Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-6688 State: PUBLISHED Published: 2025-06-27T07:22:23.675Z Last Updated: 2025-06-27T13:40:48.222Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: idokd Products: Simple Payment Problem Types: CWE-288 Description: The Simple Payment plugin for WordPress is vulnerable to Authentication Bypass in versions 1.3.6 to 2.3.8. This is due to the plugin not properly verifying a user's identity prior to logging them in through the create_user() function. This makes it possible for unauthenticated attackers to log in as administrative users. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerab
users. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/8b4e2f87-e3ad-4f1b-b647-f5e5a49f691b?source=cve - https://plugins.trac.wordpress.org/changeset/3318371/simple-payment/tags/2.3.9/simple-payment-plugin.php
CVE ID: CVE-2025-6689 State: PUBLISHED Published: 2025-06-27T07:22:21.425Z Last Updated: 2025-06-27T14:11:28.167Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: armandofiore Products: FL3R Accessibility Suite Problem Types: CWE-79 Description: The FL3R Accessibility Suite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's fl3raccessibilitysuite shortcode in all versions up to, and including, 1.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will ex
authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/33f673b5-2bcb-4591-b589-4d7230b5c2e7?source=cve - https://wordpress.org/plugins/fl3r-accessibility-suite/#developers
CVE ID: CVE-2025-6690 State: PUBLISHED Published: 2025-08-06T01:45:12.280Z Last Updated: 2025-08-06T16:01:53.174Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: archaeopath Products: WP Tournament Registration Problem Types: CWE-79 Description: The WP Tournament Registration plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘field’ parameter in all versions up to, and including, 1.3.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page
l access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/bf3c6dd5-498e-4aff-90fb-15ede66f5e3e?source=cve - https://wordpress.org/plugins/wp-tournament-registration/#developers
CVE ID: CVE-2025-6691 State: PUBLISHED Published: 2025-07-09T05:23:39.896Z Last Updated: 2025-07-09T14:13:33.611Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H) Vendors: brainstormforce Products: SureForms – Drag and Drop Form Builder for WordPress Problem Types: CWE-73 Description: The SureForms – Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_entry_files() function in all versions up to, and including, 1.7.3. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the
uthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b4658546-bf57-414b-a3c9-bf7a5692c5fe?source=cve - https://wordpress.org/plugins/sureforms/ - https://plugins.trac.wordpress.org/browser/sureforms/trunk/admin/views/entries-list-table.php#L661 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3319753%40sureforms&new=3319753%40sureforms&sfp_email=&sfph_mail=
CVE ID: CVE-2025-6692 State: PUBLISHED Published: 2025-07-29T09:23:46.797Z Last Updated: 2025-07-29T14:23:58.231Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: hanucodes Products: YouTube Embed – YouTube Gallery, Vimeo Gallery – WordPress Plugin Problem Types: CWE-79 Description: The YouTube Embed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘instance’ parameter in all versions up to, and including, 10.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user
ers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/cf558c77-fc78-4149-bc7f-2b5353144daf?source=cve - https://wordpress.org/plugins/youram-youtube-embed/#developers
CVE ID: CVE-2025-6693 State: PUBLISHED Published: 2025-06-26T13:00:15.142Z Last Updated: 2025-06-26T13:21:53.779Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:X/RL:X/RC:R) Vendors: n/a Products: RT-Thread Problem Types: CWE-119 Description: A vulnerability, which was classified as critical, was found in RT-Thread up to 5.1.0. This affects the function sys_device_open/sys_device_read/sys_device_control/sys_device_init/sys_device_close/sys_device_write of the file components/drivers/core/device.c. The manipulation leads to memory corruption. It is possible to launch the attack on the local host. The vendor was contacted early about this disclosure but did not respond
ossible to launch the attack on the local host. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.313959 - https://vuldb.com/?ctiid.313959 - https://vuldb.com/?submit.595813 - https://vuldb.com/?submit.595814 - https://vuldb.com/?submit.595827 - https://vuldb.com/?submit.595869 - https://vuldb.com/?submit.595870 - https://vuldb.com/?submit.595871 - https://github.com/RT-Thread/rt-thread/issues/10387
CVE ID: CVE-2025-6694 State: PUBLISHED Published: 2025-06-26T13:31:05.714Z Last Updated: 2025-06-26T13:53:48.359Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: LabRedesCefetRJ Products: WeGIA Problem Types: CWE-79, CWE-94 Description: A vulnerability has been found in LabRedesCefetRJ WeGIA 3.4.0 and classified as problematic. This vulnerability affects unknown code of the file /html/matPat/adicionar_unidade.php of the component Adicionar Unidade. The manipulation of the argument Insira a nova unidade leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early a
an be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.313960 - https://vuldb.com/?ctiid.313960 - https://vuldb.com/?submit.595343 - https://github.com/RaulPazemecxas/PoCVulDb
CVE ID: CVE-2025-6695 State: PUBLISHED Published: 2025-06-26T13:31:06.906Z Last Updated: 2025-06-26T13:50:43.202Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: LabRedesCefetRJ Products: WeGIA Problem Types: CWE-79, CWE-94 Description: A vulnerability was found in LabRedesCefetRJ WeGIA 3.4.0 and classified as problematic. This issue affects some unknown processing of the file /html/matPat/adicionar_categoria.php of the component Additional Categoria. The manipulation of the argument Insira a nova categoria leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted ea
ack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.313961 - https://vuldb.com/?ctiid.313961 - https://vuldb.com/?submit.597071 - https://github.com/RaulPazemecxas/PoCVulDb/blob/main/README2.md
CVE ID: CVE-2025-6696 State: PUBLISHED Published: 2025-06-26T14:31:05.633Z Last Updated: 2025-06-26T14:46:07.561Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: LabRedesCefetRJ Products: WeGIA Problem Types: CWE-79, CWE-94 Description: A vulnerability was found in LabRedesCefetRJ WeGIA 3.4.0. It has been classified as problematic. Affected is an unknown function of the file /html/atendido/Cadastro_Atendido.php of the component Cadastro de Atendio. The manipulation of the argument Nome/Sobrenome leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. This is a different issue than
aunch the attack remotely. The exploit has been disclosed to the public and may be used. This is a different issue than CVE-2025-22615. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.313962 - https://vuldb.com/?ctiid.313962 - https://vuldb.com/?submit.597078 - https://github.com/RaulPazemecxas/PoCVulDb/blob/main/README3.md
CVE ID: CVE-2025-6697 State: PUBLISHED Published: 2025-06-26T15:00:12.058Z Last Updated: 2025-06-26T15:20:10.420Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: LabRedesCefetRJ Products: WeGIA Problem Types: CWE-79, CWE-94 Description: A vulnerability was found in LabRedesCefetRJ WeGIA 3.4.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /html/matPat/adicionar_tipoEntrada.php of the component Adicionar tipo. The manipulation of the argument Insira o novo tipo leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was
pting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.313963 - https://vuldb.com/?ctiid.313963 - https://vuldb.com/?submit.597386 - https://github.com/RaulPazemecxas/PoCVulDb/blob/main/README5.md
CVE ID: CVE-2025-6698 State: PUBLISHED Published: 2025-06-26T15:00:14.315Z Last Updated: 2025-06-26T15:19:38.030Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: LabRedesCefetRJ Products: WeGIA Problem Types: CWE-79, CWE-94 Description: A vulnerability was found in LabRedesCefetRJ WeGIA 3.4.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /html/matPat/adicionar_tipoSaida.php of the component Adicionar tipo. The manipulation of the argument Insira o novo tipo leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted
attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.313964 - https://vuldb.com/?ctiid.313964 - https://vuldb.com/?submit.597389 - https://github.com/RaulPazemecxas/PoCVulDb/blob/main/README6.md
CVE ID: CVE-2025-6699 State: PUBLISHED Published: 2025-06-26T15:31:12.243Z Last Updated: 2025-06-26T15:52:41.052Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: LabRedesCefetRJ Products: WeGIA Problem Types: CWE-79, CWE-94 Description: A vulnerability classified as problematic has been found in LabRedesCefetRJ WeGIA 3.4.0. This affects an unknown part of the file /html/funcionario/cadastro_funcionario.php of the component Cadastro de Funcionário. The manipulation of the argument Nome/Sobrenome leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. This is a different issue than
itiate the attack remotely. The exploit has been disclosed to the public and may be used. This is a different issue than CVE-2025-23030. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.313965 - https://vuldb.com/?ctiid.313965 - https://vuldb.com/?submit.597401 - https://github.com/RaulPazemecxas/PoCVulDb/blob/main/README7.md
CVE ID: CVE-2025-6700 State: PUBLISHED Published: 2025-06-26T15:31:13.903Z Last Updated: 2025-06-26T15:50:30.180Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: Xuxueli Products: xxl-sso Problem Types: CWE-79, CWE-94 Description: A vulnerability classified as problematic was found in Xuxueli xxl-sso 1.1.0. This vulnerability affects unknown code of the file /xxl-sso-server/login. The manipulation of the argument errorMsg leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - C
used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.313966 - https://vuldb.com/?ctiid.313966 - https://vuldb.com/?submit.597456 - https://github.com/ShenxiuSec/cve-proofs/blob/main/POC-20250616-01/report.md
CVE ID: CVE-2025-6701 State: PUBLISHED Published: 2025-06-26T16:00:13.773Z Last Updated: 2025-06-27T13:32:40.852Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: Xuxueli Products: xxl-sso Problem Types: CWE-601 Description: A vulnerability, which was classified as problematic, has been found in Xuxueli xxl-sso 1.1.0. This issue affects some unknown processing of the file /xxl-sso-server/doLogin. The manipulation of the argument redirect_url leads to open redirect. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analys
and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.313967 - https://vuldb.com/?ctiid.313967 - https://vuldb.com/?submit.597472 - https://github.com/ShenxiuSec/cve-proofs/blob/main/POC-20250616-02.md
CVE ID: CVE-2025-6702 State: PUBLISHED Published: 2025-06-26T16:00:16.356Z Last Updated: 2025-06-27T13:18:23.188Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R) Vendors: linlinjava Products: litemall Problem Types: CWE-285, CWE-266 Description: A vulnerability, which was classified as problematic, was found in linlinjava litemall 1.8.0. Affected is an unknown function of the file /wx/comment/post. The manipulation of the argument adminComment leads to improper authorization. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond
s been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.313968 - https://vuldb.com/?ctiid.313968 - https://vuldb.com/?submit.597473 - https://ctf-n0el4kls.notion.site/Litemall-Mass-Assignment-Vulnerability-in-wx-comment-post-21441990f447808b86d1cb15e37ecae9?source=copy_link
CVE ID: CVE-2025-6703 State: PUBLISHED Published: 2025-06-26T09:30:03.893Z Last Updated: 2025-06-26T12:59:56.348Z Vendors: Mozilla Products: neqo Problem Types: CWE-20 Description: Improper Input Validation vulnerability in Mozilla neqo leads to an unexploitable crash..This issue affects neqo: from 0.4.24 through 0.13.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/mozilla/neqo/security/advisories/GHSA-jfv6-x22w-grhf
CVE ID: CVE-2025-6704 State: PUBLISHED Published: 2025-07-21T13:16:29.613Z Last Updated: 2025-07-21T15:07:07.062Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Sophos Products: Sophos Firewall Problem Types: CWE-78 Description: An arbitrary file writing vulnerability in the Secure PDF eXchange (SPX) feature of Sophos Firewall versions older than 21.0 MR2 (21.0.2) can lead to pre-auth remote code execution, if a specific configuration of SPX is enabled in combination with the firewall running in High Availability (HA) mode. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.sophos.com/en-us/security-advisories/sophos-sa-20250721-
alyst Notes: - CISA ADP Vulnrichment: References: - https://www.sophos.com/en-us/security-advisories/sophos-sa-20250721-sfos-rce
CVE ID: CVE-2025-6705 State: PUBLISHED Published: 2025-06-27T14:57:06.595Z Last Updated: 2025-07-02T06:58:28.586Z Vendors: Eclipse Foundation Products: Eclipse Open VSX Registry Problem Types: CWE-913, CWE-653 Description: A vulnerability in the Eclipse Open VSX Registry’s automated publishing system could have allowed unauthorized uploads of extensions. Specifically, the system’s build scripts were executed without proper isolation, potentially exposing a privileged token. This token enabled the publishing of new extension versions under any namespace, including those not controlled by an attacker. However, it did not permit deletion of existing extensions, overwriting of published versions
controlled by an attacker. However, it did not permit deletion of existing extensions, overwriting of published versions, or access to administrative features of the registry. The issue was reported on May 4, 2025, fully resolved by June 24, and followed by a comprehensive audit. No evidence of compromise was found, though 81 extensions were proactively deactivated as a precaution. The standard publishing process remained unaffected. Recommendations have been issued to mitigate similar risks in the future. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://open-vsx.org - https://github.com/EclipseFdn/publish-extensions/pull/881
CVE ID: CVE-2025-6706 State: PUBLISHED Published: 2025-06-26T14:00:22.802Z Last Updated: 2025-06-26T17:40:45.307Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: MongoDB Inc Products: MongoDB Server Problem Types: CWE-416 Description: An authenticated user may trigger a use after free that may result in MongoDB Server crash and other unexpected behavior, even if the user does not have authorization to shut down a server. The crash is triggered on affected versions by issuing an aggregation framework operation using a specific combination of rarely-used aggregation pipeline expressions. This issue affects MongoDB Server v6.0 version prior to 6.0.21, MongoDB Ser
arely-used aggregation pipeline expressions. This issue affects MongoDB Server v6.0 version prior to 6.0.21, MongoDB Server v7.0 version prior to 7.0.17 and MongoDB Server v8.0 version prior to 8.0.4 when the SBE engine is enabled. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://jira.mongodb.org/browse/SERVER-106746
CVE ID: CVE-2025-6707 State: PUBLISHED Published: 2025-06-26T14:04:46.283Z Last Updated: 2025-06-27T03:55:27.008Z Severity: MEDIUM (CVSS 4.2 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: MongoDB Inc Products: MongoDB Server Problem Types: CWE-863 Description: Under certain conditions, an authenticated user request may execute with stale privileges following an intentional change by an authorized administrator. This issue affects MongoDB Server v5.0 version prior to 5.0.31, MongoDB Server v6.0 version prior to 6.0.24, MongoDB Server v7.0 version prior to 7.0.21 and MongoDB Server v8.0 version prior to 8.0.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://jir
MongoDB Server v8.0 version prior to 8.0.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://jira.mongodb.org/browse/SERVER-93497
CVE ID: CVE-2025-6709 State: PUBLISHED Published: 2025-06-26T14:07:04.979Z Last Updated: 2025-06-26T17:39:12.683Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: MongoDB Inc Products: MongoDB Server Problem Types: CWE-20 Description: The MongoDB Server is susceptible to a denial of service vulnerability due to improper handling of specific date values in JSON input when using OIDC authentication. This can be reproduced using the mongo shell to send a malicious JSON payload leading to an invariant failure and server crash. This issue affects MongoDB Server v7.0 versions prior to 7.0.17 and MongoDB Server v8.0 versions prior to 8.0.5. The same issue affects Mong
ongoDB Server v7.0 versions prior to 7.0.17 and MongoDB Server v8.0 versions prior to 8.0.5. The same issue affects MongoDB Server v6.0 versions prior to 6.0.21, but an attacker can only induce denial of service after authenticating. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://jira.mongodb.org/browse/SERVER-106748
CVE ID: CVE-2025-6710 State: PUBLISHED Published: 2025-06-26T14:09:29.581Z Last Updated: 2025-06-26T17:35:01.659Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: MongoDB Inc Products: MongoDB Server Problem Types: CWE-674 Description: MongoDB Server may be susceptible to stack overflow due to JSON parsing mechanism, where specifically crafted JSON inputs may induce unwarranted levels of recursion, resulting in excessive stack space consumption. Such inputs can lead to a stack overflow that causes the server to crash which could occur pre-authorisation. This issue affects MongoDB Server v7.0 versions prior to 7.0.17 and MongoDB Server v8.0 versions prior to 8.0
orisation. This issue affects MongoDB Server v7.0 versions prior to 7.0.17 and MongoDB Server v8.0 versions prior to 8.0.5. The same issue affects MongoDB Server v6.0 versions prior to 6.0.21, but an attacker can only induce denial of service after authenticating. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://jira.mongodb.org/browse/SERVER-106749
CVE ID: CVE-2025-6711 State: PUBLISHED Published: 2025-07-07T14:42:16.562Z Last Updated: 2025-07-07T14:58:08.477Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: MongoDB Inc Products: MongoDB Server Problem Types: CWE-532 Description: An issue has been identified in MongoDB Server where unredacted queries may inadvertently appear in server logs when certain error conditions are encountered. This issue affects MongoDB Server v8.0 versions prior to 8.0.5, MongoDB Server v7.0 versions prior to 7.0.18 and MongoDB Server v6.0 versions prior to 6.0.21. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://jira.mongodb.org/browse/SERVER-98720