Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-25152 State: PUBLISHED Published: 2025-02-07T10:11:57.618Z Last Updated: 2025-02-12T20:51:36.434Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: LukaszWiecek Products: Smart DoFollow Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in LukaszWiecek Smart DoFollow allows Stored XSS. This issue affects Smart DoFollow: from n/a through 1.0.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/smart-dofollow/vulnerability/wordpress-smart-dofollow-plugin-1-0-2-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-25153 State: PUBLISHED Published: 2025-02-07T10:11:56.354Z Last Updated: 2025-02-12T20:51:38.794Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: djjmz Products: Simple Auto Tag Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in djjmz Simple Auto Tag allows Stored XSS. This issue affects Simple Auto Tag: from n/a through 1.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/simple-auto-tag/vulnerability/wordpress-simple-auto-tag-plugin-1-1-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-25154 State: PUBLISHED Published: 2025-02-07T10:11:59.403Z Last Updated: 2025-02-12T20:51:35.888Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: scweber Products: Custom Comment Notifications Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in scweber Custom Comment Notifications allows Stored XSS. This issue affects Custom Comment Notifications: from n/a through 1.0.8. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/custom-comment-notifications/vulnerability/wordpress-custom-comment-notifications-plugin-1-0-8-csrf-to-stored-xss-vulnerability?
omment-notifications/vulnerability/wordpress-custom-comment-notifications-plugin-1-0-8-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-25155 State: PUBLISHED Published: 2025-02-07T10:11:59.992Z Last Updated: 2025-02-12T20:51:35.715Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: efreja Products: Music Sheet Viewer Problem Types: CWE-22 Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in efreja Music Sheet Viewer allows Path Traversal. This issue affects Music Sheet Viewer: from n/a through 4.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/music-sheet-viewer/vulnerability/wordpress-music-sheet-viewer-plugin-4-1-arbitrary-file-read-vulnerability?_s_id=c
lugin/music-sheet-viewer/vulnerability/wordpress-music-sheet-viewer-plugin-4-1-arbitrary-file-read-vulnerability?_s_id=cve
CVE ID: CVE-2025-25156 State: PUBLISHED Published: 2025-02-07T10:11:56.970Z Last Updated: 2025-02-12T20:51:36.652Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Stanko Metodiev Products: Quote Comments Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Stanko Metodiev Quote Comments allows Stored XSS. This issue affects Quote Comments: from n/a through 2.2.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/quote-comments/vulnerability/wordpress-quote-comments-plugin-2-2-1-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-25157 State: PUBLISHED Published: 2025-03-03T13:30:26.466Z Last Updated: 2025-03-03T15:27:00.538Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: NotFound Products: WP Church Center Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound WP Church Center allows Reflected XSS. This issue affects WP Church Center: from n/a through 1.3.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wp-church-center/vulnerability/wordpress-wp-church-center-plugin-1-3-3-reflected-cross-site-scripting-xss-vul
ess/plugin/wp-church-center/vulnerability/wordpress-wp-church-center-plugin-1-3-3-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-25158 State: PUBLISHED Published: 2025-03-03T13:30:26.622Z Last Updated: 2025-03-03T15:24:44.333Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: NotFound Products: Uncomplicated SEO Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound Uncomplicated SEO allows Reflected XSS. This issue affects Uncomplicated SEO: from n/a through 1.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/uncomplicated-seo/vulnerability/wordpress-uncomplicated-seo-plugin-1-2-cross-site-scripting-xss-vulnerabilit
ress/plugin/uncomplicated-seo/vulnerability/wordpress-uncomplicated-seo-plugin-1-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-25159 State: PUBLISHED Published: 2025-02-07T10:11:58.816Z Last Updated: 2025-02-12T20:51:36.082Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: robert_kolatzek Products: WP doodlez Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in robert_kolatzek WP doodlez allows Stored XSS. This issue affects WP doodlez: from n/a through 1.0.10. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wpdoodlez/vulnerability/wordpress-wp-doodlez-plugin-1-0-10-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-25160 State: PUBLISHED Published: 2025-02-07T10:11:58.217Z Last Updated: 2025-02-12T20:51:36.262Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Mark Barnes Products: Style Tweaker Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Mark Barnes Style Tweaker allows Stored XSS. This issue affects Style Tweaker: from n/a through 0.11. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/style-tweaker/vulnerability/wordpress-style-tweaker-plugin-0-11-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-25161 State: PUBLISHED Published: 2025-03-03T13:30:26.777Z Last Updated: 2025-03-03T17:35:21.221Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: NotFound Products: WP Find Your Nearest Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound WP Find Your Nearest allows Reflected XSS. This issue affects WP Find Your Nearest: from n/a through 0.3.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wp-find-your-nearest/vulnerability/wordpress-globalquran-plugin-1-0-csrf-to-settings-change-vulne
abase/wordpress/plugin/wp-find-your-nearest/vulnerability/wordpress-globalquran-plugin-1-0-csrf-to-settings-change-vulnerability-2?_s_id=cve
CVE ID: CVE-2025-25162 State: PUBLISHED Published: 2025-03-03T13:30:26.934Z Last Updated: 2025-03-03T17:35:15.356Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: NotFound Products: Sports Rankings and Lists Problem Types: CWE-22 Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in NotFound Sports Rankings and Lists allows Absolute Path Traversal. This issue affects Sports Rankings and Lists: from n/a through 1.0.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/sports-rankings-lists/vulnerability/wordpress-read-more-copy-link-plugin-1-0-2
/patchstack.com/database/wordpress/plugin/sports-rankings-lists/vulnerability/wordpress-read-more-copy-link-plugin-1-0-2-csrf-to-stored-xss-vulnerability-2?_s_id=cve
CVE ID: CVE-2025-25163 State: PUBLISHED Published: 2025-02-07T10:12:00.791Z Last Updated: 2025-02-12T20:51:35.512Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Zach Swetz Products: Plugin A/B Image Optimizer Problem Types: CWE-22 Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Zach Swetz Plugin A/B Image Optimizer allows Path Traversal. This issue affects Plugin A/B Image Optimizer: from n/a through 3.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/images-optimizer/vulnerability/wordpress-plugin-a-b-image-optimizer-plugin-3-3-arb
chstack.com/database/wordpress/plugin/images-optimizer/vulnerability/wordpress-plugin-a-b-image-optimizer-plugin-3-3-arbitrary-file-download-vulnerability?_s_id=cve
CVE ID: CVE-2025-25164 State: PUBLISHED Published: 2025-03-03T13:30:27.103Z Last Updated: 2025-03-03T17:35:09.187Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: NotFound Products: Meta Accelerator Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound Meta Accelerator allows Reflected XSS. This issue affects Meta Accelerator: from n/a through 1.0.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/meta-accelerator/vulnerability/wordpress-meta-accelerator-plugin-1-0-4-reflected-cross-site-scripting-xss-vul
ess/plugin/meta-accelerator/vulnerability/wordpress-meta-accelerator-plugin-1-0-4-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-25165 State: PUBLISHED Published: 2025-03-03T13:30:27.263Z Last Updated: 2025-03-03T17:35:02.312Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: NotFound Products: Staff Directory Plugin: Company Directory Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound Staff Directory Plugin: Company Directory allows Stored XSS. This issue affects Staff Directory Plugin: Company Directory: from n/a through 4.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/staff-directory-pro/vulnerability/wordp
ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/staff-directory-pro/vulnerability/wordpress-staff-directory-plugin-company-directory-plugin-4-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-25166 State: PUBLISHED Published: 2025-02-07T10:12:01.447Z Last Updated: 2025-02-12T20:51:35.307Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: gabrieldarezzo Products: InLocation Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in gabrieldarezzo InLocation allows Stored XSS. This issue affects InLocation: from n/a through 1.8. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/inlocation/vulnerability/wordpress-inlocation-plugin-1-8-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-25167 State: PUBLISHED Published: 2025-02-07T10:12:03.322Z Last Updated: 2025-02-12T20:51:34.855Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H) Vendors: blackandwhitedigital Products: BookPress – For Book Authors Problem Types: CWE-862 Description: Missing Authorization vulnerability in blackandwhitedigital BookPress – For Book Authors allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects BookPress – For Book Authors: from n/a through 1.2.7. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/book-press/vulnerability/wordpress-bookpress-for-book-author
erences: - https://patchstack.com/database/wordpress/plugin/book-press/vulnerability/wordpress-bookpress-for-book-authors-plugin-1-2-7-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-25168 State: PUBLISHED Published: 2025-02-07T10:12:02.434Z Last Updated: 2025-02-12T20:51:35.107Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: blackandwhitedigital Products: BookPress – For Book Authors Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in blackandwhitedigital BookPress – For Book Authors allows Cross-Site Scripting (XSS). This issue affects BookPress – For Book Authors: from n/a through 1.2.7. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/book-press/vulnerability/wordpress-bookpress-for-book-authors-plugin-1-2-7-csrf-to-sto
ack.com/database/wordpress/plugin/book-press/vulnerability/wordpress-bookpress-for-book-authors-plugin-1-2-7-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-25169 State: PUBLISHED Published: 2025-03-03T13:30:27.439Z Last Updated: 2025-03-03T17:34:55.975Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: NotFound Products: Authors Autocomplete Meta Box Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound Authors Autocomplete Meta Box allows Reflected XSS. This issue affects Authors Autocomplete Meta Box: from n/a through 1.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/authors-autocomplete-meta-box/vulnerability/wordpress-authors-autocomple
ttps://patchstack.com/database/wordpress/plugin/authors-autocomplete-meta-box/vulnerability/wordpress-authors-autocomplete-meta-box-plugin-1-2-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-25170 State: PUBLISHED Published: 2025-03-03T13:30:27.604Z Last Updated: 2025-03-03T15:50:28.920Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: NotFound Products: Migrate Posts Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound Migrate Posts allows Reflected XSS. This issue affects Migrate Posts: from n/a through 1.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/migrate-post/vulnerability/wordpress-migrate-posts-plugin-1-0-post-based-cross-site-scripting-xss-vulnerability?_s_id=cv
migrate-post/vulnerability/wordpress-migrate-posts-plugin-1-0-post-based-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-25171 State: PUBLISHED Published: 2025-06-27T11:52:46.757Z Last Updated: 2025-06-27T14:06:44.275Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: ThemesGrove Products: WP SmartPay Problem Types: CWE-288 Description: Authentication Bypass Using an Alternate Path or Channel vulnerability in ThemesGrove WP SmartPay allows Authentication Abuse. This issue affects WP SmartPay: from n/a through 2.7.13. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/smartpay/vulnerability/wordpress-wp-smartpay-plugin-2-7-13-account-takeover-vulnerability?_s_id=cve
CVE ID: CVE-2025-25172 State: PUBLISHED Published: 2025-08-14T10:34:35.681Z Last Updated: 2025-08-14T13:28:29.723Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: beeteam368 Products: VidMov Problem Types: CWE-98 Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in beeteam368 VidMov allows PHP Local File Inclusion. This issue affects VidMov: from n/a through 1.9.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/theme/vidmov/vulnerability/wordpress-vidmov-1-9-4-local-file-inclusion-vulnerability?_s_id=cve
CVE ID: CVE-2025-25173 State: PUBLISHED Published: 2025-06-27T11:52:46.174Z Last Updated: 2025-06-27T13:41:44.926Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: FasterThemes Products: FastBook Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FasterThemes FastBook allows Stored XSS. This issue affects FastBook: from n/a through 1.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/fastbook-responsive-appointment-booking-and-scheduling-system/vulnerability/wordpress-fastbook-1-1-cross-site-scripting-xss-vulner
esponsive-appointment-booking-and-scheduling-system/vulnerability/wordpress-fastbook-1-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-25174 State: PUBLISHED Published: 2025-08-14T10:34:35.115Z Last Updated: 2025-08-14T19:50:24.312Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: beeteam368 Products: BeeTeam368 Extensions Problem Types: CWE-98 Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in beeteam368 BeeTeam368 Extensions allows PHP Local File Inclusion. This issue affects BeeTeam368 Extensions: from n/a through 1.9.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/beeteam368-extensions/vulnerability/wordpress-beeteam368-
References: - https://patchstack.com/database/wordpress/plugin/beeteam368-extensions/vulnerability/wordpress-beeteam368-extensions-plugin-1-9-4-local-file-inclusion-vulnerability?_s_id=cve
CVE ID: CVE-2025-25175 State: PUBLISHED Published: 2025-03-13T09:07:09.436Z Last Updated: 2025-03-13T19:38:24.491Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Siemens Products: Simcenter Femap V2401, Simcenter Femap V2406 Problem Types: CWE-119 Description: A vulnerability has been identified in Simcenter Femap V2401 (All versions < V2401.0003), Simcenter Femap V2406 (All versions < V2406.0002). The affected application contains a memory corruption vulnerability while parsing specially crafted .NEU files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-25443) Additional Analyst Notes: - CISA ADP Vulnrichment: Re
xecute code in the context of the current process. (ZDI-CAN-25443) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/html/ssa-920092.html
CVE ID: CVE-2025-25177 State: PUBLISHED Published: 2025-09-22T10:02:55.722Z Last Updated: 2025-09-22T14:12:26.721Z Vendors: Imagination Technologies Products: Graphics DDK Problem Types: CWE-416 Description: Software installed and run as a non-privileged user may conduct improper GPU system calls to trigger use-after-free kernel exceptions. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.imaginationtech.com/gpu-driver-vulnerabilities/
CVE ID: CVE-2025-25178 State: PUBLISHED Published: 2025-04-04T15:42:57.726Z Last Updated: 2025-04-15T14:17:06.434Z Vendors: Imagination Technologies Products: Graphics DDK Problem Types: CWE-1284 Description: Software installed and run as a non-privileged user may conduct improper GPU system calls to cause kernel system memory corruption. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.imaginationtech.com/gpu-driver-vulnerabilities/
CVE ID: CVE-2025-25179 State: PUBLISHED Published: 2025-06-02T04:19:18.316Z Last Updated: 2025-06-02T14:13:18.466Z Vendors: Imagination Technologies Products: Graphics DDK Problem Types: CWE-280 Description: Software installed and run as a non-privileged user may conduct improper GPU system calls to subvert GPU HW to write to arbitrary physical memory pages. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.imaginationtech.com/gpu-driver-vulnerabilities/
CVE ID: CVE-2025-25180 State: PUBLISHED Published: 2025-07-14T01:36:14.742Z Last Updated: 2025-07-14T14:57:16.398Z Vendors: Imagination Technologies Products: Graphics DDK Problem Types: CWE-823 Description: Software installed and run as a non-privileged user may conduct improper GPU system calls to subvert GPU HW to write to arbitrary physical memory pages. Under certain circumstances this exploit could be used to corrupt data pages not allocated by the GPU driver but memory pages in use by the kernel and drivers running on the platform altering their behaviour. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.imaginationtech.com/gpu-driver-vulnerabilities/
CVE ID: CVE-2025-25181 State: PUBLISHED Published: 2025-02-03T00:00:00.000Z Last Updated: 2025-10-21T22:55:30.568Z Severity: MEDIUM (CVSS 5.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N) Vendors: Advantive Products: VeraCore Problem Types: CWE-89 Description: A SQL injection vulnerability in timeoutWarning.asp in Advantive VeraCore through 2025.1.0 allows remote attackers to execute arbitrary SQL commands via the PmSess1 parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://advantive.my.site.com/support/s/knowledge - https://intezer.com/blog/research/xe-group-exploiting-zero-days/ - https://www.solissecurity.com/en-us/insights/xe-group-from-credit-card-skimming
esearch/xe-group-exploiting-zero-days/ - https://www.solissecurity.com/en-us/insights/xe-group-from-credit-card-skimming-to-exploiting-zero-days/
CVE ID: CVE-2025-25182 State: PUBLISHED Published: 2025-02-12T16:16:45.327Z Last Updated: 2025-02-12T19:24:50.920Z Severity: CRITICAL (CVSS 9.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L) Vendors: gchq Products: stroom Problem Types: CWE-290 Description: Stroom is a data processing, storage and analysis platform. A vulnerability exists starting in version 7.2-beta.53 and prior to versions 7.2.24, 7.3-beta.22, 7.4.4, and 7.5-beta.2 that allows authentication bypass to a Stroom system when configured with ALB and installed in a way that the application is accessible not through the ALB itself. This vulnerability may also allow for server-side request forgery which may lead to code execution
ough the ALB itself. This vulnerability may also allow for server-side request forgery which may lead to code execution or further privileges escalations when using the AWS metadata URL. This scenario assumes that Stroom must be configured to use ALB Authentication integration and the application is network accessible. The vulnerability has been fixed in versions 7.2.24, 7.3-beta.22, 7.4.4, and 7.5-beta.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/gchq/stroom/security/advisories/GHSA-x489-xx2m-vc43 - https://github.com/gchq/stroom/pull/4320
CVE ID: CVE-2025-25183 State: PUBLISHED Published: 2025-02-07T19:59:01.370Z Last Updated: 2025-02-12T20:51:46.402Z Severity: LOW (CVSS 2.6 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N) Vendors: vllm-project Products: vllm Problem Types: CWE-354 Description: vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Maliciously constructed statements can lead to hash collisions, resulting in cache reuse, which can interfere with subsequent responses and cause unintended behavior. Prefix caching makes use of Python's built-in hash() function. As of Python 3.12, the behavior of hash(None) has changed to be a predictable constant value. This makes it more feasible that