deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-1502
Published: 2025-03-01
Description: The IP2Location Redirection plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'download_ip2location_redirection_backup' AJAX action in all versions up to, and including, 1.33.3. This makes it possible for unauthenticated attackers to download the plugin's settings.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3244195%40ip2location-redirection&new=3244195%40ip2location-redirection&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/bca41dd8-5bd3-4fee-9f3f-feb8f1a4c687?source=cve
CVE: CVE-2025-1730
Published: 2025-03-01
Description: The Simple Download Counter plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 2.0 via the 'simple_download_counter_download_handler'. This makes it possible for authenticated attackers, with Author-level access and above, to extract sensitive data including any local file on the server, such as wp-config.php or /etc/passwd.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-73
References: https://plugins.trac.wordpress.org/browser/simple-download-counter/tags/2.0/inc/functions-core.php#L328; https://plugins.trac.wordpress.org/browser/simple-download-counter/tags/2.0/inc/functions-core.php#L354; https://plugins.trac.wordpress.org/changeset/3247987/
CVE: CVE-2024-12544
Published: 2025-03-01
Description: The SurveyJS: Drag & Drop WordPress Form Builder to create, style and embed multiple forms of any complexity plugin for WordPress is vulnerable to arbitrary file deletion due to a missing capability check on the callback function of the SurveyJS_DeleteFile class in all versions up to, and including, 1.12.17. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). This function is still vulnerable to Cross-Site Request Forgery as of 1.12.20.
CVSS Score: 8.8 (HIGH)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/changeset/3214665/; https://plugins.trac.wordpress.org/changeset/3222216/surveyjs/trunk/ajax_handlers/delete_file.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/e9404fe4-855e-4eb4-81c4-5246f6e9be0c?source=cve
CVE: CVE-2024-13806
Published: 2025-03-01
Description: The The Authors List plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.0.6. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-94
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3246757%40authors-list&new=3246757%40authors-list&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/dbfa20ad-6411-4054-9973-cb12d17c57f6?source=cve
CVE: CVE-2024-13911
Published: 2025-03-01
Description: The Database Backup and check Tables Automated With Scheduler 2024 plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.35 via the /dashboard/backup.php file. This makes it possible for authenticated attackers, with Administrator-level access and above, to extract sensitive data including full database credentials.
CVSS Score: 7.2 (HIGH)
CWE: CWE-200
References: https://plugins.trac.wordpress.org/browser/database-backup/trunk/dashboard/backup.php#L62; https://plugins.trac.wordpress.org/browser/database-backup/trunk/dashboard/backup.php#L63; https://plugins.trac.wordpress.org/browser/database-backup/trunk/dashboard/backup.php#L64
CVE: CVE-2025-1564
Published: 2025-03-01
Description: The SetSail Membership plugin for WordPress is vulnerable to  in all versions up to, and including, 1.0.3. This is due to the plugin not properly verifying a users identity through the social login. This makes it possible for unauthenticated attackers to log in as any user, including administrators and take over access to their account.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-288
References: https://themeforest.net/item/setsail-travel-agency-theme/22832625; https://www.wordfence.com/threat-intel/vulnerabilities/id/c2c2385e-0d1e-435a-9b82[PII_REDACTED]48?source=cve
CVE: CVE-2025-1638
Published: 2025-03-01
Description: The Alloggio Membership plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.0.2. This is due to the plugin not properly validating a user's identity through the alloggio_membership_init_rest_api_facebook_login and alloggio_membership_init_rest_api_google_login functions. This makes it possible for unauthenticated attackers to log in as any user, including administrators, without knowing a password.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-288
References: https://themeforest.net/item/alloggio-hotel-booking-theme/26775539; https://www.wordfence.com/threat-intel/vulnerabilities/id/60405e54-e869-4623-892c-0821014f887b?source=cve
CVE: CVE-2025-1671
Published: 2025-03-01
Description: The Academist Membership plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.1.6. This is due to the academist_membership_check_facebook_user() function not properly verifying a user's identity prior to authenticating them. This makes it possible for unauthenticated attackers to log in as any user, including site administrators.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-288
References: https://themeforest.net/item/academist-a-modern-learning-management-system-and-education-theme/22376830; https://www.wordfence.com/threat-intel/vulnerabilities/id/911a9550-1f62-4f28-9d8c-00d9769949c9?source=cve
CVE: CVE-2024-13611
Published: 2025-03-01
Description: The Better Messages – Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.6.9 via the 'bp-better-messages' directory. This makes it possible for unauthenticated attackers to extract sensitive data stored insecurely in the /wp-content/uploads/bp-better-messages directory which can contain file attachments included in chat messages.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://plugins.trac.wordpress.org/browser/bp-better-messages/trunk/addons/files.php; https://plugins.trac.wordpress.org/changeset/3228957/; https://www.wordfence.com/threat-intel/vulnerabilities/id/997918b9-2ccd-413e-9df2-d24bc3820ba1?source=cve
CVE: CVE-2024-13697
Published: 2025-03-01
Description: The Better Messages – Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.7.4 via the 'nice_links'. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. Successful exploitation requires the "Enable link previews" to be enabled (default).
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-918
References: https://plugins.trac.wordpress.org/changeset/3243180/bp-better-messages; https://www.wordfence.com/threat-intel/vulnerabilities/id/b67710d7-976b-4a65-bad3-091a97aceb00?source=cve
CVE: CVE-2024-13910
Published: 2025-03-01
Description: The Database Backup and check Tables Automated With Scheduler 2024 plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'database_backup_ajax_delete' function in all versions up to, and including, 2.35. This makes it possible for authenticated attackers, with Administrator-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). The vulnerability was partially patched in version 2.36.
CVSS Score: 7.2 (HIGH)
CWE: CWE-22
References: https://plugins.trac.wordpress.org/browser/database-backup/trunk/database-backup.php#L267; https://plugins.trac.wordpress.org/changeset/3247917/; https://plugins.trac.wordpress.org/changeset/3248708/
CVE: CVE-2025-1291
Published: 2025-03-01
Description: The Gutenberg Blocks with AI by Kadence WP – Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘icon’ parameter in all versions up to, and including, 3.4.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/kadence-blocks/trunk/includes/blocks/class-kadence-blocks-testimonial-block.php#L219; https://plugins.trac.wordpress.org/changeset/3246675/; https://www.wordfence.com/threat-intel/vulnerabilities/id/9df00907-c95e-445c-b424-78a1e5e00e4f?source=cve
CVE: CVE-2024-13546
Published: 2025-03-01
Description: The GenerateBlocks plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.9.1 via the 'get_image_description' function. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive data including the content of private, draft, and scheduled posts and pages.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: https://plugins.trac.wordpress.org/browser/generateblocks/trunk/includes/class-dynamic-content.php#L1047; https://plugins.trac.wordpress.org/browser/generateblocks/trunk/includes/class-dynamic-content.php#L1054; https://plugins.trac.wordpress.org/changeset/3239461/
CVE: CVE-2025-1786
Published: 2025-03-01
Description: A vulnerability was found in rizinorg rizin up to 0.7.4. It has been rated as critical. This issue affects the function msf_stream_directory_free in the library /librz/bin/pdb/pdb.c. The manipulation of the argument -P leads to buffer overflow. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. Upgrading to version 0.8.0 is able to address this issue. It is recommended to upgrade the affected component.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-119, CWE-120
References: https://github.com/rizinorg/rizin/issues/4893; https://github.com/rizinorg/rizin/milestone/18; https://github.com/user-attachments/files/18765730/rz-bin-6fb50-poc.zip
CVE: CVE-2024-13833
Published: 2025-03-01
Description: The Album Gallery – WordPress Gallery plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.6.3 via deserialization of untrusted input from gallery meta. This makes it possible for authenticated attackers, with Editor-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present.
CVSS Score: 7.2 (HIGH)
CWE: CWE-502
References: https://plugins.trac.wordpress.org/changeset/3246291/new-album-gallery; https://www.wordfence.com/threat-intel/vulnerabilities/id/cc7075a6-5609-42ab-a4cb-9d33686c7de0?source=cve
CVE: CVE-2025-1404
Published: 2025-03-01
Description: The Secure Copy Content Protection and Content Locking plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the ays_sccp_reports_user_search() function in all versions up to, and including, 4.4.7. This makes it possible for unauthenticated attackers to retrieve a list of registered user emails.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/secure-copy-content-protection/tags/4.4.6/admin/class-secure-copy-content-protection-admin.php#L943; https://plugins.trac.wordpress.org/browser/secure-copy-content-protection/tags/4.4.6/admin/js/secure-copy-content-protection-admin.js; https://plugins.trac.wordpress.org/changeset/3246301
CVE: CVE-2025-1491
Published: 2025-03-01
Description: The WP Posts Carousel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘auto_play_timeout’ parameter in all versions up to, and including, 1.3.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset/3248502/; https://wordpress.org/plugins/wp-posts-carousel/#developers; https://www.wordfence.com/threat-intel/vulnerabilities/id/7f708c72-7ce2-4eb0-869b-cec4613f6f3f?source=cve
CVE: CVE-2025-1788
Published: 2025-03-01
Description: A vulnerability, which was classified as critical, was found in rizinorg rizin up to 0.8.0. This affects the function rz_utf8_encode in the library /librz/util/utf8.c. The manipulation leads to heap-based buffer overflow. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-119, CWE-122
References: https://github.com/rizinorg/rizin/issues/4910; https://github.com/rizinorg/rizin/issues/4910#issuecomment[PII_REDACTED]; https://github.com/rizinorg/rizin/pull/4762
CVE: CVE-2025-1791
Published: 2025-03-01
Description: A vulnerability has been found in Zorlan SkyCaiji 2.9 and classified as critical. This vulnerability affects the function fileAction of the file vendor/skycaiji/app/admin/controller/Tool.php. The manipulation of the argument save_data leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-284, CWE-434, CWE-434
References: https://github.com/sheratan4/cve/issues/5; https://vuldb.com/?ctiid.298012; https://vuldb.com/?id.298012
CVE: CVE-2024-41778
Published: 2025-03-01
Description: IBM Controller 11.0.0 through 11.0.1 and 11.1.0 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-521
References: https://www.ibm.com/support/pages/node/7184423
CVE: CVE-2025-1797
Published: 2025-03-01
Description: A vulnerability, which was classified as critical, has been found in Hunan Zhonghe Baiyi Information Technology Baiyiyun Asset Management and Operations System up to 20250217. Affected by this issue is some unknown functionality of the file /wuser/anyUserBoundHouse.php. The manipulation of the argument huid leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://github.com/chichi24-ver/CVE/blob/main/CVE_1.md; https://vuldb.com/?ctiid.298028; https://vuldb.com/?id.298028
CVE: CVE-2025-1799
Published: 2025-03-01
Description: A vulnerability, which was classified as critical, was found in Zorlan SkyCaiji 2.9. This affects the function previewAction of the file vendor/skycaiji/app/admin/controller/Tool.php. The manipulation of the argument data leads to server-side request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-918
References: https://github.com/sheratan4/cve/issues/6; https://vuldb.com/?ctiid.298029; https://vuldb.com/?id.298029
CVE: CVE-2025-1800
Published: 2025-03-01
Description: A vulnerability has been found in D-Link DAR-7000 3.2 and classified as critical. This vulnerability affects the function get_ip_addr_details of the file /view/vpn/sxh_vpn/sxh_vpnlic.php of the component HTTP POST Request Handler. The manipulation of the argument ethname leads to command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-77, CWE-77
References: https://github.com/sjwszt/CVE/blob/main/CVE_1.md; https://vuldb.com/?ctiid.298030; https://vuldb.com/?id.298030
CVE: CVE-2025-1804
Published: 2025-03-01
Description: A vulnerability was found in Blizzard Battle.Net up to 2.39.0.15212 on Windows and classified as critical. Affected by this issue is some unknown functionality in the library profapi.dll. The manipulation leads to uncontrolled search path. The attack needs to be approached locally. The complexity of an attack is rather high. The exploitation is known to be difficult. The vendor assigns this issue a low risk level.
CVSS Score: 7.0 (HIGH)
CWE: CWE-426, CWE-427
References: https://vuldb.com/?ctiid.298040; https://vuldb.com/?id.298040; https://vuldb.com/?submit.485034
CVE: CVE-2025-1806
Published: 2025-03-02
Description: A vulnerability, which was classified as problematic, has been found in Eastnets PaymentSafe 2.5.26.0. Affected by this issue is some unknown functionality of the file /Default.aspx of the component URL Handler. The manipulation leads to improper authorization. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 2.5.27.0 is able to address this issue.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-266, CWE-285
References: https://drive.google.com/file/d/1WT5mJwL9NvKxBLIIj7TDbeAq6dchs5Gk/view?usp=sharing; https://vuldb.com/?ctiid.298064; https://vuldb.com/?id.298064
CVE: CVE-2025-1807
Published: 2025-03-02
Description: A vulnerability, which was classified as problematic, was found in Eastnets PaymentSafe 2.5.26.0. This affects an unknown part of the file /directRouter.rfc of the component Edit Manual Reply Handler. The manipulation of the argument Title leads to basic cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 2.5.27.0 is able to address this issue.
CVSS Score: 3.5 (LOW)
CWE: CWE-74, CWE-80
References: https://drive.google.com/file/d/1-4BwJxzKUdVRsi6PYh68mKzeIPAqug1Q/view; https://vuldb.com/?ctiid.298065; https://vuldb.com/?id.298065
CVE: CVE-2025-1808
Published: 2025-03-02
Description: A vulnerability has been found in Pixsoft E-Saphira 1.7.24 and classified as critical. This vulnerability affects unknown code of the file /servlet?act=login&tipo=1 of the component Login Endpoint. The manipulation of the argument txtUsuario leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/yago3008/cves; https://vuldb.com/?ctiid.298066; https://vuldb.com/?id.298066
CVE: CVE-2025-25724
Published: 2025-03-02
Description: list_item_verbose in tar/util.c in libarchive through 3.7.7 does not check an strftime return value, which can lead to a denial of service or unspecified other impact via a crafted TAR archive that is read with a verbose value of 2. For example, the 100-byte buffer may not be sufficient for a custom locale.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-252
References: https://gist.github.com/Ekkosun/a83870ce7f3b7813b9b462a395e8ad92; https://github.com/Ekkosun/pocs/blob/main/bsdtarbug; https://github.com/libarchive/libarchive/blob/b439d586f53911c84be5e380445a8a259e19114c/tar/util.c#L751-L752
CVE: CVE-2025-25725
Published: 2025-03-02
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2025-25724. Reason: This candidate is a reservation duplicate of CVE-2025-25724. Notes: All CVE users should reference CVE-2025-25724 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
CVE: CVE-2025-25726
Published: 2025-03-02
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2024-53427. Reason: This candidate is a reservation duplicate of CVE-2024-53427. Notes: All CVE users should reference CVE-2024-53427 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
CVE: CVE-2025-1809
Published: 2025-03-02
Description: A vulnerability was found in Pixsoft Sol up to 7.6.6c and classified as critical. This issue affects some unknown processing of the file /pix_projetos/servlet?act=login&submit=1&evento=0&pixrnd=[PII_REDACTED][PII_REDACTED]41 of the component Login Endpoint. The manipulation of the argument txtUsuario leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/yago3008/cves; https://vuldb.com/?ctiid.298067; https://vuldb.com/?id.298067
CVE: CVE-2025-1810
Published: 2025-03-02
Description: A vulnerability was found in Pixsoft Vivaz 6.0.11. It has been classified as problematic. Affected is an unknown function of the file /servlet?act=login&submit=1&evento=0&pixrnd=[PII_REDACTED][PII_REDACTED]31 of the component Login Endpoint. The manipulation of the argument sistema leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79, CWE-94
References: https://github.com/yago3008/cves; https://vuldb.com/?ctiid.298068; https://vuldb.com/?id.298068
CVE: CVE-2025-1811
Published: 2025-03-02
Description: A vulnerability was found in AT Software Solutions ATSVD up to 3.4.1. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /login.aspx of the component Login Endpoint. The manipulation of the argument txtUsuario leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 3.4.2 is able to address this issue. It is recommended to upgrade the affected component.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/yago3008/cves; https://vuldb.com/?ctiid.298069; https://vuldb.com/?id.298069
CVE: CVE-2025-1812
Published: 2025-03-02
Description: A vulnerability classified as critical has been found in zj1983 zz up to 2024-08. Affected is the function GetUserOrg of the file com/futvan/z/framework/core/SuperZ.java. The manipulation of the argument userId leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/A7cc/cve/issues/3; https://vuldb.com/?ctiid.298080; https://vuldb.com/?id.298080
CVE: CVE-2025-1813
Published: 2025-03-02
Description: A vulnerability classified as problematic was found in zj1983 zz up to 2024-08. Affected by this vulnerability is an unknown functionality. The manipulation leads to cross-site request forgery. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352, CWE-862, CWE-352
References: https://vuldb.com/?ctiid.298081; https://vuldb.com/?id.298081; https://vuldb.com/?submit.504281