deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-9635
Published: 2025-09-11
Description: The Analytics Reduce Bounce Rate plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.3. This is due to missing or incorrect nonce validation on the unbounce_options function. This makes it possible for unauthenticated attackers to modify Google Analytics tracking settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://plugins.trac.wordpress.org/browser/analytics-unbounce/tags/2.3/analytics-unbounce.php#L124; https://plugins.trac.wordpress.org/browser/analytics-unbounce/tags/2.3/analytics-unbounce.php#L86; https://www.wordfence.com/threat-intel/vulnerabilities/id/787929b7-e8e0-4b24-9[PII_REDACTED]c417f?source=cve
CVE: CVE-2025-9693
Published: 2025-09-11
Description: The User Meta – User Profile Builder and User management plugin plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the postInsertUserProcess function in all versions up to, and including, 3.1.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
CVSS Score: 8.0 (HIGH)
CWE: CWE-22
References: https://plugins.trac.wordpress.org/browser/user-meta/tags/3.1.2/models/classes/UserInsert.php#L642; https://www.wordfence.com/threat-intel/vulnerabilities/id/d482f3a1-4a5a-4382-88b1-fd3b91605694?source=cve
CVE: CVE-2025-9850
Published: 2025-09-11
Description: The Evenium plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'evenium_single_event' shortcode in all versions up to, and including, 1.3.11 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/evenium/trunk/src/evenium_quicktags.php#L27; https://www.wordfence.com/threat-intel/vulnerabilities/id/394732cc-94b5-4fbf-bd78-da18791724be?source=cve
CVE: CVE-2025-9855
Published: 2025-09-11
Description: The Enhanced BibliPlug plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'bibliplug_authors' shortcode in all versions up to, and including, 1.3.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/enhanced-bibliplug/trunk/bibliplug.php#L293; https://www.wordfence.com/threat-intel/vulnerabilities/id/efd5ce76-2f93-45f9-9822-b0f8b6fcff0b?source=cve
CVE: CVE-2025-9860
Published: 2025-09-11
Description: The Mixtape plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'mixtape' shortcode in all versions up to, and including, 1.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/mixtape/tags/1.1/src/class-mixtape-front.php#L75; https://www.wordfence.com/threat-intel/vulnerabilities/id/863d59d5-ae74-4fc7-82fb-3039743af4b8?source=cve
CVE: CVE-2025-9861
Published: 2025-09-11
Description: The ThemeLoom Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'los_showposts' shortcode in all versions up to, and including, 1.8.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/themeloom-widgets/trunk/show-widgets.php#L402; https://www.wordfence.com/threat-intel/vulnerabilities/id/327b7a35-59fc-4971-9d3f-10665e1725f7?source=cve
CVE: CVE-2025-9874
Published: 2025-09-11
Description: The Ultimate Classified Listings plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.6 via the 'uclwp_dashboard' shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included.
CVSS Score: 7.5 (HIGH)
CWE: CWE-98
References: https://plugins.trac.wordpress.org/browser/ultimate-classified-listings/tags/1.7/classes/class-shortcodes.php#L49; https://plugins.trac.wordpress.org/browser/ultimate-classified-listings/trunk/classes/class-shortcodes.php#L49; https://www.wordfence.com/threat-intel/vulnerabilities/id/7cf6421c-7b92-4624-9c8a-2a2ab0ca9b28?source=cve
CVE: CVE-2025-9918
Published: 2025-09-11
Description: A Path Traversal vulnerability in the archive extraction component in Google SecOps SOAR Server (versions 6.3.54.0, 6.3.53.2, and all prior versions) allows an authenticated attacker with permissions to import Use Cases to achieve Remote Code Execution (RCE) via uploading a malicious ZIP archive containing path traversal sequences.
CWE: CWE-22
References: https://cloud.google.com/chronicle/docs/security-bulletins#GCP-2025-049; https://cloud.google.com/support/bulletins?gcp-2025-049
CVE: CVE-2025-48038
Published: 2025-09-11
Description: Allocation of Resources Without Limits or Throttling vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Resource Leak Exposure. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl.

This issue affects OTP form OTP 17.0 until OTP 28.0.3, OTP 27.3.4.3 and 26.2.5.15 corresponding to ssh from 3.0.1 until 5.3.3, 5.2.11.3 and 5.1.4.12.
CWE: CWE-400, CWE-770
References: https://cna.erlef.org/cves/CVE-2025-48038.html; https://github.com/erlang/otp/commit/4e3bf86777ab3db7220c11d8ddabf15970ddd10a; https://github.com/erlang/otp/commit/f09e0201ff701993dc24a08f15e524daf72db42f
CVE: CVE-2025-48039
Published: 2025-09-11
Description: Allocation of Resources Without Limits or Throttling vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Resource Leak Exposure. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl.

This issue affects OTP form OTP 17.0 until OTP 28.0.3, OTP 27.3.4.3 and 26.2.5.15 corresponding to ssh from 3.0.1 until 5.3.3, 5.2.11.3 and 5.1.4.12.
CWE: CWE-400, CWE-770
References: https://cna.erlef.org/cves/CVE-2025-48039.html; https://github.com/erlang/otp/commit/043ee3c943e2977c1acdd740ad13992fd60b6bf0; https://github.com/erlang/otp/commit/c242e6458967e9514bea[PII_REDACTED]95807a54ac
CVE: CVE-2025-48040
Published: 2025-09-11
Description: Uncontrolled Resource Consumption vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Flooding. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl.

This issue affects OTP form OTP 17.0 until OTP 28.0.3, OTP 27.3.4.3 and 26.2.5.15 corresponding to ssh from 3.0.1 until 5.3.3, 5.2.11.3 and 5.1.4.12.
CWE: CWE-400, CWE-770
References: https://cna.erlef.org/cves/CVE-2025-48040.html; https://github.com/erlang/otp/commit/548f1295d86d0803da884db8685cc16d461d0d5a; https://github.com/erlang/otp/commit/7cd7abb7e19e16b027eaee6a54e1f6fbbe21181a
CVE: CVE-2025-48041
Published: 2025-09-11
Description: Allocation of Resources Without Limits or Throttling vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Flooding. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl.

This issue affects OTP form OTP 17.0 until OTP 28.0.3, OTP 27.3.4.3 and 26.2.5.15 corresponding to ssh from 3.0.1 until 5.3.3, 5.2.11.3 and 5.1.4.12.
CWE: CWE-400, CWE-770
References: https://cna.erlef.org/cves/CVE-2025-48041.html; https://github.com/erlang/otp/commit/5f9af63eec4657a37663828d206517828cb9f288; https://github.com/erlang/otp/commit/d49efa2d4fa9e6f7ee658719cd76ffe7a33c2401
CVE: CVE-2025-58320
Published: 2025-09-11
Description: Delta Electronics DIALink has an Directory Traversal Authentication Bypass Vulnerability.
CVSS Score: 7.3 (HIGH)
CWE: CWE-22
References: https://filecenter.deltaww.com/news/download/doc/Delta-PCSA-2025-00016_DIALink%20-%20Directory%20Traversal%20Authentication%20Bypass%20Vulnerability.pdf
CVE: CVE-2025-58321
Published: 2025-09-11
Description: Delta Electronics DIALink has an Directory Traversal Authentication Bypass Vulnerability.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-22
References: https://filecenter.deltaww.com/news/download/doc/Delta-PCSA-2025-00016_DIALink%20-%20Directory%20Traversal%20Authentication%20Bypass%20Vulnerability.pdf
CVE: CVE-2025-10250
Published: 2025-09-11
Description: A weakness has been identified in DJI Mavic Spark, Mavic Air and Mavic Mini 01.00.0500. Affected is an unknown function of the component Telemetry Channel. Executing manipulation can lead to use of hard-coded cryptographic key . The attacker needs to be present on the local network. A high complexity level is associated with this attack. The exploitability is told to be difficult. The exploit has been made available to the public and could be exploited. This vulnerability only affects products that are no longer supported by the maintainer.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-320, CWE-321
References: https://github.com/ByteMe1001/DJI-Enhanced-WiFi-Weak-Cryptography; https://vuldb.com/?ctiid.323609; https://vuldb.com/?id.323609
CVE: CVE-2025-40687
Published: 2025-09-11
Description: SQL Injection in Online Fire Reporting System v1.2 by PHPGurukul. This vulnerability allows an attacker to retrieve, create, update and delete database via 

'mobilenumber', 'teamleadname' and 'teammember' parameters in the endpoint '/ofrs/admin/add-team.php'.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-phpgurukuls-online-fire-reporting-system
CVE: CVE-2025-40689
Published: 2025-09-11
Description: SQL Injection in Online Fire Reporting System v1.2 by PHPGurukul. This vulnerability allows an attacker to retrieve, create, update and delete database via 

'remark', 'status' and 'requestid' parameters in the endpoint '/ofrs/admin/request-details.php'.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-phpgurukuls-online-fire-reporting-system
CVE: CVE-2025-40690
Published: 2025-09-11
Description: SQL Injection in Online Fire Reporting System v1.2 by PHPGurukul. This vulnerability allows an attacker to retrieve, create, update and delete database via 'teamid' parameter in the endpoint '/ofrs/admin/edit-team.php'.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-phpgurukuls-online-fire-reporting-system
CVE: CVE-2025-40691
Published: 2025-09-11
Description: SQL Injection in Online Fire Reporting System v1.2 by PHPGurukul. This vulnerability allows an attacker to retrieve, create, update and delete database via 

'todate' parameter in the endpoint '/ofrs/admin/bwdates-report-result.php'.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-phpgurukuls-online-fire-reporting-system
CVE: CVE-2025-40692
Published: 2025-09-11
Description: SQL Injection in Online Fire Reporting System v1.2 by PHPGurukul. This vulnerability allows an attacker to retrieve, create, update and delete database via 

'requestid' parameter in the endpoint '/ofrs/details.php'.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-phpgurukuls-online-fire-reporting-system
CVE: CVE-2025-40693
Published: 2025-09-11
Description: Stored Cross Site Scripting in Online Fire Reporting System v1.2 by PHPGurukul, that consists in a reflected and stored authenticated XSS due to the lack of propper validation of user inputs 'tname' parameter via GET and, 'teamleadname', 'teammember' and 'teamname'

 parameters via POST at the endpoint '/ofrs/admin/edit-team.php'. This vulnerability could allow a remote user to send a specially crafted query to an authenticated user and steal its cookie session details.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-phpgurukuls-online-fire-reporting-system
CVE: CVE-2025-40694
Published: 2025-09-11
Description: Stored Cross Site Scripting in Online Fire Reporting System v1.2 by PHPGurukul, that consists in a stored authenticated XSS due to the lack of propper validation of user inputs 'fromdate' and 'todate' parameters via POST at the endpoint '/ofrs/admin/bwdates-report-result.php'. This vulnerability could allow a remote user to send a specially crafted query to an authenticated user and steal its cookie session details.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-phpgurukuls-online-fire-reporting-system
CVE: CVE-2025-40695
Published: 2025-09-11
Description: Stored Cross Site Scripting in Online Fire Reporting System v1.2 by PHPGurukul, that consists in a stored authenticated XSS due to the lack of propper validation of user inputs 'remark', 'status' and 'takeaction' parameters via POST at the endpoint '/ofrs/admin/request-details.php'. This vulnerability could allow a remote user to send a specially crafted query to an authenticated user and steal its cookie session details.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-phpgurukuls-online-fire-reporting-system
CVE: CVE-2025-40696
Published: 2025-09-11
Description: Stored Cross Site Scripting in Online Fire Reporting System v1.2 by PHPGurukul, that consists in a stored authenticated XSS due to the lack of propper validation of user inputs 'fullname', 'location' and 'message' parameters via POST at the endpoint '/ofrs/reporting.php'. This vulnerability could allow a remote user to send a specially crafted query to an authenticated user and steal its cookie session details.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-phpgurukuls-online-fire-reporting-system
CVE: CVE-2025-9018
Published: 2025-09-11
Description: The Time Tracker plugin for WordPress is vulnerable to unauthorized modification and loss of data due to a missing capability check on the 'tt_update_table_function' and 'tt_delete_record_function' functions in all versions up to, and including, 3.1.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update options such as user registration and default role, allowing anyone to register as an Administrator, and to delete limited data from the database.
CVSS Score: 8.8 (HIGH)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/time-tracker/trunk/inc/function-tt-delete-record.php#L22; https://plugins.trac.wordpress.org/browser/time-tracker/trunk/inc/function-tt-update-table.php#L25; https://plugins.trac.wordpress.org/changeset/3359157/
CVE: CVE-2025-10251
Published: 2025-09-11
Description: A vulnerability was detected in FoxCMS up to 1.24. Affected by this issue is the function batchCope of the file /app/admin/controller/Images.php. The manipulation of the argument ids results in sql injection. It is possible to launch the attack remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/ueh1013/VULN/issues/3; https://vuldb.com/?ctiid.323611; https://vuldb.com/?id.323611
CVE: CVE-2025-10193
Published: 2025-09-11
Description: DNS rebinding vulnerability in Neo4j Cypher MCP server allows malicious websites to bypass Same-Origin Policy protections and execute unauthorised tool invocations against locally running Neo4j MCP instances. The attack relies on the user being enticed to visit a malicious website and spend sufficient time there for DNS rebinding to succeed.
CWE: CWE-346
References: https://github.com/neo4j-contrib/mcp-neo4j/releases/tag/mcp-neo4j-cypher-v0.4.0; https://github.com/neo4j-contrib/mcp-neo4j/security/advisories/GHSA-vcqx-v2mg-7chx; https://neo4j.com/security/cve-2025-10193
CVE: CVE-2025-10252
Published: 2025-09-11
Description: A flaw has been found in SEAT Queue Ticket Kiosk up to 20250827. This affects an unknown part of the component Java RMI Registry Handler. This manipulation causes deserialization. The attack can only be done within the local network. The attack is considered to have high complexity. It is indicated that the exploitability is difficult. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 3.1 (LOW)
CWE: CWE-20, CWE-502
References: https://vuldb.com/?ctiid.323612; https://vuldb.com/?id.323612; https://vuldb.com/?submit.642598
CVE: CVE-2025-10253
Published: 2025-09-11
Description: A vulnerability has been found in openDCIM 23.04. This vulnerability affects unknown code of the file /scripts/uploadifive.php of the component SVG File Handler. Such manipulation of the argument Filedata leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94
References: https://github.com/lam-sec/openDCIMpoc; https://vuldb.com/?ctiid.323613; https://vuldb.com/?id.323613
CVE: CVE-2025-27466
Published: 2025-09-11
Description: [This CNA information record relates to multiple CVEs; the
text explains which aspects/vulnerabilities correspond to which CVE.]

There are multiple issues related to the handling and accessing of guest
memory pages in the viridian code:

 1. A NULL pointer dereference in the updating of the reference TSC area.
    This is CVE-2025-27466.

 2. A NULL pointer dereference by assuming the SIM page is mapped when
    a synthetic timer message has to be delivered.  This is
    CVE-2025-58142.

 3. A race in the mapping of the reference TSC page, where a guest can
    get Xen to free a page while still present in the guest physical to
    machine (p2m) page tables.  This is CVE-2025-58143.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-395
References: https://xenbits.xenproject.org/xsa/advisory-472.html; http://www.openwall.com/lists/oss-security/2025/09/09/1; http://xenbits.xen.org/xsa/advisory-472.html
CVE: CVE-2025-58142
Published: 2025-09-11
Description: [This CNA information record relates to multiple CVEs; the
text explains which aspects/vulnerabilities correspond to which CVE.]

There are multiple issues related to the handling and accessing of guest
memory pages in the viridian code:

 1. A NULL pointer dereference in the updating of the reference TSC area.
    This is CVE-2025-27466.

 2. A NULL pointer dereference by assuming the SIM page is mapped when
    a synthetic timer message has to be delivered.  This is
    CVE-2025-58142.

 3. A race in the mapping of the reference TSC page, where a guest can
    get Xen to free a page while still present in the guest physical to
    machine (p2m) page tables.  This is CVE-2025-58143.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-395
References: https://xenbits.xenproject.org/xsa/advisory-472.html; http://www.openwall.com/lists/oss-security/2025/09/09/1; http://xenbits.xen.org/xsa/advisory-472.html
CVE: CVE-2025-58143
Published: 2025-09-11
Description: [This CNA information record relates to multiple CVEs; the
text explains which aspects/vulnerabilities correspond to which CVE.]

There are multiple issues related to the handling and accessing of guest
memory pages in the viridian code:

 1. A NULL pointer dereference in the updating of the reference TSC area.
    This is CVE-2025-27466.

 2. A NULL pointer dereference by assuming the SIM page is mapped when
    a synthetic timer message has to be delivered.  This is
    CVE-2025-58142.

 3. A race in the mapping of the reference TSC page, where a guest can
    get Xen to free a page while still present in the guest physical to
    machine (p2m) page tables.  This is CVE-2025-58143.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-366
References: https://xenbits.xenproject.org/xsa/advisory-472.html; http://www.openwall.com/lists/oss-security/2025/09/09/1; http://xenbits.xen.org/xsa/advisory-472.html
CVE: CVE-2025-58144
Published: 2025-09-11
Description: [This CNA information record relates to multiple CVEs; the
text explains which aspects/vulnerabilities correspond to which CVE.]

There are two issues related to the mapping of pages belonging to other
domains: For one, an assertion is wrong there, where the case actually
needs handling.  A NULL pointer de-reference could result on a release
build.  This is CVE-2025-58144.

And then the P2M lock isn't held until a page reference was actually
obtained (or the attempt to do so has failed).  Otherwise the page can
not only change type, but even ownership in between, thus allowing
domain boundaries to be violated.  This is CVE-2025-58145.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://xenbits.xenproject.org/xsa/advisory-473.html; http://www.openwall.com/lists/oss-security/2025/09/09/2; http://xenbits.xen.org/xsa/advisory-473.html
CVE: CVE-2025-58145
Published: 2025-09-11
Description: [This CNA information record relates to multiple CVEs; the
text explains which aspects/vulnerabilities correspond to which CVE.]

There are two issues related to the mapping of pages belonging to other
domains: For one, an assertion is wrong there, where the case actually
needs handling.  A NULL pointer de-reference could result on a release
build.  This is CVE-2025-58144.

And then the P2M lock isn't held until a page reference was actually
obtained (or the attempt to do so has failed).  Otherwise the page can
not only change type, but even ownership in between, thus allowing
domain boundaries to be violated.  This is CVE-2025-58145.
CVSS Score: 7.5 (HIGH)
CWE: CWE-362
References: https://xenbits.xenproject.org/xsa/advisory-473.html; http://www.openwall.com/lists/oss-security/2025/09/09/2; http://xenbits.xen.org/xsa/advisory-473.html
CVE: CVE-2025-8716
Published: 2025-09-11
Description: In Content Management versions 20.4- 25.3 authenticated attackers may exploit a complex cache poisoning technique to download unprotected files from the server if the filenames are known.
CWE: CWE-754
References: https://support.opentext.com/csm?id=ot_kb_unauthenticated&sysparm_article=KB0847046
CVE: CVE-2025-10254
Published: 2025-09-11
Description: A vulnerability was found in Ascensio System SIA OnlyOffice up to 12.7.0. This issue affects some unknown processing of the file /Products/Projects/Messages.aspx of the component SVG Image Handler. Performing manipulation results in cross site scripting. The attack may be initiated remotely. The exploit has been made public and could be used. The vendor was informed early about this issue and replied: "We are already working on this case, and the issues will be resolved in one of the upcoming patches."
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94
References: https://hkohi.ca/vulnerability/20; https://vuldb.com/?ctiid.323614; https://vuldb.com/?id.323614