Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-54036 State: PUBLISHED Published: 2025-07-16T10:36:48.274Z Last Updated: 2025-07-16T20:01:34.768Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Webba Appointment Booking Products: Webba Booking Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Webba Appointment Booking Webba Booking allows Cross Site Request Forgery. This issue affects Webba Booking: from n/a through 5.1.20. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/webba-booking-lite/vulnerability/wordpress-webba-booking-plugin-5-1-20-cross-site-request-forgery-csrf-vulnerability?_
n/webba-booking-lite/vulnerability/wordpress-webba-booking-plugin-5-1-20-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2025-54037 State: PUBLISHED Published: 2025-07-16T10:36:48.754Z Last Updated: 2025-07-16T20:02:00.434Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) Vendors: blazethemes Products: News Kit Elementor Addons Problem Types: CWE-862 Description: Missing Authorization vulnerability in blazethemes News Kit Elementor Addons allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects News Kit Elementor Addons: from n/a through 1.3.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/news-kit-elementor-addons/vulnerability/wordpress-news-kit-elementor-addons-plugin-1-
tack.com/database/wordpress/plugin/news-kit-elementor-addons/vulnerability/wordpress-news-kit-elementor-addons-plugin-1-3-4-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-54038 State: PUBLISHED Published: 2025-07-16T10:36:49.236Z Last Updated: 2025-07-16T20:02:41.031Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: jetmonsters Products: Restaurant Menu by MotoPress Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in jetmonsters Restaurant Menu by MotoPress allows Cross Site Request Forgery. This issue affects Restaurant Menu by MotoPress: from n/a through 2.4.6. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/mp-restaurant-menu/vulnerability/wordpress-restaurant-menu-by-motopress-plugin-2-4-6-cross-site-reques
/wordpress/plugin/mp-restaurant-menu/vulnerability/wordpress-restaurant-menu-by-motopress-plugin-2-4-6-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2025-54039 State: PUBLISHED Published: 2025-07-16T10:36:49.823Z Last Updated: 2025-07-16T20:03:04.643Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Toast Plugins Products: Animator Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Toast Plugins Animator allows Cross Site Request Forgery. This issue affects Animator: from n/a through 3.0.16. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/scroll-triggered-animations/vulnerability/wordpress-animator-plugin-3-0-16-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2025-54040 State: PUBLISHED Published: 2025-08-20T08:02:58.162Z Last Updated: 2025-08-20T15:01:30.101Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) Vendors: Webba Appointment Booking Products: Webba Booking Problem Types: CWE-862 Description: Missing Authorization vulnerability in Webba Appointment Booking Webba Booking allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Webba Booking: from n/a through 5.1.20. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/webba-booking-lite/vulnerability/wordpress-webba-booking-5-1-20-broken-access-control-vulner
m/database/wordpress/plugin/webba-booking-lite/vulnerability/wordpress-webba-booking-5-1-20-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-54041 State: PUBLISHED Published: 2025-07-16T10:36:50.294Z Last Updated: 2025-07-16T20:03:35.172Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: WP Swings Products: Wallet System for WooCommerce Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in WP Swings Wallet System for WooCommerce allows Cross Site Request Forgery. This issue affects Wallet System for WooCommerce: from n/a through 2.6.7. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wallet-system-for-woocommerce/vulnerability/wordpress-wallet-system-for-woocommerce-plugin-2-6-7-cross-
wordpress/plugin/wallet-system-for-woocommerce/vulnerability/wordpress-wallet-system-for-woocommerce-plugin-2-6-7-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2025-54042 State: PUBLISHED Published: 2025-07-16T10:36:50.745Z Last Updated: 2025-07-16T20:04:03.869Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: xfinitysoft Products: WP Post Hide Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in xfinitysoft WP Post Hide allows Cross Site Request Forgery. This issue affects WP Post Hide: from n/a through 1.0.9. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wp-post-hide/vulnerability/wordpress-wp-post-hide-plugin-1-0-9-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2025-54043 State: PUBLISHED Published: 2025-07-16T10:36:51.266Z Last Updated: 2025-07-16T20:06:55.130Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L) Vendors: YayCommerce Products: SMTP for Amazon SES Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in YayCommerce SMTP for Amazon SES allows SQL Injection. This issue affects SMTP for Amazon SES: from n/a through 1.9. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/smtp-amazon-ses/vulnerability/wordpress-smtp-for-amazon-ses-plugin-1-9-sql-injection-vulnerabili
tabase/wordpress/plugin/smtp-amazon-ses/vulnerability/wordpress-smtp-for-amazon-ses-plugin-1-9-sql-injection-vulnerability?_s_id=cve
CVE ID: CVE-2025-54044 State: PUBLISHED Published: 2025-08-20T08:02:57.647Z Last Updated: 2025-08-20T15:04:56.499Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: _CreativeMedia_ Products: Elite Video Player Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in _CreativeMedia_ Elite Video Player allows Reflected XSS. This issue affects Elite Video Player: from n/a through 10.0.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/elite-video-player/vulnerability/wordpress-elite-video-player-10-0-5-cross-site-scriptin
k.com/database/wordpress/plugin/elite-video-player/vulnerability/wordpress-elite-video-player-10-0-5-cross-site-scripting-xss-vulnerability-2?_s_id=cve
CVE ID: CVE-2025-54046 State: PUBLISHED Published: 2025-08-20T08:02:57.124Z Last Updated: 2025-08-20T15:05:42.101Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: QuanticaLabs Products: Cost Calculator Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in QuanticaLabs Cost Calculator allows Stored XSS. This issue affects Cost Calculator: from n/a through 7.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/ql-cost-calculator/vulnerability/wordpress-cost-calculator-plugin-7-4-cross-site-scripting-xss-vulnerabilit
press/plugin/ql-cost-calculator/vulnerability/wordpress-cost-calculator-plugin-7-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-54047 State: PUBLISHED Published: 2025-07-16T10:36:51.744Z Last Updated: 2025-07-16T20:07:32.560Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: QuanticaLabs Products: Cost Calculator Problem Types: CWE-862 Description: Missing Authorization vulnerability in QuanticaLabs Cost Calculator allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Cost Calculator: from n/a through 7.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/ql-cost-calculator/vulnerability/wordpress-cost-calculator-plugin-7-4-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-54048 State: PUBLISHED Published: 2025-08-20T08:02:56.540Z Last Updated: 2025-08-20T15:09:43.509Z Severity: CRITICAL (CVSS 9.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L) Vendors: miniOrange Products: Custom API for WP Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in miniOrange Custom API for WP allows SQL Injection. This issue affects Custom API for WP: from n/a through 4.2.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/custom-api-for-wp/vulnerability/wordpress-custom-api-for-wp-4-2-2-sql-injection-vulnerability?_s_i
base/wordpress/plugin/custom-api-for-wp/vulnerability/wordpress-custom-api-for-wp-4-2-2-sql-injection-vulnerability?_s_id=cve
CVE ID: CVE-2025-54049 State: PUBLISHED Published: 2025-08-20T08:02:55.961Z Last Updated: 2025-08-26T18:52:06.023Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: miniOrange Products: Custom API for WP Problem Types: CWE-266 Description: Incorrect Privilege Assignment vulnerability in miniOrange Custom API for WP allows Privilege Escalation. This issue affects Custom API for WP: from n/a through 4.2.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/custom-api-for-wp/vulnerability/wordpress-custom-api-for-wp-4-2-2-privilege-escalation-vulnerability?_s_id=cve
CVE ID: CVE-2025-54050 State: PUBLISHED Published: 2025-07-16T10:36:52.246Z Last Updated: 2025-07-16T20:08:14.512Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: CyberChimps Products: Responsive Addons for Elementor Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CyberChimps Responsive Addons for Elementor allows Stored XSS. This issue affects Responsive Addons for Elementor: from n/a through 1.7.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/responsive-addons-for-elementor/vulnerability/wordpress-res
ferences: - https://patchstack.com/database/wordpress/plugin/responsive-addons-for-elementor/vulnerability/wordpress-responsive-addons-for-elementor-plugin-1-7-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-54051 State: PUBLISHED Published: 2025-07-16T10:36:52.703Z Last Updated: 2025-07-16T20:10:30.122Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: bPlugins Products: LightBox Block Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins LightBox Block allows Stored XSS. This issue affects LightBox Block: from n/a through 1.1.30. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/lightbox-block/vulnerability/wordpress-lightbox-block-plugin-1-1-30-cross-site-scripting-xss-vulnerability?_s_id=cv
ugin/lightbox-block/vulnerability/wordpress-lightbox-block-plugin-1-1-30-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-54052 State: PUBLISHED Published: 2025-08-20T08:02:55.255Z Last Updated: 2025-08-20T15:14:20.750Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Realtyna Products: Realtyna Organic IDX plugin Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Realtyna Realtyna Organic IDX plugin allows PHP Local File Inclusion. This issue affects Realtyna Organic IDX plugin: from n/a through 5.0.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/real-estate-listing-realtyna-wpl/vulnerability/wordpress-realtyna-organic-idx-plugin-plugin-5-0-0-local-file-inclus
ugin/real-estate-listing-realtyna-wpl/vulnerability/wordpress-realtyna-organic-idx-plugin-plugin-5-0-0-local-file-inclusion-vulnerability?_s_id=cve
CVE ID: CVE-2025-54053 State: PUBLISHED Published: 2025-08-20T08:02:54.742Z Last Updated: 2025-08-20T15:14:26.786Z Severity: MEDIUM (CVSS 6.6 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Adrian Tobey Products: Groundhogg Problem Types: CWE-502 Description: Deserialization of Untrusted Data vulnerability in Adrian Tobey Groundhogg allows Object Injection. This issue affects Groundhogg: from n/a through 4.2.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/groundhogg/vulnerability/wordpress-groundhogg-4-2-2-php-object-injection-vulnerability?_s_id=cve
CVE ID: CVE-2025-54054 State: PUBLISHED Published: 2025-08-14T18:21:48.649Z Last Updated: 2025-08-14T19:59:37.805Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: AA Web Servant Products: 12 Step Meeting List Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AA Web Servant 12 Step Meeting List allows Stored XSS. This issue affects 12 Step Meeting List: from n/a through 3.18.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/12-step-meeting-list/vulnerability/wordpress-12-step-meeting-list-plugin-plugin-3-18-
tack.com/database/wordpress/plugin/12-step-meeting-list/vulnerability/wordpress-12-step-meeting-list-plugin-plugin-3-18-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-54055 State: PUBLISHED Published: 2025-08-20T08:02:54.222Z Last Updated: 2025-08-20T15:14:33.402Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: skygroup Products: Druco Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in skygroup Druco allows Reflected XSS. This issue affects Druco: from n/a through 1.5.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/theme/druco/vulnerability/wordpress-druco-1-5-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-54056 State: PUBLISHED Published: 2025-08-20T08:02:53.635Z Last Updated: 2025-08-20T15:14:40.591Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: LambertGroup Products: Responsive HTML5 Audio Player PRO With Playlist Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup Responsive HTML5 Audio Player PRO With Playlist allows Reflected XSS. This issue affects Responsive HTML5 Audio Player PRO With Playlist: from n/a through 3.5.8. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/lbg-audi
ditional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/lbg-audio2-html5/vulnerability/wordpress-responsive-html5-audio-player-pro-with-playlist-3-5-8-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-54058 State: PUBLISHED Published: 2025-07-17T14:09:46.878Z Last Updated: 2025-07-17T19:58:19.682Z Vendors: LabRedesCefetRJ Products: WeGIA Problem Types: CWE-89 Description: WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A SQL Injection vulnerability was identified in versions prior to 3.4.6 in the `idatendido_familiares` parameter of the `/html/funcionario/dependente_editarEndereco.php` endpoint. This vulnerability allows attacker to manipulate SQL queries and access sensitive database information, such as table names and sensitive data. Version 3.4.6 fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment
such as table names and sensitive data. Version 3.4.6 fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-5pwp-39jc-wxj8
CVE ID: CVE-2025-54059 State: PUBLISHED Published: 2025-07-18T15:40:43.277Z Last Updated: 2025-07-18T16:04:30.154Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) Vendors: chainguard-dev Products: melange Problem Types: CWE-276 Description: melange allows users to build apk packages using declarative pipelines. Starting in version 0.23.0 and prior to version 0.29.5, SBOM files generated by melange in apks had file system permissions mode 666. This potentially allows an unprivileged user to tamper with apk SBOMs on a running image, potentially confusing security scanners. An attacker could also perform a DoS under special circumstances. Version 0.29.5 fixes the issue.
ing security scanners. An attacker could also perform a DoS under special circumstances. Version 0.29.5 fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/chainguard-dev/melange/security/advisories/GHSA-5662-cv6m-63wh - https://github.com/chainguard-dev/melange/pull/1836 - https://github.com/chainguard-dev/melange/pull/2086 - https://github.com/chainguard-dev/melange/commit/1b272db2a0bb3441553284cc56d87236b4b64c04 - https://github.com/chainguard-dev/melange/commit/e29494b4a40a91619ec1c87a09003c6d5164cea1 - https://github.com/chainguard-dev/melange/releases/tag/v0.23.0 - https://github.com/chainguard-dev/melange/releases/tag/v0.29.5
CVE ID: CVE-2025-54060 State: PUBLISHED Published: 2025-07-17T14:17:54.158Z Last Updated: 2025-07-17T19:59:16.415Z Vendors: LabRedesCefetRJ Products: WeGIA Problem Types: CWE-89 Description: WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A SQL Injection vulnerability was identified in versions prior to 3.4.6 in the `idatendido_familiares` parameter of the `/html/funcionario/dependente_editarInfoPessoal.php` endpoint. This vulnerability allows attacker to manipulate SQL queries and access sensitive database information, such as table names and sensitive data. Version 3.4.6 fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichm
n, such as table names and sensitive data. Version 3.4.6 fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-mw78-c4f6-2hq7
CVE ID: CVE-2025-54061 State: PUBLISHED Published: 2025-07-17T14:30:21.098Z Last Updated: 2025-07-17T20:00:28.456Z Vendors: LabRedesCefetRJ Products: WeGIA Problem Types: CWE-89 Description: WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A SQL Injection vulnerability was identified in versions prior to 3.4.6 in the `idatendido_familiares` parameter of the `/html/funcionario/dependente_editarDoc.php` endpoint. This vulnerability allows attacker to manipulate SQL queries and access sensitive database information, such as table names and sensitive data. Version 3.4.6 fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: Ref
as table names and sensitive data. Version 3.4.6 fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-g47q-vfpj-g9mr
CVE ID: CVE-2025-54062 State: PUBLISHED Published: 2025-07-17T14:33:27.241Z Last Updated: 2025-07-17T20:01:07.447Z Vendors: LabRedesCefetRJ Products: WeGIA Problem Types: CWE-89 Description: WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A SQL Injection vulnerability was identified in versions prior to 3.4.6 in the `/html/funcionario/profile_dependente.php` endpoint, specifically in the `id_dependente` parameter. This vulnerability allows attackers to execute arbitrary SQL commands, compromising the confidentiality, integrity, and availability of the database. Version 3.4.6 fixes the issue. Additional Analyst Notes: - CISA ADP Vulnric
integrity, and availability of the database. Version 3.4.6 fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-f53c-f6jx-cm56
CVE ID: CVE-2025-54063 State: PUBLISHED Published: 2025-08-11T17:59:40.626Z Last Updated: 2025-08-11T18:15:43.581Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: CherryHQ Products: cherry-studio Problem Types: CWE-94 Description: Cherry Studio is a desktop client that supports for multiple LLM providers. From versions 1.4.8 to 1.5.0, there is a one-click remote code execution vulnerability through the custom URL handling. An attacker can exploit this by hosting a malicious website or embedding a specially crafted URL on any website. If a victim clicks the exploit link in their browser, the app’s custom URL handler is triggered, leading to remote code execution
m clicks the exploit link in their browser, the app’s custom URL handler is triggered, leading to remote code execution on the victim’s machine. This issue has been patched in version 1.5.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/CherryHQ/cherry-studio/security/advisories/GHSA-p6vw-w3p8-4g72 - https://github.com/CherryHQ/cherry-studio/pull/8218 - https://github.com/CherryHQ/cherry-studio/commit/ff72c007c03ff47de21a4d0bf52a1ff1fb35cd89
CVE ID: CVE-2025-54064 State: PUBLISHED Published: 2025-07-17T14:40:59.619Z Last Updated: 2025-07-17T20:01:54.062Z Vendors: rucio Products: helm-charts Problem Types: CWE-532 Description: Rucio is a software framework that provides functionality to organize, manage, and access large volumes of scientific data using customizable policies. The common Rucio helm-charts for the `rucio-server`, `rucio-ui`, and `rucio-webui` define the log format for the apache access log of these components. The `X-Rucio-Auth-Token`, which is part of each request header sent to Rucio, is part of this log format. Thus, each access log line potentially exposes the credentials (Internal Rucio token, or JWT in case o
this log format. Thus, each access log line potentially exposes the credentials (Internal Rucio token, or JWT in case of OIDC authentication) of the user. Due to the length of the token (Especially for a JWT) the tokens are often truncated, and thus not usable as credential; nevertheless, the (partial) credential should not be part of the logfile. The impact of this issue is amplified if the access logs are made available to a larger group of people than the instance administrators themselves. An updated release has been supplied for the `rucio-server`, `rucio-ui` and `rucio-webui` helm-chart. The change was also retrofitted for the currently supported Rucio LTS releases. The patched versio
io-webui` helm-chart. The change was also retrofitted for the currently supported Rucio LTS releases. The patched versions are rucio-server 37.0.2, 35.0.1, and 32.0.1; rucio-ui 37.0.4, 35.0.1, and 32.0.2; and rucio-webui 37.0.2, 35.1.1, and 32.0.1. As a workaround, one may update the `logFormat` variable and remove the `X-Rucio-Auth-Token`. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/rucio/helm-charts/security/advisories/GHSA-cmfq-f2v2-vj33