deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-32259
Published: 2025-04-10
Description: Missing Authorization vulnerability in Alimir WP ULike wp-ulike.This issue affects WP ULike: from n/a through <= 4.7.9.1.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/wp-ulike/vulnerability/wordpress-wp-ulike-plugin-4-7-9-1-content-spoofing-vulnerability?_s_id=cve
CVE: CVE-2025-32260
Published: 2025-04-10
Description: Missing Authorization vulnerability in Detheme DethemeKit For Elementor dethemekit-for-elementor.This issue affects DethemeKit For Elementor: from n/a through <= 2.1.10.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/dethemekit-for-elementor/vulnerability/wordpress-dethemekit-for-elementor-plugin-2-1-10-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-32275
Published: 2025-04-10
Description: Authentication Bypass by Spoofing vulnerability in Ays Pro Survey Maker survey-maker allows Identity Spoofing.This issue affects Survey Maker: from n/a through <= 5.1.6.3.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-290
References: https://patchstack.com/database/Wordpress/Plugin/survey-maker/vulnerability/wordpress-survey-maker-plugin-5-1-5-0-bypass-vulnerability-vulnerability?_s_id=cve
CVE: CVE-2025-32282
Published: 2025-04-10
Description: Cross-Site Request Forgery (CSRF) vulnerability in ShareThis ShareThis Dashboard for Google Analytics googleanalytics.This issue affects ShareThis Dashboard for Google Analytics: from n/a through <= 3.2.3.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/googleanalytics/vulnerability/wordpress-sharethis-dashboard-for-google-analytics-plugin-3-2-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-32668
Published: 2025-04-10
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Rameez Iqbal Real Estate Manager real-estate-manager allows PHP Local File Inclusion.This issue affects Real Estate Manager: from n/a through <= 7.3.
CVSS Score: 8.1 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Plugin/real-estate-manager/vulnerability/wordpress-real-estate-manager-plugin-7-3-local-file-inclusion-vulnerability-2?_s_id=cve
CVE: CVE-2025-32687
Published: 2025-04-10
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Magnigenie Review Stars Count For WooCommerce review-stars-count-for-woocommerce allows SQL Injection.This issue affects Review Stars Count For WooCommerce: from n/a through <= 2.0.
CVSS Score: 8.5 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/review-stars-count-for-woocommerce/vulnerability/wordpress-review-stars-count-for-woocommerce-2-0-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-22279
Published: 2025-04-10
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Crocoblock JetCompareWishlist jet-compare-wishlist allows PHP Local File Inclusion.This issue affects JetCompareWishlist: from n/a through <= 1.5.9.
CVSS Score: 7.5 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Plugin/jet-compare-wishlist/vulnerability/wordpress-jetcomparewishlist-plugin-1-5-9-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-27081
Published: 2025-04-10
Description: A potential security vulnerability in HPE NonStop OSM Service Connection Suite could potentially be exploited to allow a local Denial of Service.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-400
References: https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbns04836en_us&docLocale=en_US
CVE: CVE-2025-23386
Published: 2025-04-10
Description: A Incorrect Default Permissions vulnerability in the openSUSE Tumbleweed package gerbera allows the service user gerbera to escalate to root.,This issue affects gerbera on openSUSE Tumbleweed before 2.5.0-1.1.
CVSS Score: 7.8 (HIGH)
CWE: CWE-276
References: https://bugzilla.suse.com/show_bug.cgi?id=CVE-2025-23386
CVE: CVE-2025-22374
Published: 2025-04-10
Description: A Server-Side Request Forgery (SSRF) vulnerability was discovered in the videx-legacy-ssl web service of Videx’s CyberAudit-Web, affecting versions prior to 1.1.3. This vulnerability has been patched in versions after 1.1.3. Leaving this vulnerability unpatched could lead to unauthorized access to the underlying infrastructure.
CWE: CWE-918
References: https://csirt.divd.nl/CVE-2025-22374; https://csirt.divd.nl/DIVD-2024-00043/
CVE: CVE-2025-22375
Published: 2025-04-10
Description: An authentication bypass vulnerability was found in Videx's CyberAudit-Web. Through the exploitation of a logic flaw, an attacker could create a valid session without any credentials. This vulnerability has been patched in versions later than 9.5 and a patch has been made available to all instances of CyberAudit-Web, including the versions that are End of Maintenance (EOM). Anyone that requires support with the resolution of this issue can contact support@videx.com for assistance.
CWE: CWE-287
References: https://csirt.divd.nl/CVE-2025-22375; https://csirt.divd.nl/DIVD-2024-00043/
CVE: CVE-2025-27350
Published: 2025-04-10
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Hugh Mungus Vice Versa vice-versa allows Reflected XSS.This issue affects Vice Versa: from n/a through <= 2.2.3.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/vice-versa/vulnerability/wordpress-vice-versa-plugin-2-2-3-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-31411
Published: 2025-04-10
Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in aribhour Linet ERP-Woocommerce Integration linet-erp-woocommerce-integration allows Path Traversal.This issue affects Linet ERP-Woocommerce Integration: from n/a through <= 3.5.12.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-22
References: https://patchstack.com/database/Wordpress/Plugin/linet-erp-woocommerce-integration/vulnerability/wordpress-linet-erp-woocommerce-integration-plugin-3-5-12-arbitrary-file-read-deletion-vulnerability?_s_id=cve
CVE: CVE-2025-1073
Published: 2025-04-10
Description: Panasonic IR Control Hub (IR Blaster) versions 1.17 and earlier may allow an attacker with physical access to load unauthorized firmware onto the device.
CVSS Score: 7.5 (HIGH)
CWE: CWE-1299
References: https://lsin.panasonic.com/release-notes
CVE: CVE-2025-32754
Published: 2025-04-10
Description: In jenkins/ssh-agent Docker images 6.11.1 and earlier, SSH host keys are generated on image creation for images based on Debian, causing all containers based on images of the same version use the same SSH host keys, allowing attackers able to insert themselves into the network path between the SSH client (typically the Jenkins controller) and SSH build agent to impersonate the latter.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-338
References: https://www.jenkins.io/security/advisory/2025-04-10/#SECURITY-3565
CVE: CVE-2025-32755
Published: 2025-04-10
Description: In jenkins/ssh-slave Docker images based on Debian, SSH host keys are generated on image creation for images based on Debian, causing all containers based on images of the same version use the same SSH host keys, allowing attackers able to insert themselves into the network path between the SSH client (typically the Jenkins controller) and SSH build agent to impersonate the latter.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-338
References: https://www.jenkins.io/security/advisory/2025-04-10/#SECURITY-3565
CVE: CVE-2024-11129
Published: 2025-04-10
Description: An issue has been discovered in GitLab EE affecting all versions from 17.1 before 17.8.7, 17.9 before  17.9.6, and 17.10 before 17.10.4. This allows attackers to perform targeted searches with sensitive keywords to get the count of issues containing the searched term."
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-209
References: https://gitlab.com/gitlab-org/gitlab/-/issues/503722; https://hackerone.com/reports/2717400
CVE: CVE-2025-1677
Published: 2025-04-10
Description: A Denial of Service (DoS) issue has been discovered in GitLab CE/EE affecting all up to 17.8.7, 17.9 prior to 17.9.6 and 17.10 prior to 17.10.4 A denial of service could occur upon injecting oversized payloads into CI pipeline exports.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-770
References: https://gitlab.com/gitlab-org/gitlab/-/issues/521117; https://hackerone.com/reports/3004008
CVE: CVE-2025-25197
Published: 2025-04-10
Description: Silverstripe Elemental extends a page type to swap the content area for a list of manageable elements to compose a page out of rather than a single text field. An elemental block can include an XSS payload, which can be executed when viewing the "Content blocks in use" report. The vulnerability is specific to that report and is a result of failure to cast input prior to including it in the grid field. This vulnerability is fixed in 5.3.12.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/silverstripe/silverstripe-elemental/commit/34ff4ed498ccab94cc5f55ef9a56c37f491eda1d; https://github.com/silverstripe/silverstripe-elemental/security/advisories/GHSA-x8xm-c7p8-2pj2; https://www.silverstripe.org/download/security-releases/CVE-2025-25197
CVE: CVE-2025-27812
Published: 2025-04-10
Description: MSI Center before 2.0.52.0 allows TOCTOU Local Privilege Escalation.
CVSS Score: 8.1 (HIGH)
CWE: CWE-367
References: https://csr.msi.com/global/product-security-advisories
CVE: CVE-2025-27813
Published: 2025-04-10
Description: MSI Center before 2.0.52.0 has Missing PE Signature Validation.
CVSS Score: 8.1 (HIGH)
CWE: CWE-347
References: https://csr.msi.com/global/product-security-advisories
CVE: CVE-2025-2408
Published: 2025-04-10
Description: An issue has been discovered in GitLab CE/EE affecting all versions from 13.12 before 17.8.7, 17.9 before 17.9.6, and 17.10 before 17.10.4. Under certain conditions users could bypass IP access restrictions and view sensitive information.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-1220
References: https://gitlab.com/gitlab-org/gitlab/-/issues/525323; https://hackerone.com/reports/3027775
CVE: CVE-2025-30148
Published: 2025-04-10
Description: Silverstripe Framework is a PHP framework which powers the Silverstripe CMS. Prior to 5.3.23, bad actor with access to edit content in the CMS could send a specifically crafted encoded payload to the server, which could be used to inject a JavaScript payload on the front end of the site. The payload would be sanitized on the client-side, but server-side sanitization doesn't catch it. The server-side sanitization logic has been updated to sanitize against this attack. This vulnerability is fixed in 5.3.23.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/silverstripe/silverstripe-framework/commit/e99cfd62d160d145a76fcf9631e6b11226e42358; https://github.com/silverstripe/silverstripe-framework/security/advisories/GHSA-rhx4-hvx9-j387; https://www.silverstripe.org/download/security-releases/cve-2025-30148
CVE: CVE-2023-42007
Published: 2025-04-10
Description: IBM Sterling Control Center 6.2.1, 6.3.1, and 6.4.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.ibm.com/support/pages/node/7230560
CVE: CVE-2023-43035
Published: 2025-04-10
Description: IBM Sterling Control Center 6.2.1, 6.3.1, and 6.4.0 allows web pages to be stored locally which can be read by another user on the system.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-525
References: https://www.ibm.com/support/pages/node/7230561
CVE: CVE-2023-43037
Published: 2025-04-10
Description: IBM Maximo Application Suite 8.11 and 9.0 could allow an authenticated user to perform unauthorized actions due to improper input validation.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: https://www.ibm.com/support/pages/node/7230567
CVE: CVE-2025-29017
Published: 2025-04-10
Description: A Remote Code Execution (RCE) vulnerability exists in Code Astro Internet Banking System 2.0.0 due to improper file upload validation in the profile_pic parameter within pages_view_client.php.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://github.com/b1tm4r/CVE-2025-29017
CVE: CVE-2025-29088
Published: 2025-04-10
Description: In SQLite 3.49.0 before 3.49.1, certain argument values to sqlite3_db_config (in the C-language API) can cause a denial of service (application crash). An sz*nBig multiplication is not cast to a 64-bit integer, and consequently some memory allocations may be incorrect.
CVSS Score: 5.6 (MEDIUM)
CWE: CWE-190
References: https://gist.github.com/ylwango613/d3883fb9f6ba8a[PII_REDACTED]9ce88248; https://github.com/sqlite/sqlite/commit/56d2fd008b108109f489339f5fd55212bb50afd4; https://sqlite.org/forum/forumpost/48f365daec
CVE: CVE-2025-2469
Published: 2025-04-10
Description: An issue has been discovered in GitLab CE/EE affecting all versions from 17.9 before 17.9.6, and 17.10 before 17.10.4. The runtime profiling data of a specific service was accessible to unauthenticated users.
CVSS Score: 3.7 (LOW)
CWE: CWE-1295
References: https://gitlab.com/gitlab-org/gitlab/-/issues/525374; https://hackerone.com/reports/3030586
CVE: CVE-2025-32383
Published: 2025-04-10
Description: MaxKB (Max Knowledge Base) is an open source knowledge base question-answering system based on a large language model and retrieval-augmented generation (RAG). A reverse shell vulnerability exists in the module of function library. The vulnerability allow privileged‌ users to create a reverse shell. This vulnerability is fixed in v1.10.4-lts.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-94
References: https://github.com/1Panel-dev/MaxKB/commit/4ae02c8d3eb65542c88ef58c0abd94c52c949d8f; https://github.com/1Panel-dev/MaxKB/security/advisories/GHSA-fjf6-6cvf-xr72
CVE: CVE-2025-32391
Published: 2025-04-10
Description: HedgeDoc is an open source, real-time, collaborative, markdown notes application. Prior to 1.10.3, a malicious SVG file uploaded to HedgeDoc results in the possibility of XSS when opened in a new tab instead of the editor itself. The XSS is possible by exploiting the JSONP capabilities of GitHub Gist embeddings. Only instances with the local filesystem upload backend or special configurations, where the uploads are served from the same domain as HedgeDoc, are vulnerable. This vulnerability is fixed in 1.10.3. When upgrading to HedgeDoc 1.10.3 is not possible, instance owners could add the following headers for all routes under /uploads as a first-countermeasure: Content-Disposition: attachment and Content-Security-Policy: default-src 'none'. Additionally, the external URLs in the script-src attribute of the Content-Security-Policy header should be removed.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/hedgedoc/hedgedoc/commit/0636b5c20b7097afccfa[PII_REDACTED]ad068ef964; https://github.com/hedgedoc/hedgedoc/commit/3f520ea59abf912c66d7443cb99f29a567c47748; https://github.com/hedgedoc/hedgedoc/commit/d2585fbd3b398b3359f6f88aa1fda8f4ecf2f78d
CVE: CVE-2025-32395
Published: 2025-04-10
Description: Vite is a frontend tooling framework for javascript. Prior to 6.2.6, 6.1.5, 6.0.15, 5.4.18, and 4.5.13, the contents of arbitrary files can be returned to the browser if the dev server is running on Node or Bun. HTTP 1.1 spec (RFC 9112) does not allow # in request-target. Although an attacker can send such a request. For those requests with an invalid request-line (it includes request-target), the spec recommends to reject them with 400 or 301. The same can be said for HTTP 2. On Node and Bun, those requests are not rejected internally and is passed to the user land. For those requests, the value of http.IncomingMessage.url contains #. Vite assumed req.url won't contain # when checking server.fs.deny, allowing those kinds of requests to bypass the check. Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) and running the Vite dev server on runtimes that are not Deno (e.g. Node, Bun) are affected. This vulnerability is fixed in 6.2.6, 6.1.5, 6.0.15, 5.4.18, and 4.5.13.
CWE: CWE-200
References: https://github.com/vitejs/vite/commit/175a83909f02d3b554452a7bd02b9f340cdfef70; https://github.com/vitejs/vite/security/advisories/GHSA-356w-63v5-8wf4
CVE: CVE-2025-32743
Published: 2025-04-10
Description: In ConnMan through 1.44, the lookup string in ns_resolv in dnsproxy.c can be NULL or an empty string when the TC (Truncated) bit is set in a DNS response. This allows attackers to cause a denial of service (application crash) or possibly execute arbitrary code, because those lookup values lead to incorrect length calculations and incorrect memcpy operations.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-392
References: https://lapis-sawfish-be3.notion.site/0-click-Vulnerability-in-Comman-1-43_v3-1cadc00d01d080b0b3b9c46a6da584cc; https://web.git.kernel.org/pub/scm/network/connman/connman.git/tree/src/dnsproxy.c?h=1.44#n1688
CVE: CVE-2025-0362
Published: 2025-04-10
Description: An issue has been discovered in GitLab CE/EE affecting all versions from 7.7 before 17.8.7, 17.9 before 17.9.6, and 17.10 before 17.10.4. Under certain conditions, an attacker could potentially trick users into unintentionally authorizing sensitive actions on their behalf.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-1021
References: https://gitlab.com/gitlab-org/gitlab/-/issues/512425; https://hackerone.com/reports/2926425
CVE: CVE-2025-29150
Published: 2025-04-10
Description: BlueCMS 1.6 suffers from Arbitrary File Deletion via the id parameter in an /publish.php?act=del request.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: https://gist.github.com/electroN1chahaha/054a1af22157aa3010e89b3103ad7b9a
CVE: CVE-2025-32027
Published: 2025-04-10
Description: Yii is an open source PHP web framework. Prior to 1.1.31, yiisoft/yii is vulnerable to Reflected XSS in specific scenarios where the fallback error renderer is used. Upgrade yiisoft/yii to version 1.1.31 or higher.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-80, CWE-79
References: https://github.com/yiisoft/yii/commit/d386d737861c9014269b7ed8c36c65eadb387368; https://github.com/yiisoft/yii/security/advisories/GHSA-7r2v-8wxr-3ch5
CVE: CVE-2025-32382
Published: 2025-04-10
Description: Metabase is an open source Business Intelligence and Embedded Analytics tool. When admins change Snowflake connection details in Metabase (either updating a password or changing password to private key or vice versa), Metabase would not always purge older Snowflake connection details from the application database. In order to remove older and stale connection details, Metabase would try one connection method at a time and purge all the other connection methods from the application database. When Metabase found a connection that worked, it would log (log/infof "Successfully connected, migrating to: %s" (pr-str test-details)) which would then print the username and password to the logger. This is fixed in 52.17.1, 53.9.5 and 54.1.5 in both the OSS and enterprise editions. Versions 51 and lower are not impacted.
CWE: CWE-532
References: https://github.com/metabase/metabase/security/advisories/GHSA-832j-56xw-5p7f
CVE: CVE-2025-24866
Published: 2025-04-10
Description: Mattermost versions 9.11.x <= 9.11.8  fail to enforce proper access controls on the /api/v4/audits endpoint, allowing users with delegated granular administration roles who lack access to Compliance Monitoring to retrieve User Activity Logs.
CVSS Score: 2.7 (LOW)
CWE: CWE-863
References: https://mattermost.com/security-updates
CVE: CVE-2025-22232
Published: 2025-04-10
Description: Spring Cloud Config Server may not use Vault token sent by clients using a X-CONFIG-TOKEN header when making requests to Vault.
Your application may be affected by this if the following are true:
  *  You have Spring Vault on the classpath of your Spring Cloud Config Server and
  *  You are using the X-CONFIG-TOKEN header to send a Vault token to the Spring Cloud Config Server for the Config Server to use when making requests to Vault and
  *  You are using the default Spring Vault SessionManager implementation LifecycleAwareSessionManager or a SessionManager implementation that persists the Vault token such as SimpleSessionManager.

In this case the SessionManager persists the first token it retrieves and will continue to use that token even if client requests to the Spring Cloud Config Server include a X-CONFIG-TOKEN header with a different value.
Affected Spring Products and Versions
Spring Cloud Config:
  *  2.2.1.RELEASE - 4.2.1


Mitigation
Users of affected versions should upgrade to the corresponding fixed version.

Affected version(s)Fix versionAvailability4.2.x4.2.2OSS4.1.x4.1.6OSS4.0.x4.0.10Commercial3.1.x3.1.10Commercial3.0.x4.1.6OSS2.2.x4.1.6OSS
NOTE: Spring Cloud Config 3.0.x and 2.2.x are no longer under open source or commercial support. Users of these versions are encouraged to upgrade to a supported version.

No other mitigation steps are necessary.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-287
References: https://spring.io/security/cve-2025-22232
CVE: CVE-2025-23008
Published: 2025-04-10
Description: An improper privilege management vulnerability in the SonicWall NetExtender Windows (32 and 64 bit) client allows a low privileged attacker to modify configurations.
CVSS Score: 7.2 (HIGH)
CWE: CWE-250
References: https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2025-0006
CVE: CVE-2025-23009
Published: 2025-04-10
Description: A local privilege escalation vulnerability in SonicWall NetExtender Windows (32 and 64 bit) client which allows an attacker to trigger an arbitrary file deletion.
CVSS Score: 7.2 (HIGH)
CWE: CWE-250
References: https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2025-0006
CVE: CVE-2025-23010
Published: 2025-04-10
Description: An Improper Link Resolution Before File Access ('Link Following') vulnerability in SonicWall NetExtender Windows (32 and 64 bit) client which allows an attacker to manipulate file paths.
CVSS Score: 7.2 (HIGH)
CWE: CWE-59
References: https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2025-0006
CVE: CVE-2025-32696
Published: 2025-04-10
Description: Improper Preservation of Permissions vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/actions/RevertAction.Php, includes/api/ApiFileRevert.Php.

This issue affects MediaWiki: before 1.39.12, 1.42.6, 1.43.1.
CWE: CWE-281
References: https://phabricator.wikimedia.org/T304474; https://lists.debian.org/debian-lts-announce/2025/07/msg00012.html
CVE: CVE-2025-32697
Published: 2025-04-10
Description: Improper Preservation of Permissions vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/editpage/IntroMessageBuilder.Php, includes/Permissions/PermissionManager.Php, includes/Permissions/RestrictionStore.Php.

This issue affects MediaWiki: before 1.42.6, 1.43.1.
CWE: CWE-281
References: https://phabricator.wikimedia.org/T140010; https://phabricator.wikimedia.org/T24521; https://phabricator.wikimedia.org/T62109
CVE: CVE-2025-32698
Published: 2025-04-10
Description: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/logging/LogPager.Php.

This issue affects MediaWiki: before 1.39.12, 1.42.6, 1.43.1.
CWE: CWE-200
References: https://phabricator.wikimedia.org/T385958; https://lists.debian.org/debian-lts-announce/2025/07/msg00012.html
CVE: CVE-2025-32699
Published: 2025-04-10
Description: Vulnerability in Wikimedia Foundation MediaWiki, Wikimedia Foundation Parsoid.This issue affects MediaWiki: before 1.39.12, 1.42.6, 1.43.1; Parsoid: before 0.16.5, 0.19.2, 0.20.2.
CWE: CWE-74, CWE-79
References: https://phabricator.wikimedia.org/T387130; https://lists.debian.org/debian-lts-announce/2025/07/msg00012.html