deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-49725
Published: 2025-02-26
Description: In the Linux kernel, the following vulnerability has been resolved:

i40e: Fix call trace in setup_tx_descriptors

After PF reset and ethtool -t there was call trace in dmesg
sometimes leading to panic. When there was some time, around 5
seconds, between reset and test there were no errors.

Problem was that pf reset calls i40e_vsi_close in prep_for_reset
and ethtool -t calls i40e_vsi_close in diag_test. If there was not
enough time between those commands the second i40e_vsi_close starts
before previous i40e_vsi_close was done which leads to crash.

Add check to diag_test if pf is in reset and don't start offline
tests if it is true.
Add netif_info("testing failed") into unhappy path of i40e_diag_test()
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/0a4e5a3dc5e41212870e6043895ae02455c93f63; https://git.kernel.org/stable/c/15950157e2c24865b696db1c9ccc72743ae0e967; https://git.kernel.org/stable/c/322271351b0e41565171e4cce70ea41854fac115
CVE: CVE-2022-49726
Published: 2025-02-26
Description: In the Linux kernel, the following vulnerability has been resolved:

clocksource: hyper-v: unexport __init-annotated hv_init_clocksource()

EXPORT_SYMBOL and __init is a bad combination because the .init.text
section is freed up after the initialization. Hence, modules cannot
use symbols annotated __init. The access to a freed symbol may end up
with kernel panic.

modpost used to detect it, but it has been broken for a decade.

Recently, I fixed modpost so it started to warn it again, then this
showed up in linux-next builds.

There are two ways to fix it:

  - Remove __init
  - Remove EXPORT_SYMBOL

I chose the latter for this case because the only in-tree call-site,
arch/x86/kernel/cpu/mshyperv.c is never compiled as modular.
(CONFIG_HYPERVISOR_GUEST is boolean)
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-908
References: https://git.kernel.org/stable/c/0414eab7c78f3518143d383e448d44fc573ac6d2; https://git.kernel.org/stable/c/245b993d8f6c4e25f19191edfbd8080b645e12b1; https://git.kernel.org/stable/c/937fcbb55a1e48a6422e87e8f49422c92265f102
CVE: CVE-2022-49727
Published: 2025-02-26
Description: In the Linux kernel, the following vulnerability has been resolved:

ipv6: Fix signed integer overflow in l2tp_ip6_sendmsg

When len >= INT_MAX - transhdrlen, ulen = len + transhdrlen will be
overflow. To fix, we can follow what udpv6 does and subtract the
transhdrlen from the max.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-190, CWE-190
References: https://git.kernel.org/stable/c/034246122f5c5e2e2a0b9fe04e24517920e9beb1; https://git.kernel.org/stable/c/0e818d433fc2718fe4da044ffca7431812a7e04e; https://git.kernel.org/stable/c/27a37755ceb401111ded76810359d3adc4b268a1
CVE: CVE-2022-49728
Published: 2025-02-26
Description: In the Linux kernel, the following vulnerability has been resolved:

ipv6: Fix signed integer overflow in __ip6_append_data

Resurrect ubsan overflow checks and ubsan report this warning,
fix it by change the variable [length] type to size_t.

UBSAN: signed-integer-overflow in net/ipv6/ip6_output.c:1489:19[PII_REDACTED] + 8567 cannot be represented in type 'int'
CPU: 0 PID: 253 Comm: err Not tainted 5.16.0+ #1
Hardware name: linux,dummy-virt (DT)
Call trace:
  dump_backtrace+0x214/0x230
  show_stack+0x30/0x78
  dump_stack_lvl+0xf8/0x118
  dump_stack+0x18/0x30
  ubsan_epilogue+0x18/0x60
  handle_overflow+0xd0/0xf0
  __ubsan_handle_add_overflow+0x34/0x44
  __ip6_append_data.isra.48+0x1598/0x1688
  ip6_append_data+0x128/0x260
  udpv6_sendmsg+0x680/0xdd0
  inet6_sendmsg+0x54/0x90
  sock_sendmsg+0x70/0x88
  ____sys_sendmsg+0xe8/0x368
  ___sys_sendmsg+0x98/0xe0
  __sys_sendmmsg+0xf4/0x3b8
  __arm64_sys_sendmmsg+0x34/0x48
  invoke_syscall+0x64/0x160
  el0_svc_common.constprop.4+0x124/0x300
  do_el0_svc+0x44/0xc8
  el0_svc+0x3c/0x1e8
  el0t_64_sync_handler+0x88/0xb0
  el0t_64_sync+0x16c/0x170

Changes since v1:
-Change the variable [length] type to unsigned, as Eric Dumazet suggested.
Changes since v2:
-Don't change exthdrlen type in ip6_make_skb, as Paolo Abeni suggested.
Changes since v3:
-Don't change ulen type in udpv6_sendmsg and l2tp_ip6_sendmsg, as
Jakub Kicinski suggested.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-190
References: https://git.kernel.org/stable/c/70549c80fe80ac4e2a22068c76ebebced24f7e74; https://git.kernel.org/stable/c/84dc940890e91e42898e4443a[PII_REDACTED]40abf; https://git.kernel.org/stable/c/f26422eabeb517629568edf8c2dd9c6cb9147584
CVE: CVE-2022-49729
Published: 2025-02-26
Description: In the Linux kernel, the following vulnerability has been resolved:

nfc: nfcmrvl: Fix memory leak in nfcmrvl_play_deferred

Similar to the handling of play_deferred in commit 19cfe912c37b
("Bluetooth: btusb: Fix memory leak in play_deferred"), we thought
a patch might be needed here as well.

Currently usb_submit_urb is called directly to submit deferred tx
urbs after unanchor them.

So the usb_giveback_urb_bh would failed to unref it in usb_unanchor_urb
and cause memory leak.

Put those urbs in tx_anchor to avoid the leak, and also fix the error
handling.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401, CWE-401
References: https://git.kernel.org/stable/c/0eeec1a8b0cd38c47edeb042980a6aeacecf35ed; https://git.kernel.org/stable/c/1eb0afecfb9cd0f38424b82bd9aaa542310934ee; https://git.kernel.org/stable/c/3e7c7df6991ac349f2fa[PII_REDACTED]df666e610f
CVE: CVE-2022-49730
Published: 2025-02-26
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2022-49731
Published: 2025-02-26
Description: In the Linux kernel, the following vulnerability has been resolved:

ata: libata-core: fix NULL pointer deref in ata_host_alloc_pinfo()

In an unlikely (and probably wrong?) case that the 'ppi' parameter of
ata_host_alloc_pinfo() points to an array starting with a NULL pointer,
there's going to be a kernel oops as the 'pi' local variable won't get
reassigned from the initial value of NULL. Initialize 'pi' instead to
'&ata_dummy_port_info' to fix the possible kernel oops for good...

Found by Linux Verification Center (linuxtesting.org) with the SVACE static
analysis tool.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://git.kernel.org/stable/c/07cbdb4807d369fbda73062a91b570c4dc5ec429; https://git.kernel.org/stable/c/1ac5efee33f29e704226506d429b84575a5d66f8; https://git.kernel.org/stable/c/253334f84c81bc6a43af489f108c0bddad989eef
CVE: CVE-2025-0234
Published: 2025-02-26
Description: Out-of-bounds vulnerability in curve segmentation processing of Generic PCL6 V4 Printer Driver / Generic UFR II V4 Printer Driver / Generic LIPSLX V4 Printer Driver.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-787
References: https://psirt.canon/advisory-information/cp2025-002/
CVE: CVE-2025-0235
Published: 2025-02-26
Description: Out-of-bounds vulnerability due to improper memory release during image rendering in Generic PCL6 V4 Printer Driver / Generic UFR II V4 Printer Driver / Generic LIPSLX V4 Printer Driver.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-787
References: https://psirt.canon/advisory-information/cp2025-002/
CVE: CVE-2025-0236
Published: 2025-02-26
Description: Out-of-bounds vulnerability in slope processing during curve rendering in Generic PCL6 V4 Printer Driver / Generic UFR II V4 Printer Driver / Generic LIPSLX V4 Printer Driver.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-787
References: https://psirt.canon/advisory-information/cp2025-002/
CVE: CVE-2025-0889
Published: 2025-02-26
Description: Prior to 25.2, a local authenticated attacker can elevate privileges on a system with Privilege Management for Windows installed, via the manipulation of COM objects under certain circumstances where an EPM policy allows for automatic privilege elevation of a user process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-268
References: https://www.beyondtrust.com/trust-center/security-advisories/bt25-01
CVE: CVE-2025-22868
Published: 2025-02-26
Description: An attacker can pass a malicious malformed token which causes unexpected memory to be consumed during parsing.
CVSS Score: 7.5 (HIGH)
CWE: CWE-1286
References: https://go.dev/cl/652155; https://go.dev/issue/71490; https://pkg.go.dev/vuln/GO-2025-3488
CVE: CVE-2025-22869
Published: 2025-02-26
Description: SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at all, causing pending content to be read into memory, but never transmitted.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770
References: https://go.dev/cl/652135; https://go.dev/issue/71931; https://pkg.go.dev/vuln/GO-2025-3487
CVE: CVE-2025-22881
Published: 2025-02-26
Description: Delta Electronics CNCSoft-G2 lacks proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. If a target visits a malicious page or opens a malicious file an attacker can leverage this vulnerability to execute code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122
References: https://filecenter.deltaww.com/news/download/doc/Delta-PCSA-2025-00003_CNCSoft-G2%20-%20Heap-based%20Buffer%20Overflow_v1.pdf
CVE: CVE-2022-25773
Published: 2025-02-26
Description: This advisory addresses a file placement vulnerability that could allow assets to be uploaded to unintended directories on the server.

  *  Improper Limitation of a Pathname to a Restricted Directory: A vulnerability exists in the asset upload functionality that allows users to upload files to directories outside of the intended temporary directory.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-22
References: https://github.com/mautic/mautic/security/advisories/GHSA-4w2w-36vm-c8hf
CVE: CVE-2024-10152
Published: 2025-02-26
Description: The Simple Certain Time to Show Content WordPress plugin before 1.3.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://wpscan.com/vulnerability/b4d17da2-4c47-4fd1-a6bd-6692b07cf710/
CVE: CVE-2024-10483
Published: 2025-02-26
Description: The Simple:Press Forum WordPress plugin before 6.10.11 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://wpscan.com/vulnerability/c7e3c473-09b2-473b-87d7-0a01d8f52086/
CVE: CVE-2024-10563
Published: 2025-02-26
Description: The WooCommerce Cart Count Shortcode WordPress plugin before 1.1.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/08ed69f6-9c9b-4548-9dbb-05b602530ef7/
CVE: CVE-2024-12434
Published: 2025-02-26
Description: The SureMembers plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.10.6 via the REST API. This makes it possible for unauthenticated attackers to extract sensitive data including restricted content.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://suremembers.com/whats-new/; https://www.wordfence.com/threat-intel/vulnerabilities/id/f33e0019-e52e-464b-843d-a034e5205b2e?source=cve
CVE: CVE-2024-12737
Published: 2025-02-26
Description: The WP BASE Booking of Appointments, Services and Events WordPress plugin before 5.0.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/997eb9f6-80e1-4bc5-be72-bd6a6f52379c/
CVE: CVE-2024-12878
Published: 2025-02-26
Description: The Custom Block Builder  WordPress plugin before 3.8.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://wpscan.com/vulnerability/827444d1-87cb-4057-827a-d802eac82cf8/
CVE: CVE-2024-13113
Published: 2025-02-26
Description: The Countdown Timer for Elementor WordPress plugin before 1.3.7 does not sanitise and escape some parameters when outputting them on the page, which could allow users with a role as low as contributor to perform Cross-Site Scripting attacks.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/ffc31d9d-d245-4c4b-992d-394a01798117/
CVE: CVE-2024-13560
Published: 2025-02-26
Description: The Subscriptions & Memberships for PayPal plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.6. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to delete arbitrary posts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://plugins.trac.wordpress.org/changeset/3246039/subscriptions-memberships-for-paypal; https://wordpress.org/plugins/subscriptions-memberships-for-paypal/#developers; https://www.wordfence.com/threat-intel/vulnerabilities/id/2bed7fc8-a961-4141-80a1-9c23a6504fbd?source=cve
CVE: CVE-2024-13571
Published: 2025-02-26
Description: The Post Timeline WordPress plugin before 2.3.10 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://wpscan.com/vulnerability/ad6ad44d-fdc3-494c-a371-5d7959d1fd23/
CVE: CVE-2024-13624
Published: 2025-02-26
Description: The WPMovieLibrary WordPress plugin through 2.1.4.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://wpscan.com/vulnerability/c19b56cc-634f-420f-b6a0-9a10ad159049/
CVE: CVE-2024-13628
Published: 2025-02-26
Description: The WP Pricing Table WordPress plugin through 1.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/34d6c8a2-e70d-485c-a217-4a569c16b079/
CVE: CVE-2024-13629
Published: 2025-02-26
Description: The pushBIZ  WordPress plugin through 1.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/5ffb548c-14f1-499d-8bbf-6ecc632cbb8c/
CVE: CVE-2024-13630
Published: 2025-02-26
Description: The NewsTicker WordPress plugin through 1.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/15eed487-01ac-4c1e-88f8-26cfa036fb54/
CVE: CVE-2024-13631
Published: 2025-02-26
Description: The Om Stripe WordPress plugin through 02.00.00 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://wpscan.com/vulnerability/c991fdd0-cb9d-43ea-bafa-df3b2e806013/
CVE: CVE-2024-13632
Published: 2025-02-26
Description: The WP Extra Fields WordPress plugin through 1.0.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://wpscan.com/vulnerability/85c5b465-afce-4c68-b5e3-214ec4b5c9f2/
CVE: CVE-2024-13633
Published: 2025-02-26
Description: The Simple catalogue WordPress plugin through 1.0.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://wpscan.com/vulnerability/4291d5eb-c006-42b0-accf-90f09f26b6a0/
CVE: CVE-2024-13634
Published: 2025-02-26
Description: The Post Sync WordPress plugin through 1.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/0e60bf74-19fb-441c-85a8-005def36af9a/
CVE: CVE-2024-13669
Published: 2025-02-26
Description: The CalendApp WordPress plugin through 1.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://wpscan.com/vulnerability/71e69cf2-7d41-479c-9721-662b57571c90/
CVE: CVE-2024-13678
Published: 2025-02-26
Description: The R3W InstaFeed WordPress plugin through 1.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/ba759796-a152-4f13-a474-f0368b4bc1f6/
CVE: CVE-2024-13803
Published: 2025-02-26
Description: The Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘data-marker’ parameter in all versions up to, and including, 5.2.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: http://localhost:1337/wp-content/plugins/essential-blocks/assets/admin/editor/editor.js; https://plugins.trac.wordpress.org/changeset/3242493/; https://www.wordfence.com/threat-intel/vulnerabilities/id/efdeca40-e021-478f-af75-c5566ae70735?source=cve
CVE: CVE-2024-39441
Published: 2025-02-26
Description: In wifi display, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed.
CVSS Score: 7.1 (HIGH)
References: https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]12791298
CVE: CVE-2024-47051
Published: 2025-02-26
Description: This advisory addresses two critical security vulnerabilities present in Mautic versions before 5.2.3. These vulnerabilities could be exploited by authenticated users.

  *  Remote Code Execution (RCE) via Asset Upload: A Remote Code Execution vulnerability has been identified in the asset upload functionality. Insufficient enforcement of allowed file extensions allows an attacker to bypass restrictions and upload executable files, such as PHP scripts.


  *  Path Traversal File Deletion: A Path Traversal vulnerability exists in the upload validation process. Due to improper handling of path components, an authenticated user can manipulate the file deletion process to delete arbitrary files on the host system.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-23, CWE-94
References: https://github.com/mautic/mautic/security/advisories/GHSA-73gx-x7r9-77x2; https://owasp.org/www-community/attacks/Code_Injection; https://owasp.org/www-community/attacks/Path_Traversal
CVE: CVE-2024-47053
Published: 2025-02-26
Description: This advisory addresses an authorization vulnerability in Mautic's HTTP Basic Authentication implementation. This flaw could allow unauthorized access to sensitive report data.

  *  Improper Authorization: An authorization flaw exists in Mautic's API Authorization implementation. Any authenticated user, regardless of assigned roles or permissions, can access all reports and their associated data via the API. This bypasses the intended access controls governed by the "Reporting Permissions > View Own" and "Reporting Permissions > View Others" permissions, which should restrict access to non-System Reports.
CVSS Score: 7.7 (HIGH)
CWE: CWE-285
References: https://cwe.mitre.org/data/definitions/287.html; https://docs.mautic.org/en/5.2/configuration/settings.html#api-settings; https://github.com/mautic/mautic/security/advisories/GHSA-8xv7-g2q3-fqgc
CVE: CVE-2024-6810
Published: 2025-02-26
Description: The Quiz Organizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.9.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/quiz-organizer/trunk/src/includes/admin/admin-modify-quiz.php#L230; https://plugins.trac.wordpress.org/browser/quiz-organizer/trunk/src/includes/admin/admin-modify-quiz.php#L570; https://plugins.trac.wordpress.org/browser/quiz-organizer/trunk/src/includes/sets/class-qzorg-plug-shortcode.php#L508
CVE: CVE-2025-0731
Published: 2025-02-26
Description: An unauthenticated remote attacker can upload a .aspx file instead of a PV system picture through the demo account. The code can only be executed in the security context of the user.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-434
References: https://cert.vde.com/en/advisories/VDE-2025-012
CVE: CVE-2025-1517
Published: 2025-02-26
Description: The Sina Extension for Elementor (Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets & Elementor Templates) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Fancy Text, Countdown Widget, and Login Form shortcodes in all versions up to, and including, 3.6.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/shaonsina/sina-extension-for-elementor/commit/5cb89db08b15a3011800ee0f6ad68c69c5a256d5; https://plugins.trac.wordpress.org/browser/sina-extension-for-elementor/trunk/widgets/advanced/sina-countdown.php; https://plugins.trac.wordpress.org/browser/sina-extension-for-elementor/trunk/widgets/advanced/sina-login-form.php
CVE: CVE-2025-26698
Published: 2025-02-26
Description: Incorrect resource transfer between spheres issue exists in RevoWorks SCVX and RevoWorks Browser. If exploited, malicious files may be downloaded to the system where using the product.
CVSS Score: 2.7 (LOW)
CWE: CWE-669
References: https://jscom.jp/news-20250217/; https://jvn.jp/en/jp/JVN91300609/
CVE: CVE-2025-0719
Published: 2025-02-26
Description: IBM Cloud Pak for Data 4.0.0 through 4.8.5 and 5.0.0 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.ibm.com/support/pages/node/7184173