Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-1675 State: PUBLISHED Published: 2025-02-25T07:22:35.703Z Last Updated: 2025-02-28T17:02:37.541Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H) Vendors: zephyrproject-rtos Products: Zephyr Problem Types: CWE-125 Description: The function dns_copy_qname in dns_pack.c performs performs a memcpy operation with an untrusted field and does not check if the source buffer is large enough to contain the copied data. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-2m84-5hfw-m8v4
CVE ID: CVE-2025-1676 State: PUBLISHED Published: 2025-02-25T11:00:13.282Z Last Updated: 2025-02-25T13:53:14.254Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: hzmanyun Products: Education and Training System Problem Types: CWE-78, CWE-77 Description: A vulnerability classified as critical was found in hzmanyun Education and Training System 3.1.1. Affected by this vulnerability is the function pdf2swf of the file /pdf2swf. The manipulation of the argument file leads to os command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.296
o the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.296731 - https://vuldb.com/?ctiid.296731 - https://vuldb.com/?submit.500507 - https://github.com/Rain1er/report/blob/main/nxb/rce1.md
CVE ID: CVE-2025-1677 State: PUBLISHED Published: 2025-04-10T12:30:58.715Z Last Updated: 2025-04-10T13:02:54.300Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: GitLab Products: GitLab Problem Types: CWE-770 Description: A Denial of Service (DoS) issue has been discovered in GitLab CE/EE affecting all up to 17.8.7, 17.9 prior to 17.9.6 and 17.10 prior to 17.10.4 A denial of service could occur upon injecting oversized payloads into CI pipeline exports. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/521117 - https://hackerone.com/reports/3004008
CVE ID: CVE-2025-1679 State: PUBLISHED Published: 2025-10-23T13:51:27.285Z Last Updated: 2025-10-23T14:37:22.233Z Vendors: Moxa Products: TN-4500A Series, TN-5500A Series, TN-G4500 Series, TN-G6500 Series Problem Types: CWE-79 Description: Cross-site Scripting has been identified in Moxa’s Ethernet switches, which allows an authenticated administrative attacker to inject malicious scripts to an affected device’s web service that could impact authenticated users interacting with the device’s web interface. This vulnerability is classified as stored cross-site scripting (XSS); attackers inject malicious scripts into the system, and the scripts persist across sessions. There is no impact to the
; attackers inject malicious scripts into the system, and the scripts persist across sessions. There is no impact to the confidentiality, integrity, and availability of the affected device; no loss of availability within any subsequent systems but has some loss of confidentiality and integrity within the subsequent system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.moxa.com/en/support/product-support/security-advisory/mpsa-257421-cve-2025-1679,-cve-2025-1680-stored-cross-site-scripting-(xss)-and-host-header-injection-vulnerabilities-in - https://www.hackrtu.com/blog/cg-technical-en-003/
CVE ID: CVE-2025-1680 State: PUBLISHED Published: 2025-10-23T13:56:39.744Z Last Updated: 2025-10-23T14:35:30.379Z Vendors: Moxa Products: TN-4500A Series, TN-5500A Series, TN-G4500 Series, TN-G6500 Series Problem Types: CWE-349 Description: An acceptance of extraneous untrusted data with trusted data vulnerability has been identified in Moxa’s Ethernet switches, which allows attackers with administrative privileges to manipulate HTTP Host headers by injecting a specially crafted Host header into HTTP requests sent to an affected device’s web service. This vulnerability is classified as Host Header Injection, where invalid Host headers can manipulate to redirect users, forge links, or phishin
lassified as Host Header Injection, where invalid Host headers can manipulate to redirect users, forge links, or phishing attacks. There is no impact to the confidentiality, integrity, and availability of the affected device; no loss of confidentiality, integrity, and availability within any subsequent systems. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.moxa.com/en/support/product-support/security-advisory/mpsa-257421-cve-2025-1679,-cve-2025-1680-stored-cross-site-scripting-(xss)-and-host-header-injection-vulnerabilities-in - https://www.hackrtu.com/blog/cg-technical-en-003/
CVE ID: CVE-2025-1681 State: PUBLISHED Published: 2025-02-27T23:22:38.865Z Last Updated: 2025-02-28T14:59:56.825Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) Vendors: ThemeMakers Products: Car Dealer Automotive WordPress Theme – Responsive Problem Types: CWE-862 Description: The Cardealer theme for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability check and missing filename sanitization on the demo theme scheme AJAX functions in versions up to, and including, 1.6.4. This makes it possible for authenticated attackers, with subscriber-level access and above, to change or delete arbitrary css and js files. Addi
or authenticated attackers, with subscriber-level access and above, to change or delete arbitrary css and js files. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/3e394ee2-13c1-4b04-a8a5-4642f1794d59?source=cve - https://themeforest.net/item/car-dealer-automotive-wordpress-theme-responsive/8574708 - https://webtemplatemasters.com/cardealer/changelog/#v165
CVE ID: CVE-2025-1682 State: PUBLISHED Published: 2025-02-27T23:22:39.410Z Last Updated: 2025-02-28T14:47:50.398Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: ThemeMakers Products: Car Dealer Automotive WordPress Theme – Responsive Problem Types: CWE-862 Description: The Cardealer theme for WordPress is vulnerable to privilege escalation in versions up to, and including, 1.6.4 due to missing capability check on the 'save_settings' function. This makes it possible for authenticated attackers, with subscriber-level access and above, to modify the default user role. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/thre
y the default user role. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/4e337281-f05e-486c-9491-161365af252a?source=cve - https://themeforest.net/item/car-dealer-automotive-wordpress-theme-responsive/8574708 - https://webtemplatemasters.com/cardealer/changelog/#v165
CVE ID: CVE-2025-1683 State: PUBLISHED Published: 2025-03-12T15:25:27.765Z Last Updated: 2025-06-18T18:40:59.816Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: 1E Products: 1E Client Problem Types: CWE-59 Description: Improper link resolution before file access in the Nomad module of the 1E Client, in versions prior to 25.3, enables an attacker with local unprivileged access on a Windows system to delete arbitrary files on the device by exploiting symbolic links. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.teamviewer.com/en/resources/trust-center/security-bulletins/1e-2025-2001/ - https://nvd.nist.gov/vuln/detail/CVE-2025-168
eamviewer.com/en/resources/trust-center/security-bulletins/1e-2025-2001/ - https://nvd.nist.gov/vuln/detail/CVE-2025-1683 - https://cwe.mitre.org/data/definitions/59.html - https://capec.mitre.org/data/definitions/27.html
CVE ID: CVE-2025-1686 State: PUBLISHED Published: 2025-02-27T05:00:05.848Z Last Updated: 2025-02-27T14:44:57.552Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N/E:P) Vendors: n/a Products: io.pebbletemplates:pebble Problem Types: CWE-73 Description: All versions of the package io.pebbletemplates:pebble are vulnerable to External Control of File Name or Path via the include tag. A high privileged attacker can access sensitive local files by crafting malicious notification templates that leverage this tag to include files like /etc/passwd or /proc/1/environ. Workaround This vulnerability can be mitigated by disabling the include macro in Pebble Templates: java new Pebb
nviron. Workaround This vulnerability can be mitigated by disabling the include macro in Pebble Templates: java new PebbleEngine.Builder() .registerExtensionCustomizer(new DisallowExtensionCustomizerBuilder() .disallowedTokenParserTags(List.of("include")) .build()) .build(); Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.snyk.io/vuln/SNYK-JAVA-IOPEBBLETEMPLATES-8745594 - https://github.com/PebbleTemplates/pebble/issues/680 - https://pebbletemplates.io/wiki/tag/include - https://github.com/PebbleTemplates/pebble/issues/688
CVE ID: CVE-2025-1687 State: PUBLISHED Published: 2025-02-27T23:22:39.776Z Last Updated: 2025-02-28T14:47:26.319Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: ThemeMakers Products: Car Dealer Automotive WordPress Theme – Responsive Problem Types: CWE-352 Description: The Cardealer theme for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.6.4. This is due to missing nonce validation on the 'update_user_profile' function. This makes it possible for unauthenticated attackers to update the user email and password via a forged request, granted they can trick a site administrator into performing an action such as clicking
nd password via a forged request, granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/6305b7be-8651-4028-a8cf-ea58b4977225?source=cve - https://themeforest.net/item/car-dealer-automotive-wordpress-theme-responsive/8574708 - https://webtemplatemasters.com/cardealer/changelog/#v165
CVE ID: CVE-2025-1688 State: PUBLISHED Published: 2025-04-15T10:13:51.549Z Last Updated: 2025-09-09T07:51:13.969Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:L) Vendors: Milestone Systems Products: XProtect VMS Problem Types: CWE-1394 Description: Milestone Systems has discovered a security vulnerability in Milestone XProtect installer that resets system configuration password after the upgrading from older versions using specific installers. The system configuration password is an additional, optional protection that is enabled on the Management Server. To mitigate the issue, we highly recommend updating system configuration password via GUI with a standard procedu
erver. To mitigate the issue, we highly recommend updating system configuration password via GUI with a standard procedure. Any system upgraded with 2024 R1 or 2024 R2 release installer is vulnerable to this issue. Systems upgraded from 2023 R3 or older with version 2025 R1 and newer are not affected. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://supportcommunity.milestonesys.com/KBRedir?art=000069835&lang=en_US
CVE ID: CVE-2025-1689 State: PUBLISHED Published: 2025-02-27T06:48:39.544Z Last Updated: 2025-02-27T14:50:35.378Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: ThemeMakers Products: ThemeMakers PayPal Express Checkout Problem Types: CWE-79 Description: The ThemeMakers PayPal Express Checkout plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'paypal' shortcode in versions up to, and including, 1.1.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will exe
henticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/6390dba6-423b-48be-b5f0-1018d94f4a32?source=cve - https://themeforest.net/item/car-dealer-automotive-wordpress-theme-responsive/8574708 - https://github.com/ThemeMakers/tmm_paypal_checkout/commit/d6d3b1877ed705ac171cf7e74a6e866fc135ba22
CVE ID: CVE-2025-1690 State: PUBLISHED Published: 2025-02-27T08:22:03.600Z Last Updated: 2025-02-27T14:37:29.303Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: ThemeMakers Products: ThemeMakers Stripe Checkout Problem Types: CWE-79 Description: The ThemeMakers Stripe Checkout plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'stripe' shortcode in versions up to, and including, 1.0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a
kers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/dd040ff7-7f30-4097-9492-743a9821589e?source=cve - https://themeforest.net/item/car-dealer-automotive-wordpress-theme-responsive/8574708 - https://github.com/ThemeMakers/tmm_stripe_checkout/compare/v1.0.1...v1.0.2
CVE ID: CVE-2025-1691 State: PUBLISHED Published: 2025-02-27T12:34:02.752Z Last Updated: 2025-02-27T15:18:23.418Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H) Vendors: MongoDB Inc Products: mongosh Problem Types: CWE-74 Description: The MongoDB Shell may be susceptible to control character injection where an attacker with control of the mongosh autocomplete feature, can use the autocompletion feature to input and run obfuscated malicious text. This requires user interaction in the form of the user using ‘tab’ to autocomplete text that is a prefix of the attacker’s prepared autocompletion. This issue affects mongosh versions prior to 2.3.9. The vulnerability is explo
f the attacker’s prepared autocompletion. This issue affects mongosh versions prior to 2.3.9. The vulnerability is exploitable only when mongosh is connected to a cluster that is partially or fully controlled by an attacker. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://jira.mongodb.org/browse/MONGOSH-2024
CVE ID: CVE-2025-1692 State: PUBLISHED Published: 2025-02-27T12:37:00.376Z Last Updated: 2025-02-27T15:19:13.933Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H) Vendors: MongoDB Inc Products: mongosh Problem Types: CWE-150 Description: The MongoDB Shell may be susceptible to control character injection where an attacker with control of the user’s clipboard could manipulate them to paste text into mongosh that evaluates arbitrary code. Control characters in the pasted text can be used to obfuscate malicious code. This issue affects mongosh versions prior to 2.3.9 Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://jira.mongodb.org/browse/MONGOSH-
prior to 2.3.9 Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://jira.mongodb.org/browse/MONGOSH-2025
CVE ID: CVE-2025-1693 State: PUBLISHED Published: 2025-02-27T12:39:37.520Z Last Updated: 2025-02-27T15:20:13.640Z Severity: LOW (CVSS 3.9 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L) Vendors: MongoDB Inc Products: mongosh Problem Types: CWE-150 Description: The MongoDB Shell may be susceptible to control character injection where an attacker with control over the database cluster contents can inject control characters into the shell output. This may result in the display of falsified messages that appear to originate from mongosh or the underlying operating system, potentially misleading users into executing unsafe actions. The vulnerability is exploitable only when mongosh is connected to
ally misleading users into executing unsafe actions. The vulnerability is exploitable only when mongosh is connected to a cluster that is partially or fully controlled by an attacker. This issue affects mongosh versions prior to 2.3.9 Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://jira.mongodb.org/browse/MONGOSH-2026
CVE ID: CVE-2025-1695 State: PUBLISHED Published: 2025-03-04T00:54:52.240Z Last Updated: 2025-03-04T16:33:18.911Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: F5 Products: NGINX Unit Problem Types: CWE-835 Description: In NGINX Unit before version 1.34.2 with the Java Language Module in use, undisclosed requests can lead to an infinite loop and cause an increase in CPU resource utilization. This vulnerability allows a remote attacker to cause a degradation that can lead to a limited denial-of-service (DoS). There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are no
sure; this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://my.f5.com/manage/s/article/K000149959
CVE ID: CVE-2025-1696 State: PUBLISHED Published: 2025-03-06T11:58:43.389Z Last Updated: 2025-03-06T16:15:52.078Z Vendors: Docker Products: Docker Desktop Problem Types: CWE-532 Description: A vulnerability exists in Docker Desktop prior to version 4.39.0 that could lead to the unintentional disclosure of sensitive information via application logs. In affected versions, proxy configuration data—potentially including sensitive details—was written to log files in clear text whenever an HTTP GET request was made through a proxy. An attacker with read access to these logs could obtain the proxy information and leverage it for further attacks or unauthorized access. Starting with version 4.39.0,
obtain the proxy information and leverage it for further attacks or unauthorized access. Starting with version 4.39.0, Docker Desktop no longer logs the proxy string, thereby mitigating this risk. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.docker.com/desktop/settings-and-maintenance/settings/#proxies - https://docs.docker.com/desktop/troubleshoot-and-support/troubleshoot/#check-the-logs
CVE ID: CVE-2025-1697 State: PUBLISHED Published: 2025-04-18T17:43:54.423Z Last Updated: 2025-04-22T03:55:16.232Z Vendors: HP, Inc. Products: HP Touchpoint Analytics Service Problem Types: CWE-59 Description: A potential security vulnerability has been identified in the HP Touchpoint Analytics Service for certain HP PC products with versions prior to 4.2.2439. This vulnerability could potentially allow a local attacker to escalate privileges. HP is providing software updates to mitigate this potential vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.hp.com/us-en/document/ish_12269975-12269997-16/hpsbgn04008
CVE ID: CVE-2025-1698 State: PUBLISHED Published: 2025-06-11T16:14:37.530Z Last Updated: 2025-06-11T17:50:12.382Z Severity: LOW (CVSS 2.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L) Vendors: Motorola Products: Razr 40 Ultra, Razr 40, Razr 2023, Edge 40 Pro, Edge+ 2023 Problem Types: CWE-476 Description: Null pointer exception vulnerabilities were reported in the fingerprint sensor service that could allow a local attacker to cause a denial of service. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://en-us.support.motorola.com/app/answers/detail/a_id/186728
CVE ID: CVE-2025-1699 State: PUBLISHED Published: 2025-06-11T16:14:49.135Z Last Updated: 2025-06-11T17:32:38.557Z Severity: LOW (CVSS 2.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N) Vendors: Motorola Products: g34, g34t, g45 5G Problem Types: CWE-276 Description: An incorrect default permissions vulnerability was reported in the MotoSignature application that could result in unauthorized access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://en-us.support.motorola.com/app/answers/detail/a_id/186729
CVE ID: CVE-2025-1700 State: PUBLISHED Published: 2025-07-17T19:16:40.562Z Last Updated: 2025-07-21T20:23:41.863Z Severity: HIGH (CVSS 7 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Motorola Products: Software Fix Problem Types: CWE-427 Description: A DLL hijacking vulnerability was reported in the Motorola Software Fix (Rescue and Smart Assistant) installer that could allow a local attacker to escalate privileges during installation of the software. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://en-us.support.motorola.com/app/answers/detail/a_id/186730/~/motorola-software-fix-installer-vulnerability - https://support.lenovo.com/us/en/product_security/LEN-
ail/a_id/186730/~/motorola-software-fix-installer-vulnerability - https://support.lenovo.com/us/en/product_security/LEN-194483
CVE ID: CVE-2025-1701 State: PUBLISHED Published: 2025-06-04T13:01:17.637Z Last Updated: 2025-06-04T13:29:02.676Z Vendors: MIM Software Products: MIM Admin Service Problem Types: CWE-20, CWE-306 Description: CVE-2025-1701 is a high-severity vulnerability in the MIM Admin service. An attacker could exploit this vulnerability by sending a specially crafted request over the RMI interface to execute arbitrary code with the privileges of the MIM Admin service. The RMI interface is only accessible locally (listening on 127.0.0.1), limiting the attack vector to the local machine. This means that in a properly configured hospital environment, an attacker must have already compromised the network and
This means that in a properly configured hospital environment, an attacker must have already compromised the network and additionally compromised the system where the MIM Admin service is running. From there, attackers with sufficient knowledge of MIM's implementation, library usage, and functionality with access to extend the MIM RMI library could force the MIM Admin service to run commands on the local machine with its privileges. Users of MIM Software products exposed via RDP or multi-user application virtualization system should take note that the system being exposed is the environment hosting the virtualized MIM client. This issue affects MIM Admin Service: before 7.2.13, 7.3.8, 7.4.3
s the environment hosting the virtualized MIM client. This issue affects MIM Admin Service: before 7.2.13, 7.3.8, 7.4.3 Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.mimsoftware.com/cve-2025-1701
CVE ID: CVE-2025-1702 State: PUBLISHED Published: 2025-03-05T11:22:09.425Z Last Updated: 2025-03-05T14:18:59.593Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: ultimatemember Products: Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin Problem Types: CWE-89 Description: The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to time-based SQL Injection via the 'search' parameter in all versions up to, and including, 2.10.0 due to insufficient escaping on the user supplied parameter and lack of sufficient pr