Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-4094 State: PUBLISHED Published: 2025-05-21T06:00:09.025Z Last Updated: 2025-08-27T12:00:33.608Z Vendors: Unknown Products: DIGITS: WordPress Mobile Number Signup and Login Problem Types: CWE-307 Improper Restriction of Excessive Authentication Attempts Description: The DIGITS: WordPress Mobile Number Signup and Login WordPress plugin before 8.4.6.1 does not rate limit OTP validation attempts, making it straightforward for attackers to bruteforce them. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/b5f0a263-644b-4954-a1f0-d08e2149edbb/
CVE ID: CVE-2025-4095 State: PUBLISHED Published: 2025-04-29T17:16:16.894Z Last Updated: 2025-04-29T18:00:02.591Z Vendors: Docker Products: Docker Desktop Problem Types: CWE-862 Description: Registry Access Management (RAM) is a security feature allowing administrators to restrict access for their developers to only allowed registries. When a MacOS configuration profile is used to enforce organization sign-in, the RAM policies are not being applied, which would allow Docker Desktop users to pull down unapproved, and potentially malicious images from any registry. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.docker.com/security/for-admins/hardened-desktop/regi
Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.docker.com/security/for-admins/hardened-desktop/registry-access-management
CVE ID: CVE-2025-4096 State: PUBLISHED Published: 2025-05-05T18:10:36.791Z Last Updated: 2025-05-06T02:58:24.402Z Vendors: Google Products: Chrome Problem Types: CWE-122 Description: Heap buffer overflow in HTML in Google Chrome prior to 136.0.7103.59 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2025/04/stable-channel-update-for-desktop_29.html - https://issues.chromium.org/issues/409911705
CVE ID: CVE-2025-4098 State: PUBLISHED Published: 2025-05-08T17:45:03.309Z Last Updated: 2025-05-10T00:02:17.453Z Vendors: Horner Automation Products: Cscape Problem Types: CWE-125 Description: Horner Automation Cscape version 10.0 (10.0.415.2) SP1 is vulnerable to an out-of-bounds read vulnerability that could allow an attacker to disclose information and execute arbitrary code on affected installations of Cscape. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-25-128-01
CVE ID: CVE-2025-4099 State: PUBLISHED Published: 2025-05-01T04:22:56.550Z Last Updated: 2025-05-01T13:19:30.257Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: theandystratton Products: List Children Problem Types: CWE-79 Description: The List Children plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'list_children' shortcode in all versions up to, and including, 2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user acce
with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/538b4d4b-f8c6-44db-89d2-d345bfbfecb2?source=cve - https://plugins.trac.wordpress.org/browser/list-children/trunk/list_children.php#L26 - https://plugins.trac.wordpress.org/changeset/3284430/
CVE ID: CVE-2025-4100 State: PUBLISHED Published: 2025-05-01T06:40:15.546Z Last Updated: 2025-05-01T14:39:28.807Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: stur Products: Nautic Pages Problem Types: CWE-79 Description: The Nautic Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'np_marinetraffic_map' shortcode in all versions up to, and including, 2.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses a
ontributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/2f6bfe18-bb9b-4cc2-bdb7-fd9163b61323?source=cve - https://plugins.trac.wordpress.org/browser/nautic-pages/trunk/nautic_pages.php#L22
CVE ID: CVE-2025-4101 State: PUBLISHED Published: 2025-05-17T12:22:42.688Z Last Updated: 2025-05-19T14:49:42.304Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: wcmp Products: MultiVendorX – WooCommerce Multivendor Marketplace Solutions Problem Types: CWE-863 Description: The MultiVendorX – WooCommerce Multivendor Marketplace Solutions plugin for WordPress is vulnerable to unauthorized loss of data due to a misconfigured capability check on the 'delete_fpm_product' function in all versions up to, and including, 4.2.22. This makes it possible for authenticated attackers, with Contributor-level access and above, to delete arbitrary posts, pages, attachments,
le for authenticated attackers, with Contributor-level access and above, to delete arbitrary posts, pages, attachments, and products. The vulnerability was partially patched in version 4.2.22. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/5c1fd517-32ee-429d-9026-512afe117dc5?source=cve - https://plugins.trac.wordpress.org/browser/dc-woocommerce-multi-vendor/trunk/classes/class-mvx-ajax.php#L982 - https://plugins.trac.wordpress.org/changeset/3293832/dc-woocommerce-multi-vendor/trunk/classes/class-mvx-ajax.php?old=3272848&old_path=dc-woocommerce-multi-vendor%2Ftrunk%2Fclasses%2Fclass-mvx-ajax.php
CVE ID: CVE-2025-4102 State: PUBLISHED Published: 2025-06-20T11:16:39.690Z Last Updated: 2025-06-20T13:10:25.103Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: The Beaver Builder Team Products: Beaver Builder Plugin (Starter Version) Problem Types: CWE-434 Description: The Beaver Builder Plugin (Starter Version) plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'save_enabled_icons' function in all versions up to, and including, 2.9.1. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload arbitrary files on the affected site's server which may make remote
ith Administrator-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. The vulnerability was partially patched in version 2.9.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/2eb4608f-fa4f-444c-a857-c9059777a70b?source=cve - https://www.wpbeaverbuilder.com/change-logs/?utm_medium=bb-lite&utm_source=repo-readme&utm_campaign=repo-changelog-page
CVE ID: CVE-2025-4103 State: PUBLISHED Published: 2025-05-31T06:40:54.746Z Last Updated: 2025-06-02T15:49:53.380Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: luminfire Products: WP-GeoMeta Problem Types: CWE-285 Description: The WP-GeoMeta plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the wp_ajax_wpgm_start_geojson_import() function in versions 0.3.4 to 0.3.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to elevate their privileges to that of an administrator. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-inte
an administrator. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/43039f2a-b3f9-4836-8b55-e8a091b1a102?source=cve - https://wordpress.org/plugins/wp-geometa/#developers - https://plugins.trac.wordpress.org/browser/wp-geometa/tags/0.3.4/lib/wp-geometa-dash.php#L896
CVE ID: CVE-2025-4104 State: PUBLISHED Published: 2025-05-07T09:21:44.603Z Last Updated: 2025-05-07T13:29:49.041Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: vinoth06 Products: Frontend Dashboard Problem Types: CWE-285 Description: The Frontend Dashboard plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the fed_wp_ajax_fed_login_form_post() function in versions 1.0 to 2.2.6. This makes it possible for unauthenticated attackers to reset the administrator’s email and password, and elevate their privileges to that of an administrator. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www
eir privileges to that of an administrator. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/31e518a9-316b-40a4-ada7-317fb2c16766?source=cve - https://wordpress.org/plugins/frontend-dashboard/#developers - https://plugins.trac.wordpress.org/browser/frontend-dashboard/tags/2.2.6/includes/frontend/request/login/index.php#L21 - https://plugins.trac.wordpress.org/browser/frontend-dashboard/tags/2.2.6/includes/frontend/request/login/register.php#L16 - https://plugins.trac.wordpress.org/changeset/3288562/ - https://plugins.trac.wordpress.org/browser/frontend-dashboard/tags/2.2.7/includes/frontend/request/login/validation.php
CVE ID: CVE-2025-4105 State: PUBLISHED Published: 2025-05-21T09:21:50.660Z Last Updated: 2025-05-21T10:16:39.665Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: splitit Products: Splitit Problem Types: CWE-862 Description: The Splitit plugin for WordPress is vulnerable to unauthorized modification of data due to missing capability checks on several functions in the 'splitIt-flexfields-payment-gateway.php' file in all versions up to, and including, 4.2.8. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change plugin settings, including changing the environment from sandbox to production and vice versa. Additiona
bove, to change plugin settings, including changing the environment from sandbox to production and vice versa. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/6471b075-8115-4d38-a7dd-2308dca69f15?source=cve - https://plugins.trac.wordpress.org/browser/splitit-installment-payments/tags/4.2.6/splitIt-flexfields-payment-gateway.php#L765 - https://plugins.trac.wordpress.org/browser/splitit-installment-payments/tags/4.2.6/splitIt-flexfields-payment-gateway.php#L1927
CVE ID: CVE-2025-4106 State: PUBLISHED Published: 2025-10-24T21:32:30.165Z Last Updated: 2025-10-28T03:55:59.720Z Vendors: WatchGuard Products: Fireware OS Problem Types: CWE-489 Description: An authenticated admin user with access to both the management WebUI and command line interface on a Firebox can enable a diagnostic debug shell by uploading a platform and version-specific diagnostic package and executing a leftover diagnostic command. This issue affects Fireware OS: from 12.0 before 12.11.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2025-00010
CVE ID: CVE-2025-4107 State: REJECTED Published: N/A Last Updated: 2025-05-08T22:16:06.749Z Description: No description available.
CVE ID: CVE-2025-4108 State: PUBLISHED Published: 2025-04-30T10:00:06.958Z Last Updated: 2025-04-30T16:25:35.336Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: PHPGurukul Products: Student Record System Problem Types: CWE-89, CWE-74 Description: A vulnerability, which was classified as critical, was found in PHPGurukul Student Record System 3.20. Affected is an unknown function of the file /add-subject.php. The manipulation of the argument sub1 leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.306588 - https://
nd may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.306588 - https://vuldb.com/?ctiid.306588 - https://vuldb.com/?submit.560697 - https://github.com/bleakTS/myCVE/issues/2 - https://phpgurukul.com/
CVE ID: CVE-2025-4109 State: PUBLISHED Published: 2025-04-30T10:00:10.076Z Last Updated: 2025-04-30T16:22:13.615Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: PHPGurukul Products: Pre-School Enrollment System Problem Types: CWE-89, CWE-74 Description: A vulnerability has been found in PHPGurukul Pre-School Enrollment System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin/edit-subadmin.php. The manipulation of the argument mobilenumber leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well. Additional Analy
e exploit has been disclosed to the public and may be used. Other parameters might be affected as well. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.306589 - https://vuldb.com/?ctiid.306589 - https://vuldb.com/?submit.560700 - https://github.com/Iandweb/CVE/issues/3 - https://phpgurukul.com/
CVE ID: CVE-2025-4110 State: PUBLISHED Published: 2025-04-30T10:31:04.856Z Last Updated: 2025-04-30T16:06:24.419Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: PHPGurukul Products: Pre-School Enrollment System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in PHPGurukul Pre-School Enrollment System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/edit-teacher.php. The manipulation of the argument mobilenumber leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well. Additional Analyst Notes: -
s been disclosed to the public and may be used. Other parameters might be affected as well. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.306590 - https://vuldb.com/?ctiid.306590 - https://vuldb.com/?submit.560703 - https://github.com/Iandweb/CVE/issues/4 - https://phpgurukul.com/
CVE ID: CVE-2025-4111 State: PUBLISHED Published: 2025-04-30T10:31:07.547Z Last Updated: 2025-04-30T15:51:43.715Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: PHPGurukul Products: Pre-School Enrollment System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in PHPGurukul Pre-School Enrollment System 1.0. It has been classified as critical. This affects an unknown part of the file /admin/visitor-details.php. The manipulation of the argument Status leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.
disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.306591 - https://vuldb.com/?ctiid.306591 - https://vuldb.com/?submit.560706 - https://github.com/Iandweb/CVE/issues/5 - https://phpgurukul.com/
CVE ID: CVE-2025-4112 State: PUBLISHED Published: 2025-04-30T11:00:08.428Z Last Updated: 2025-04-30T15:32:57.086Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: PHPGurukul Products: Student Record System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in PHPGurukul Student Record System 3.20. It has been declared as critical. This vulnerability affects unknown code of the file /add-course.php. The manipulation of the argument course-short leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.306592 - ht
blic and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.306592 - https://vuldb.com/?ctiid.306592 - https://vuldb.com/?submit.560701 - https://github.com/bleakTS/myCVE/issues/3 - https://phpgurukul.com/
CVE ID: CVE-2025-4113 State: PUBLISHED Published: 2025-04-30T11:00:11.460Z Last Updated: 2025-04-30T15:24:43.423Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: PHPGurukul Products: Curfew e-Pass Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in PHPGurukul Curfew e-Pass Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /admin/edit-pass-detail.php. The manipulation of the argument editid leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://
been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.306593 - https://vuldb.com/?ctiid.306593 - https://vuldb.com/?submit.560738 - https://github.com/yhy7612/cve-01/issues/1 - https://phpgurukul.com/
CVE ID: CVE-2025-4114 State: PUBLISHED Published: 2025-04-30T12:00:06.173Z Last Updated: 2025-04-30T13:41:20.693Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C) Vendors: Netgear Products: JWNR2000v2 Problem Types: CWE-120, CWE-119 Description: A vulnerability classified as critical has been found in Netgear JWNR2000v2 1.0.0.11. Affected is the function check_language_file. The manipulation of the argument host leads to buffer overflow. It is possible to launch the attack remotely. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.306594 - https://vuldb.com/?ctiid.30659
onal Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.306594 - https://vuldb.com/?ctiid.306594 - https://vuldb.com/?submit.560768 - https://github.com/jylsec/vuldb/blob/main/Netgear/netgear_JWNR2000v2/Buffer_overflow-check_language_file-GUI_Region/README.md - https://www.netgear.com/
CVE ID: CVE-2025-4115 State: PUBLISHED Published: 2025-04-30T12:31:04.322Z Last Updated: 2025-04-30T13:39:45.818Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C) Vendors: Netgear Products: JWNR2000v2 Problem Types: CWE-120, CWE-119 Description: A vulnerability classified as critical was found in Netgear JWNR2000v2 1.0.0.11. Affected by this vulnerability is the function default_version_is_new. The manipulation of the argument host leads to buffer overflow. The attack can be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.306595 - https://vuldb.com/?
way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.306595 - https://vuldb.com/?ctiid.306595 - https://vuldb.com/?submit.560769 - https://github.com/jylsec/vuldb/blob/main/Netgear/netgear_JWNR2000v2/Buffer_overflow-defualt_version_is_new-StringTable_NonEnglish_Ver/README.md - https://www.netgear.com/
CVE ID: CVE-2025-4116 State: PUBLISHED Published: 2025-04-30T12:31:05.895Z Last Updated: 2025-04-30T13:28:22.057Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C) Vendors: Netgear Products: JWNR2000v2 Problem Types: CWE-120, CWE-119 Description: A vulnerability, which was classified as critical, has been found in Netgear JWNR2000v2 1.0.0.11. Affected by this issue is the function get_cur_lang_ver. The manipulation of the argument host leads to buffer overflow. The attack may be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.306596 - https://vuldb.co
ny way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.306596 - https://vuldb.com/?ctiid.306596 - https://vuldb.com/?submit.560770 - https://github.com/jylsec/vuldb/blob/main/Netgear/netgear_JWNR2000v2/Buffer_overflow-get_cur_lang_ver-StringTable_NonEnglish_Ver/README.md - https://www.netgear.com/
CVE ID: CVE-2025-4117 State: PUBLISHED Published: 2025-04-30T13:00:08.383Z Last Updated: 2025-04-30T13:16:59.492Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: Netgear Products: JWNR2000v2 Problem Types: CWE-120, CWE-119 Description: A vulnerability, which was classified as critical, was found in Netgear JWNR2000v2 1.0.0.11. This affects the function sub_41A914. The manipulation of the argument host leads to buffer overflow. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.306597 - https://vuldb.com/?ctiid.306597 - https://vuldb.com/?s
SA ADP Vulnrichment: References: - https://vuldb.com/?id.306597 - https://vuldb.com/?ctiid.306597 - https://vuldb.com/?submit.560771 - https://github.com/jylsec/vuldb/blob/main/Netgear/netgear_JWNR2000v2/Buffer_overflow-sub_41A914-GUI_Region/README.md - https://www.netgear.com/
CVE ID: CVE-2025-4118 State: PUBLISHED Published: 2025-04-30T13:31:06.111Z Last Updated: 2025-04-30T13:48:52.380Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Weitong Products: Mall Problem Types: CWE-284, CWE-266 Description: A vulnerability classified as critical has been found in Weitong Mall 1.0.0. This affects an unknown part of the file /historyList of the component Product History Handler. The manipulation of the argument isDelete with the input 1 leads to improper access controls. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: Referenc
he exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.306603 - https://vuldb.com/?ctiid.306603 - https://vuldb.com/?submit.560777 - https://www.cnblogs.com/aibot/p/18830907
CVE ID: CVE-2025-4119 State: PUBLISHED Published: 2025-04-30T13:31:09.797Z Last Updated: 2025-04-30T13:48:10.312Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Weitong Products: Mall Problem Types: CWE-284, CWE-266 Description: A vulnerability classified as critical was found in Weitong Mall 1.0.0. This vulnerability affects unknown code of the file /queryTotal of the component Product Statistics Handler. The manipulation of the argument isDelete with the input 1 leads to improper access controls. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References
exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.306604 - https://vuldb.com/?ctiid.306604 - https://vuldb.com/?submit.560778 - https://www.cnblogs.com/aibot/p/18830908