deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-50042
Published: 2025-06-20
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in aviplugins.com WP Register Profile With Shortcode wp-register-profile-with-shortcode allows Stored XSS.This issue affects WP Register Profile With Shortcode: from n/a through <= 3.6.3.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wp-register-profile-with-shortcode/vulnerability/wordpress-wp-register-profile-with-shortcode-plugin-3-6-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-50043
Published: 2025-06-20
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jordy Meow Code Engine code-engine allows Stored XSS.This issue affects Code Engine: from n/a through <= 0.3.2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/code-engine/vulnerability/wordpress-code-engine-plugin-0-3-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-50044
Published: 2025-06-20
Description: Cross-Site Request Forgery (CSRF) vulnerability in Rameez Iqbal Real Estate Manager real-estate-manager allows Cross Site Request Forgery.This issue affects Real Estate Manager: from n/a through <= 7.3.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/real-estate-manager/vulnerability/wordpress-real-estate-manager-plugin-7-3-cross-site-request-forgery-csrf-vulnerability-2?_s_id=cve
CVE: CVE-2025-50045
Published: 2025-06-20
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ProWCPlugins Related Products Manager for WooCommerce related-products-manager-woocommerce allows DOM-Based XSS.This issue affects Related Products Manager for WooCommerce: from n/a through <= 1.6.2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/related-products-manager-woocommerce/vulnerability/wordpress-related-products-manager-for-woocommerce-plugin-1-6-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-50046
Published: 2025-06-20
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in StellarWP WPComplete wpcomplete allows Stored XSS.This issue affects WPComplete: from n/a through <= 2.9.5.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wpcomplete/vulnerability/wordpress-wpcomplete-plugin-2-9-5-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-50047
Published: 2025-06-20
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webvitaly Sitekit sitekit allows Stored XSS.This issue affects Sitekit: from n/a through <= 1.9.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/sitekit/vulnerability/wordpress-sitekit-plugin-1-9-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-50048
Published: 2025-06-20
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Atakan Au Automatically Hierarchic Categories in Menu automatically-hierarchic-categories-in-menu allows Stored XSS.This issue affects Automatically Hierarchic Categories in Menu: from n/a through <= 2.0.9.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/automatically-hierarchic-categories-in-menu/vulnerability/wordpress-automatically-hierarchic-categories-in-menu-plugin-2-0-9-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-50049
Published: 2025-06-20
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in prismtechstudios Modern Footnotes modern-footnotes allows Stored XSS.This issue affects Modern Footnotes: from n/a through <= 1.4.19.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/modern-footnotes/vulnerability/wordpress-modern-footnotes-plugin-1-4-19-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-50050
Published: 2025-06-20
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BlueGlass Interactive AG Jobs for WordPress job-postings allows Stored XSS.This issue affects Jobs for WordPress: from n/a through <= 2.7.14.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/job-postings/vulnerability/wordpress-jobs-for-wordpress-plugin-2-7-12-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-50051
Published: 2025-06-20
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Chad Butler WP-Members wp-members allows Stored XSS.This issue affects WP-Members: from n/a through <= 3.5.4.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wp-members/vulnerability/wordpress-wp-members-plugin-3-5-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-52707
Published: 2025-06-20
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Firelight Firelight Lightbox easy-fancybox allows Stored XSS.This issue affects Firelight Lightbox: from n/a through <= 2.3.16.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/easy-fancybox/vulnerability/wordpress-firelight-lightbox-plugin-2-3-16-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-52708
Published: 2025-06-20
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in RealMag777 HUSKY woocommerce-products-filter allows PHP Local File Inclusion.This issue affects HUSKY: from n/a through <= 1.3.7.
CVSS Score: 7.5 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Plugin/woocommerce-products-filter/vulnerability/wordpress-husky-plugin-1-3-7-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-52710
Published: 2025-06-20
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ninja Team File Manager Pro filester allows Stored XSS.This issue affects File Manager Pro: from n/a through <= 1.8.8.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/filester/vulnerability/wordpress-file-manager-pro-plugin-1-8-8-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-52711
Published: 2025-06-20
Description: Cross-Site Request Forgery (CSRF) vulnerability in BoldGrid Post and Page Builder by BoldGrid post-and-page-builder allows Cross Site Request Forgery.This issue affects Post and Page Builder by BoldGrid: from n/a through <= 1.27.8.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/post-and-page-builder/vulnerability/wordpress-post-and-page-builder-by-boldgrid-visual-drag-and-drop-editor-plugin-1-27-8-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-52713
Published: 2025-06-20
Description: Server-Side Request Forgery (SSRF) vulnerability in BoldGrid Post and Page Builder by BoldGrid post-and-page-builder allows Server Side Request Forgery.This issue affects Post and Page Builder by BoldGrid: from n/a through <= 1.27.8.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-918
References: https://patchstack.com/database/Wordpress/Plugin/post-and-page-builder/vulnerability/wordpress-post-and-page-builder-by-boldgrid-visual-drag-and-drop-editor-plugin-1-27-8-server-side-request-forgery-ssrf-vulnerability?_s_id=cve
CVE: CVE-2025-52715
Published: 2025-06-20
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in RadiusTheme Classified Listing classified-listing allows PHP Local File Inclusion.This issue affects Classified Listing: from n/a through <= 4.2.0.
CVSS Score: 7.5 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Plugin/classified-listing/vulnerability/wordpress-classified-listing-plugin-4-2-0-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-52719
Published: 2025-06-20
Description: Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Metagauss ProfileGrid  profilegrid-user-profiles-groups-and-communities allows Retrieve Embedded Sensitive Data.This issue affects ProfileGrid : from n/a through <= 5.9.5.2.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-497
References: https://patchstack.com/database/Wordpress/Plugin/profilegrid-user-profiles-groups-and-communities/vulnerability/wordpress-profilegrid-plugin-5-9-5-2-full-path-disclosure-fpd-vulnerability?_s_id=cve
CVE: CVE-2025-52733
Published: 2025-06-20
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Anonform Ab ANON::form embedded secure form anonform-embedded-secure-form allows DOM-Based XSS.This issue affects ANON::form embedded secure form: from n/a through <= 1.7.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/anonform-embedded-secure-form/vulnerability/wordpress-anon-form-embedded-secure-form-plugin-1-7-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-52772
Published: 2025-06-20
Description: Cross-Site Request Forgery (CSRF) vulnerability in Adnan Haque (a11n) Virtual Moderator allows Cross-Site Scripting (XSS). This issue affects Virtual Moderator: from n/a through 1.4.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/wordpress/plugin/virtual-moderator/vulnerability/wordpress-virtual-moderator-plugin-1-4-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-52780
Published: 2025-06-20
Description: Cross-Site Request Forgery (CSRF) vulnerability in Mohammad Parsa Logo Manager For Samandehi samandehi-logo-manager allows Stored XSS.This issue affects Logo Manager For Samandehi: from n/a through <= 0.5.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/samandehi-logo-manager/vulnerability/wordpress-logo-manager-for-samandehi-plugin-0-5-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-52781
Published: 2025-06-20
Description: Cross-Site Request Forgery (CSRF) vulnerability in Beee TinyNav tinynav allows Stored XSS.This issue affects TinyNav: from n/a through <= 1.4.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/tinynav/vulnerability/wordpress-tinynav-plugin-1-4-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-52782
Published: 2025-06-20
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in King Rayhan Scroll UP scroll-to-up allows Reflected XSS.This issue affects Scroll UP: from n/a through <= 2.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/scroll-to-up/vulnerability/wordpress-scroll-up-plugin-2-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-52783
Published: 2025-06-20
Description: Cross-Site Request Forgery (CSRF) vulnerability in themelocation Change Cart button Colors WooCommerce wc-style allows Stored XSS.This issue affects Change Cart button Colors WooCommerce: from n/a through <= 1.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/wc-style/vulnerability/wordpress-change-cart-button-colors-woocommerce-plugin-1-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-52784
Published: 2025-06-20
Description: Cross-Site Request Forgery (CSRF) vulnerability in hideoguchi Bluff Post bluff-post allows Stored XSS.This issue affects Bluff Post: from n/a through <= 1.1.1.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/bluff-post/vulnerability/wordpress-bluff-post-plugin-1-1-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-52789
Published: 2025-06-20
Description: Cross-Site Request Forgery (CSRF) vulnerability in George Lewe Lewe ChordPress chordpress allows Stored XSS.This issue affects Lewe ChordPress: from n/a through <= 4.0.1.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/chordpress/vulnerability/wordpress-lewe-chordpress-plugin-3-9-6-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-52790
Published: 2025-06-20
Description: Cross-Site Request Forgery (CSRF) vulnerability in r-win WP-DownloadCounter wp-downloadcounter allows Stored XSS.This issue affects WP-DownloadCounter: from n/a through <= 1.01.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/wp-downloadcounter/vulnerability/wordpress-wp-downloadcounter-plugin-1-01-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-52791
Published: 2025-06-20
Description: Cross-Site Request Forgery (CSRF) vulnerability in devfelixmoira Knowledge Base – Knowledge Base Maker knowledge-base-maker allows Stored XSS.This issue affects Knowledge Base – Knowledge Base Maker: from n/a through <= 1.1.8.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/knowledge-base-maker/vulnerability/wordpress-knowledge-base-knowledge-base-maker-plugin-1-1-8-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-52792
Published: 2025-06-20
Description: Cross-Site Request Forgery (CSRF) vulnerability in vgstef WP User Stylesheet Switcher wp-user-stylesheet-switcher allows Stored XSS.This issue affects WP User Stylesheet Switcher: from n/a through <= v2.2.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/wp-user-stylesheet-switcher/vulnerability/wordpress-wp-user-stylesheet-switcher-plugin-v2-2-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-52793
Published: 2025-06-20
Description: Cross-Site Request Forgery (CSRF) vulnerability in Esselink.nu Esselink.nu Settings esselinknu-settings allows Reflected XSS.This issue affects Esselink.nu Settings: from n/a through <= 4.5.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/esselinknu-settings/vulnerability/wordpress-esselink-nu-settings-plugin-2-94-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-52794
Published: 2025-06-20
Description: Cross-Site Request Forgery (CSRF) vulnerability in Creative-Solutions Creative Contact Form sexy-contact-form allows Stored XSS.This issue affects Creative Contact Form: from n/a through <= 1.0.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/sexy-contact-form/vulnerability/wordpress-creative-contact-form-plugin-1-0-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-52795
Published: 2025-06-20
Description: Cross-Site Request Forgery (CSRF) vulnerability in aharonyan WP Front User Submit / Front Editor front-editor allows Cross Site Request Forgery.This issue affects WP Front User Submit / Front Editor: from n/a through <= 5.0.6.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/front-editor/vulnerability/wordpress-wp-front-user-submit-front-editor-plugin-4-9-4-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-52802
Published: 2025-06-20
Description: Missing Authorization vulnerability in enguerranws Import YouTube videos as WP Posts import-youtube-videos-as-wp-post allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Import YouTube videos as WP Posts: from n/a through <= 2.1.
CVSS Score: 7.5 (HIGH)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/import-youtube-videos-as-wp-post/vulnerability/wordpress-import-youtube-videos-as-wp-posts-plugin-2-1-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-52821
Published: 2025-06-20
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in thanhtungtnt Video List Manager video-list-manager allows SQL Injection.This issue affects Video List Manager: from n/a through <= 1.7.
CVSS Score: 8.5 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/video-list-manager/vulnerability/wordpress-video-list-manager-plugin-1-7-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-52822
Published: 2025-06-20
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Iqonic Design WP Roadmap wp-roadmap allows SQL Injection.This issue affects WP Roadmap: from n/a through <= 2.1.3.
CVSS Score: 8.5 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/wp-roadmap/vulnerability/wordpress-wp-roadmap-plugin-2-1-3-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-52825
Published: 2025-06-20
Description: Cross-Site Request Forgery (CSRF) vulnerability in Rameez Iqbal Real Estate Manager real-estate-manager allows Privilege Escalation.This issue affects Real Estate Manager: from n/a through <= 7.3.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/real-estate-manager/vulnerability/wordpress-real-estate-manager-plugin-7-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-6345
Published: 2025-06-20
Description: A vulnerability was found in SourceCodester My Food Recipe 1.0 and classified as problematic. Affected by this issue is the function addRecipeModal of the file /endpoint/add-recipe.php of the component Add Recipe Page. The manipulation of the argument Name leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94, CWE-79
References: https://github.com/RaulPazemecxas/PoCVulDb/blob/main/README4.md; https://vuldb.com/?ctiid.313340; https://vuldb.com/?id.313340
CVE: CVE-2025-6346
Published: 2025-06-20
Description: A vulnerability was found in SourceCodester Advance Charity Management System 1.0. It has been classified as critical. This affects an unknown part of the file /members/fundDetails.php. The manipulation of the argument m06 leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://gist.github.com/0xCaptainFahim/86a679533ca293c98be5ab91b76b213f; https://vuldb.com/?ctiid.313341; https://vuldb.com/?id.313341
CVE: CVE-2025-44203
Published: 2025-06-20
Description: In HotelDruid 3.0.7, an unauthenticated attacker can exploit verbose SQL error messages on creadb.php before the 'create database' button is pressed. By sending malformed POST requests to this endpoint, the attacker may obtain the administrator username, password hash, and salt. In some cases, the attack results in a Denial of Service (DoS), preventing the administrator from logging in even with the correct credentials.
CVSS Score: 7.5 (HIGH)
CWE: CWE-209, CWE-400
References: https://github.com/IvanT7D3/CVE-2025-44203/tree/main; https://www.hoteldruid.com/; https://github.com/IvanT7D3/CVE-2025-44203/tree/main
CVE: CVE-2025-45331
Published: 2025-06-20
Description: brplot v420.69.1 contains a Null Pointer Dereference (NPD) vulnerability in the br_dagens_handle_once function of its data processing module, leading to unpredictable program behavior, causing segmentation faults, and program crashes.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://gist.github.com/QiuYitai/9dd6db6e9dfc03868b9c886b801502ac; https://github.com/branc116/brplot/commit/b90e93a0e0d514d48f38d[PII_REDACTED]fa5fe4fe4
CVE: CVE-2025-45890
Published: 2025-06-20
Description: Directory Traversal vulnerability in novel plus before v.5.1.0 allows a remote attacker to execute arbitrary code via the filePath parameter
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22
References: https://github.com/SecureCore1/CVE/blob/main/novel-plus/readme.md; https://github.com/SecureCore1/CVE/blob/main/novel-plus/readme.md
CVE: CVE-2025-5416
Published: 2025-06-20
Description: A vulnerability has been identified in Keycloak that could lead to unauthorized information disclosure. While it requires an already authenticated user, the /admin/serverinfo endpoint can inadvertently provide sensitive environment information.
CVSS Score: 2.7 (LOW)
CWE: CWE-497
References: https://access.redhat.com/security/cve/CVE-2025-5416; https://bugzilla.redhat.com/show_bug.cgi?id=2369601
CVE: CVE-2025-6193
Published: 2025-06-20
Description: A command injection vulnerability was discovered in the TrustyAI Explainability toolkit. Arbitrary commands placed in certain fields of a LMEValJob custom resource (CR) may be executed in the LMEvalJob pod's terminal. This issue can be exploited via a maliciously crafted LMEvalJob by a user with permissions to deploy a CR.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-78
References: https://access.redhat.com/errata/RHSA-2026:5807; https://access.redhat.com/security/cve/CVE-2025-6193; https://bugzilla.redhat.com/show_bug.cgi?id=2374032
CVE: CVE-2025-6347
Published: 2025-06-20
Description: A vulnerability was found in code-projects Responsive Blog 1.0/1.12.4/3.3.4. It has been declared as problematic. This vulnerability affects unknown code of the file /responsive/resblog/blogadmin/admin/pageViewMembers.php. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 2.4 (LOW)
CWE: CWE-79, CWE-94, CWE-79
References: https://code-projects.org/; https://gist.github.com/0xCaptainFahim/8bb9021dcea33863eaf0279aaca2671c; https://vuldb.com/?ctiid.313342
CVE: CVE-2025-6351
Published: 2025-06-20
Description: A vulnerability was found in itsourcecode Employee Record Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /editprofile.php. The manipulation of the argument emp1name leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://github.com/ltranquility/CVE/issues/8; https://itsourcecode.com/; https://vuldb.com/?ctiid.313343
CVE: CVE-2025-6352
Published: 2025-06-20
Description: A vulnerability classified as problematic has been found in code-projects Automated Voting System 1.0. Affected is an unknown function of the file /vote.php of the component Backend. The manipulation leads to direct request. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-425
References: https://code-projects.org/; https://github.com/asd1238525/cve/blob/main/Unauthorized.md; https://vuldb.com/?ctiid.313344
CVE: CVE-2025-44635
Published: 2025-06-20
Description: There are multiple unauthorized remote command execution vulnerabilities in the H3C ER2200G2, ERG2-450W, ERG2-1200W, ERG2-1350W, NR1200W series routers before ERG2AW-MNW100-R1117; H3C ER3100G2, ER3200G2, ER3260G2, ER5100G2, ER5200G2, ER6300G2, ER8300G2, ER8300G2-X series routers before ERHMG2-MNW100-R1126; GR3200, GR5200, GR8300 and other series routers before MiniGR1B0V100R018L50; GR-1800AX before MiniGRW1B0V100R009L50; GR-3000AX before SWBRW1A0V100R007L50; and GR-5400AX before SWBRW1B0V100R009L50. Attackers can bypass authentication by including specially crafted text in the request URL or message header, and then inject arbitrary malicious commands into some fields related to ACL access control list and user group functions and execute to obtain the highest ROOT privileges of remote devices, thereby completely taking over the remote target devices.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://www.h3c.com/cn/Service/Online_Help/psirt/security-notice/detail_2021.htm?Id=459; https://zhiliao.h3c.com/Theme/details/230461