importer, Scraper & Crawler Problem Types: CWE-94 Description: The Catalog Importer, Scraper & Crawler plugin for WordPress is vulnerable to PHP code injection in all versions up to, and including, 5.1.4. This is due to reliance on a guessable numeric token (e.g. ?key= 900001705) without proper authentication, combined with the unsafe use of eval() on user-supplied input. This makes it possible for unauthenticated attackers to execute arbitrary PHP code on the server via a f