Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-2409 State: PUBLISHED Published: 2025-05-22T17:35:36.301Z Last Updated: 2025-05-22T18:44:43.463Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: ABB Products: ASPECT-Enterprise, NEXUS Series, MATRIX Series Problem Types: CWE-73 Description: File corruption vulnerabilities in ASPECT provide attackers access to overwrite sys-tem files if session administrator credentials become compromised This issue affects ASPECT-Enterprise: through 3.08.03; NEXUS Series: through 3.08.03; MATRIX Series: through 3.08.03. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://search.abb.com/library/Download.aspx?DocumentID=9AKK108471A0021&L
CVE ID: CVE-2025-2410 State: PUBLISHED Published: 2025-05-22T17:32:35.572Z Last Updated: 2025-05-23T03:39:37.521Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: ABB Products: ASPECT-Enterprise, NEXUS Series, MATRIX Series Problem Types: CWE-99 Description: Port manipulation vulnerabilities in ASPECT provide attackers with the ability to con-trol TCP/IP port access if session administrator credentials become compromised. This issue affects ASPECT-Enterprise: through 3.08.03; NEXUS Series: through 3.08.03; MATRIX Series: through 3.08.03. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://search.abb.com/library/Download.aspx?DocumentID=
CVE ID: CVE-2025-2411 State: PUBLISHED Published: 2025-09-04T08:34:34.583Z Last Updated: 2025-09-04T20:08:23.129Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L) Vendors: Akinsoft Products: TaskPano Problem Types: CWE-307 Description: Improper Restriction of Excessive Authentication Attempts vulnerability in Akinsoft TaskPano allows Authentication Bypass.This issue affects TaskPano: from s1.06.04 before v1.06.06. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-25-0208
CVE ID: CVE-2025-2412 State: PUBLISHED Published: 2025-09-01T12:48:50.980Z Last Updated: 2025-09-02T20:26:50.040Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L) Vendors: Akinsoft Products: QR Menu Problem Types: CWE-307 Description: Improper Restriction of Excessive Authentication Attempts vulnerability in Akinsoft QR Menu allows Authentication Bypass.This issue affects QR Menu: from s1.05.07 before v1.05.12. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-25-0202
CVE ID: CVE-2025-2413 State: PUBLISHED Published: 2025-09-02T13:28:21.556Z Last Updated: 2025-09-02T14:00:41.976Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L) Vendors: Akinsoft Products: ProKuafor Problem Types: CWE-307 Description: Improper Restriction of Excessive Authentication Attempts vulnerability in Akinsoft ProKuafor allows Authentication Bypass.This issue affects ProKuafor: from s1.02.08 before v1.02.08. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-25-0204
CVE ID: CVE-2025-2414 State: PUBLISHED Published: 2025-09-02T11:52:30.213Z Last Updated: 2025-09-02T13:28:42.794Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L) Vendors: Akinsoft Products: OctoCloud Problem Types: CWE-307 Description: Improper Restriction of Excessive Authentication Attempts vulnerability in Akinsoft OctoCloud allows Authentication Bypass.This issue affects OctoCloud: from s1.09.03 before v1.11.01. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-25-0203
CVE ID: CVE-2025-2415 State: PUBLISHED Published: 2025-09-03T08:54:31.583Z Last Updated: 2025-09-03T14:37:26.089Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L) Vendors: Akinsoft Products: MyRezzta Problem Types: CWE-307 Description: Improper Restriction of Excessive Authentication Attempts vulnerability in Akinsoft MyRezzta allows Authentication Bypass.This issue affects MyRezzta: from s2.03.01 before v2.05.01. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-25-0205
CVE ID: CVE-2025-2416 State: PUBLISHED Published: 2025-09-03T13:25:02.837Z Last Updated: 2025-09-03T13:37:08.690Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L) Vendors: Akinsoft Products: LimonDesk Problem Types: CWE-307 Description: Improper Restriction of Excessive Authentication Attempts vulnerability in Akinsoft LimonDesk allows Authentication Bypass.This issue affects LimonDesk: from s1.02.14 before v1.02.17. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-25-0206
CVE ID: CVE-2025-2417 State: PUBLISHED Published: 2025-09-04T07:44:08.515Z Last Updated: 2025-09-04T20:07:02.281Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L) Vendors: Akinsoft Products: e-Mutabakat Problem Types: CWE-307 Description: Improper Restriction of Excessive Authentication Attempts vulnerability in Akinsoft e-Mutabakat allows Authentication Bypass.This issue affects e-Mutabakat: from 2.02.06 before v2.02.06. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-25-0207
CVE ID: CVE-2025-2419 State: PUBLISHED Published: 2025-03-17T22:00:08.554Z Last Updated: 2025-03-18T13:22:33.583Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: code-projects Products: Real Estate Property Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability classified as critical has been found in code-projects Real Estate Property Management System 1.0. Affected is an unknown function of the file /InsertFeedback.php. The manipulation of the argument txtName/txtEmail/txtMobile/txtFeedback leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA AD
h the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.299916 - https://vuldb.com/?ctiid.299916 - https://vuldb.com/?submit.516999 - https://github.com/heiheiworld/cve/blob/main/cve-h.md - https://code-projects.org/
CVE ID: CVE-2025-2420 State: PUBLISHED Published: 2025-03-17T22:31:08.216Z Last Updated: 2025-03-18T13:12:05.123Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N) Vendors: 猫宁i Products: Morning Problem Types: CWE-352, CWE-862 Description: A vulnerability classified as problematic was found in 猫宁i Morning up to bc782730c74ff080494f145cc363a0b4f43f7d3e. Affected by this vulnerability is an unknown functionality. The manipulation leads to cross-site request forgery. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and upda
takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.299917 - https://vuldb.com/?ctiid.299917 - https://vuldb.com/?submit.517009 - https://gitee.com/morning-pro/Morning/issues/IBRVMX
CVE ID: CVE-2025-2421 State: PUBLISHED Published: 2025-05-02T11:27:49.395Z Last Updated: 2025-09-29T17:57:26.575Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Profelis Informatics Products: SambaBox Problem Types: CWE-94 Description: Improper Control of Generation of Code ('Code Injection') vulnerability in Profelis Informatics SambaBox allows Code Injection.This issue affects SambaBox: before 5.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-25-0101 - https://sambabox.io/2025/04/14/version-5-1/
CVE ID: CVE-2025-2422 State: REJECTED Published: N/A Last Updated: 2025-07-05T22:16:38.648Z Description: No description available.
CVE ID: CVE-2025-2424 State: PUBLISHED Published: 2025-04-14T14:49:35.783Z Last Updated: 2025-04-14T15:00:45.367Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Mattermost Products: Mattermost Problem Types: CWE-863 Description: Mattermost versions 10.5.x <= 10.5.1, 9.11.x <= 9.11.9 fail to check if a file has been deleted when creating a bookmark which allows an attacker who knows the IDs of deleted files to obtain metadata of the files via bookmark creation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://mattermost.com/security-updates
CVE ID: CVE-2025-2425 State: PUBLISHED Published: 2025-07-18T09:20:52.051Z Last Updated: 2025-07-18T11:37:03.044Z Vendors: ESET, spol. s.r.o Products: ESET NOD32 Antivirus, ESET Internet Security, ESET Smart Security Premium, ESET Security Ultimate, ESET Endpoint Antivirus for Windows, ESET Endpoint Security for Windows, ESET Small Business Security, ESET Safe Server, ESET Server Security for Windows Server, ESET Mail Security for Microsoft Exchange Server, ESET Security for Microsoft SharePoint Server Problem Types: CWE-367 Description: Time-of-check to time-of-use race condition vulnerability potentially allowed an attacker to use the installed ESET security software to clear the content o
ndition vulnerability potentially allowed an attacker to use the installed ESET security software to clear the content of an arbitrary file on the file system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.eset.com/en/ca8840-eset-customer-advisory-toctou-race-condition-vulnerability-in-eset-products-on-windows-fixed
CVE ID: CVE-2025-2440 State: PUBLISHED Published: 2025-04-09T10:20:57.073Z Last Updated: 2025-04-09T13:49:03.760Z Severity: MEDIUM (CVSS 4.2 CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Schneider Electric Products: Trio Q Licensed Data Radio Problem Types: CWE-922 Description: CWE-922: Insecure Storage of Sensitive Information vulnerability exists that could potentially lead to unauthorized access of confidential data when a malicious user, having physical access and advanced information on the file system, sets the radio in factory default mode. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2025-098-02
t Notes: - CISA ADP Vulnrichment: References: - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2025-098-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2025-098-02.pdf
CVE ID: CVE-2025-2441 State: PUBLISHED Published: 2025-04-09T10:23:45.536Z Last Updated: 2025-04-09T13:40:05.280Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Schneider Electric Products: Trio Q Licensed Data Radio Problem Types: CWE-1188 Description: CWE-1188: Initialization of a Resource with an Insecure Default vulnerability exists that could lead to loss of confidentiality when a malicious user, having physical access, sets the radio in factory default mode where the product does not correctly initialize all data. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2025-098-02&p
Notes: - CISA ADP Vulnrichment: References: - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2025-098-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2025-098-02.pdf
CVE ID: CVE-2025-2442 State: PUBLISHED Published: 2025-04-09T10:26:01.874Z Last Updated: 2025-04-09T13:36:42.766Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Schneider Electric Products: Trio Q Licensed Data Radio Problem Types: CWE-1188 Description: CWE-1188: Initialization of a Resource with an Insecure Default vulnerability exists that could potentially lead to unauthorized access which could result in the loss of confidentially, integrity and availability when a malicious user, having physical access, sets the radio to the factory default mode. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://download.schneider-electric.com/fi
efault mode. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2025-098-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2025-098-02.pdf
CVE ID: CVE-2025-2443 State: PUBLISHED Published: 2025-06-20T17:12:54.738Z Last Updated: 2025-06-20T17:27:26.650Z Severity: HIGH (CVSS 8.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N) Vendors: GitLab Products: GitLab Problem Types: CWE-79 Description: An issue has been discovered in GitLab EE that allows for cross-site-scripting attack and content security policy bypass in a user's browser under specific conditions, affecting all versions from 16.6 before 17.9.7, 17.10 before 17.10.5, and 17.11 before 17.11.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/525363 - https://hackerone.com/reports/3037340
CVE ID: CVE-2025-2448 State: REJECTED Published: N/A Last Updated: 2025-11-15T22:19:22.560Z Description: No description available.
CVE ID: CVE-2025-2449 State: PUBLISHED Published: 2025-03-18T13:18:32.984Z Last Updated: 2025-03-18T13:52:36.096Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: NI Products: FlexLogger Problem Types: CWE-22 Description: NI FlexLogger usiReg URI File Parsing Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to create arbitrary files on affected installations of NI FlexLogger. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of URI files by the usiReg component. The issue results from th
icious file. The specific flaw exists within the parsing of URI files by the usiReg component. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-21805. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-25-146/
CVE ID: CVE-2025-2450 State: PUBLISHED Published: 2025-03-18T13:18:12.908Z Last Updated: 2025-03-18T13:53:50.515Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: NI Products: Vision Builder AI Problem Types: CWE-356 Description: NI Vision Builder AI VBAI File Processing Missing Warning Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of NI Vision Builder AI. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of VBAI files. The issue results from allowin
e or open a malicious file. The specific flaw exists within the processing of VBAI files. The issue results from allowing the execution of dangerous script without user warning. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-22833. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-25-147/
CVE ID: CVE-2025-2469 State: PUBLISHED Published: 2025-04-10T13:30:43.136Z Last Updated: 2025-04-10T14:13:00.917Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: GitLab Products: GitLab Problem Types: CWE-1295 Description: An issue has been discovered in GitLab CE/EE affecting all versions from 17.9 before 17.9.6, and 17.10 before 17.10.4. The runtime profiling data of a specific service was accessible to unauthenticated users. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/525374 - https://hackerone.com/reports/3030586
CVE ID: CVE-2025-2470 State: PUBLISHED Published: 2025-04-25T11:12:53.066Z Last Updated: 2025-04-25T11:57:50.900Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: aonetheme Products: Service Finder Bookings Problem Types: CWE-266 Description: The Service Finder Bookings plugin for WordPress, used by the Service Finder - Directory and Job Board WordPress Theme, is vulnerable to privilege escalation in all versions up to, and including, 5.1. This is due to a lack of restriction on user role in the 'nsl_registration_store_extra_input' function. This makes it possible for unauthenticated attackers to register an account on the site with an arbitrary role, inclu
n. This makes it possible for unauthenticated attackers to register an account on the site with an arbitrary role, including Administrator, when registering via a social login. The Nextend Social Login plugin must be installed and configured to exploit the vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a1f62cda-262b-46d9-a839-0a573813cfa1?source=cve - https://themeforest.net/item/service-finder-service-and-business-listing-wordpress-theme/15208793
CVE ID: CVE-2025-2471 State: PUBLISHED Published: 2025-03-17T23:31:04.936Z Last Updated: 2025-03-18T14:06:54.295Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: PHPGurukul Products: Boat Booking System Problem Types: CWE-89, CWE-74 Description: A vulnerability, which was classified as critical, was found in PHPGurukul Boat Booking System 1.0. Affected is an unknown function of the file /boat-details.php. The manipulation of the argument bid leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.299964 - https://vuldb
y be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.299964 - https://vuldb.com/?ctiid.299964 - https://vuldb.com/?submit.517113 - https://github.com/1cfh/vuln-pub/issues/1 - https://phpgurukul.com/
CVE ID: CVE-2025-2472 State: PUBLISHED Published: 2025-03-17T23:31:07.601Z Last Updated: 2025-03-18T14:05:17.635Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: PHPGurukul Products: Apartment Visitors Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability has been found in PHPGurukul Apartment Visitors Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /index.php of the component Sign In. The manipulation of the argument username leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP
e launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.299965 - https://vuldb.com/?ctiid.299965 - https://vuldb.com/?submit.517264 - https://github.com/l8BL/vul_report/issues/1 - https://phpgurukul.com/
CVE ID: CVE-2025-2473 State: PUBLISHED Published: 2025-03-18T00:00:09.918Z Last Updated: 2025-03-18T14:04:35.014Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: PHPGurukul Products: Company Visitor Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in PHPGurukul Company Visitor Management System 2.0 and classified as critical. Affected by this issue is some unknown functionality of the file /index.php of the component Sign In. The manipulation of the argument username leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: Ref
ly. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.299966 - https://vuldb.com/?ctiid.299966 - https://vuldb.com/?submit.517266 - https://github.com/l8BL/vul_report/issues/2 - https://phpgurukul.com/
CVE ID: CVE-2025-2474 State: PUBLISHED Published: 2025-06-10T17:38:03.661Z Last Updated: 2025-06-10T18:24:20.690Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: BlackBerry Products: QNX Software Development Platform (SDP) Problem Types: CWE-787 Description: Out-of-bounds write in the PCX image codec in QNX SDP versions 8.0, 7.1 and 7.0 could allow an unauthenticated attacker to cause a denial-of-service condition or execute code in the context of the process using the image codec. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.blackberry.com/pkb/s/article/140646
CVE ID: CVE-2025-2475 State: PUBLISHED Published: 2025-04-14T14:49:36.261Z Last Updated: 2025-04-14T14:59:27.677Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: Mattermost Products: Mattermost Problem Types: CWE-303 Description: Mattermost versions 10.5.x <= 10.5.1, 10.4.x <= 10.4.3, 9.11.x <= 9.11.9 fail to invalidate the cache when a user account is converted to a bot which allows an attacker to login to the bot exactly one time via normal credentials. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://mattermost.com/security-updates
CVE ID: CVE-2025-2476 State: PUBLISHED Published: 2025-03-19T18:59:42.832Z Last Updated: 2025-03-24T15:06:07.104Z Vendors: Google Products: Chrome Problem Types: CWE-416 Description: Use after free in Lens in Google Chrome prior to 134.0.6998.117 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2025/03/stable-channel-update-for-desktop_19.html - https://issues.chromium.org/issues/401029609
CVE ID: CVE-2025-2477 State: PUBLISHED Published: 2025-03-22T06:41:09.844Z Last Updated: 2025-03-24T15:13:48.632Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: cryokey Products: CryoKey Problem Types: CWE-79 Description: The CryoKey plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘ckemail’ parameter in all versions up to, and including, 2.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA
ey can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/1646f96c-f0f4-433a-ac5e-04c1c251972d?source=cve - https://plugins.trac.wordpress.org/browser/cryokey/trunk/cryokey.php#L95 - https://wordpress.org/plugins/cryokey/#developers
CVE ID: CVE-2025-2478 State: PUBLISHED Published: 2025-03-22T06:41:13.120Z Last Updated: 2025-03-24T13:18:05.036Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: allhart Products: Code Clone Problem Types: CWE-89 Description: The Code Clone plugin for WordPress is vulnerable to time-based SQL Injection via the ‘snippetId’ parameter in all versions up to, and including, 0.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can b
rs, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/9b6f21ce-8601-425f-bd44-6a1af31c67de?source=cve - https://plugins.trac.wordpress.org/browser/code-clone/trunk/admin/snippet-edit.php - https://wordpress.org/plugins/code-clone/#developers