deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-46232
Published: 2025-04-22
Description: Missing Authorization vulnerability in alttextai Download Alt Text AI alttext-ai allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Download Alt Text AI: from n/a through <= 1.9.93.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/alttext-ai/vulnerability/wordpress-download-alt-text-ai-1-9-93-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-46233
Published: 2025-04-22
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sirv CDN and Image Hosting Sirv sirv allows Stored XSS.This issue affects Sirv: from n/a through <= 7.5.3.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/sirv/vulnerability/wordpress-sirv-7-5-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-46235
Published: 2025-04-22
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sonalsinha21 SKT Blocks skt-blocks allows Stored XSS.This issue affects SKT Blocks: from n/a through <= 2.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/skt-blocks/vulnerability/wordpress-skt-blocks-gutenberg-based-page-builder-2-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-46236
Published: 2025-04-22
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Link Software LLC HTML Forms html-forms allows Stored XSS.This issue affects HTML Forms: from n/a through <= 1.5.2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/html-forms/vulnerability/wordpress-html-forms-1-5-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-46237
Published: 2025-04-22
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Yannick Lefebvre Link Library link-library allows Stored XSS.This issue affects Link Library: from n/a through <= 7.8.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/link-library/vulnerability/wordpress-link-library-7-8-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-46238
Published: 2025-04-22
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in rbaer List Last Changes list-last-changes allows Stored XSS.This issue affects List Last Changes: from n/a through <= 1.2.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/list-last-changes/vulnerability/wordpress-list-last-changes-1-2-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-46239
Published: 2025-04-22
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jeff Starr Theme Switcha theme-switcha allows Stored XSS.This issue affects Theme Switcha: from n/a through <= 3.4.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/theme-switcha/vulnerability/wordpress-theme-switcha-3-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-46240
Published: 2025-04-22
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jeff Starr Simple Download Counter simple-download-counter allows Stored XSS.This issue affects Simple Download Counter: from n/a through <= 2.2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/simple-download-counter/vulnerability/wordpress-simple-download-counter-2-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-46241
Published: 2025-04-22
Description: Cross-Site Request Forgery (CSRF) vulnerability in codepeople Appointment Booking Calendar appointment-booking-calendar allows SQL Injection.This issue affects Appointment Booking Calendar: from n/a through <= 1.3.92.
CVSS Score: 8.2 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/appointment-booking-calendar/vulnerability/wordpress-appointment-booking-calendar-plugin-1-3-92-csrf-to-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-46242
Published: 2025-04-22
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Bob Watu Quiz watu allows SQL Injection.This issue affects Watu Quiz: from n/a through <= 3.4.3.
CVSS Score: 7.6 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/watu/vulnerability/wordpress-watu-quiz-3-4-3-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-46243
Published: 2025-04-22
Description: Cross-Site Request Forgery (CSRF) vulnerability in sonalsinha21 Recover abandoned cart for WooCommerce recover-wc-abandoned-cart allows Cross Site Request Forgery.This issue affects Recover abandoned cart for WooCommerce: from n/a through <= 2.2.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/recover-wc-abandoned-cart/vulnerability/wordpress-recover-abandoned-cart-for-woocommerce-2-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-46244
Published: 2025-04-22
Description: Missing Authorization vulnerability in Dotstore Advanced Linked Variations for Woocommerce linked-variation allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Advanced Linked Variations for Woocommerce: from n/a through <= 1.0.3.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/linked-variation/vulnerability/wordpress-advanced-linked-variations-for-woocommerce-1-0-3-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-46245
Published: 2025-04-22
Description: Cross-Site Request Forgery (CSRF) vulnerability in CreativeMindsSolutions CM Ad Changer cm-ad-changer allows Cross Site Request Forgery.This issue affects CM Ad Changer: from n/a through <= 2.0.5.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/cm-ad-changer/vulnerability/wordpress-cm-ad-changer-2-0-5-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-46246
Published: 2025-04-22
Description: Cross-Site Request Forgery (CSRF) vulnerability in CreativeMindsSolutions CM Answers cm-answers allows Cross Site Request Forgery.This issue affects CM Answers: from n/a through <= 3.3.3.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/cm-answers/vulnerability/wordpress-cm-answers-3-3-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-46247
Published: 2025-04-22
Description: Missing Authorization vulnerability in codepeople Appointment Booking Calendar appointment-booking-calendar allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Appointment Booking Calendar: from n/a through <= 1.3.92.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/appointment-booking-calendar/vulnerability/wordpress-appointment-booking-calendar-1-3-92-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-46249
Published: 2025-04-22
Description: Cross-Site Request Forgery (CSRF) vulnerability in Michael Simple calendar for Elementor simple-calendar-for-elementor allows Cross Site Request Forgery.This issue affects Simple calendar for Elementor: from n/a through <= 1.6.4.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/simple-calendar-for-elementor/vulnerability/wordpress-simple-calendar-for-elementor-1-6-4-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-46250
Published: 2025-04-22
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vikas Ratudi VPSUForm v-form allows Stored XSS.This issue affects VPSUForm: from n/a through <= 3.1.14.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/v-form/vulnerability/wordpress-vform-3-1-14-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-46251
Published: 2025-04-22
Description: Cross-Site Request Forgery (CSRF) vulnerability in e4jvikwp VikRestaurants vikrestaurants allows Cross Site Request Forgery.This issue affects VikRestaurants: from n/a through <= 1.3.3.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/vikrestaurants/vulnerability/wordpress-vikrestaurants-table-reservations-and-take-away-plugin-1-3-3-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE: CVE-2025-46252
Published: 2025-04-22
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Kofi Mokome Message Filter for Contact Form 7 cf7-message-filter allows SQL Injection.This issue affects Message Filter for Contact Form 7: from n/a through <= 1.6.3.2.
CVSS Score: 7.6 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/cf7-message-filter/vulnerability/wordpress-message-filter-for-contact-form-7-plugin-1-6-3-2-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-46253
Published: 2025-04-22
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ataur R GutenKit gutenkit-blocks-addon allows Stored XSS.This issue affects GutenKit: from n/a through <= 2.2.2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/gutenkit-blocks-addon/vulnerability/wordpress-gutenkit-plugin-2-2-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-46254
Published: 2025-04-22
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Visual Composer Visual Composer Website Builder visualcomposer allows Stored XSS.This issue affects Visual Composer Website Builder: from n/a through <= 45.10.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/visualcomposer/vulnerability/wordpress-visual-composer-website-builder-plugin-45-10-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-11299
Published: 2025-04-22
Description: The Memberpress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.11.37 via the WordPress core search feature. This makes it possible for unauthenticated attackers to extract sensitive data from posts that have been restricted to higher-level roles such as administrator.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://memberpress.com/change-log/#1.12.0; https://www.wordfence.com/threat-intel/vulnerabilities/id/787cd2bb-489f-471a-82e0-073b4766b45a?source=cve
CVE: CVE-2025-2092
Published: 2025-04-22
Description: Insertion of Sensitive Information into Log File in Checkmk GmbH's Checkmk versions <2.3.0p29, <2.2.0p41 and <=2.1.0p49 (EOL) causes remote site authentication secrets to be written to log files accessible to administrators.
CVSS Score: 7.5 (HIGH)
CWE: CWE-532
References: https://checkmk.com/werk/17780
CVE: CVE-2025-3457
Published: 2025-04-22
Description: The Ocean Extra plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'oceanwp_icon' shortcode in all versions up to, and including, 2.4.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/ocean-extra/tags/2.4.5/includes/shortcodes/shortcodes.php#L838; https://plugins.trac.wordpress.org/changeset/3277977/; https://themes.trac.wordpress.org/browser/oceanwp/4.0.6/inc/oceanwp-theme-icons.php#L819
CVE: CVE-2025-3458
Published: 2025-04-22
Description: The Ocean Extra plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ocean_gallery_id’ parameter in all versions up to, and including, 2.4.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The Classic Editor plugin must be installed and activated to exploit the vulnerability.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/ocean-extra/tags/2.4.6/includes/metabox/gallery-metabox/gallery-metabox.php#L113; https://plugins.trac.wordpress.org/browser/ocean-extra/tags/2.4.6/includes/metabox/gallery-metabox/gallery-metabox.php#L162; https://plugins.trac.wordpress.org/changeset/3277977/
CVE: CVE-2025-3472
Published: 2025-04-22
Description: The Ocean Extra plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.4.6. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes when WooCommerce is also installed and activated.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-94
References: https://plugins.trac.wordpress.org/browser/ocean-extra/trunk/includes/shortcodes/shortcodes.php#L618; https://plugins.trac.wordpress.org/changeset/3277977/; https://www.wordfence.com/threat-intel/vulnerabilities/id/74428e76-1946-408f-8adc-24ab4b7e46c5?source=cve
CVE: CVE-2024-40445
Published: 2025-04-22
Description: A directory traversal vulnerability in forkosh Mime TeX before version 1.77 allows attackers on Windows systems to read or append arbitrary files by manipulating crafted input paths.
CVSS Score: 7.3 (HIGH)
CWE: CWE-77
References: https://github.com/Oefenweb/mimetex/blob/master/mimetex.c#L12414-L12423; https://github.com/TaiYou-TW/CVE-2024-40445_CVE-2024-40446/; https://youtu.be/OII16TteaJw
CVE: CVE-2024-40446
Published: 2025-04-22
Description: An issue in forkosh Mime Tex before v.1.77 allows an attacker to execute arbitrary code via a crafted script
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://github.com/TaiYou-TW/CVE-2024-40445_CVE-2024-40446/; https://youtu.be/S3cmZkWIi6o
CVE: CVE-2024-46546
Published: 2025-04-22
Description: NEXTU FLETA AX1500 WIFI6 Router v1.0.3 was discovered to contain a stack overflow via the url parameter at /boafrm/formFilter. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.
CVSS Score: 7.3 (HIGH)
CWE: CWE-121
References: https://ez-net.co.kr/new_2012/customer/download_view.php?cid=&sid=&goods=&cate=&q=&seq=233; https://ez-net.co.kr/new_2012/product/view.php?cid=461&sid=467&q=%C7%C3%B7%B9%C5%B8&seq=3479&page=; https://gist.github.com/laskdjlaskdj12/5b29b8b68f8a2279c9294708f080496b
CVE: CVE-2025-28032
Published: 2025-04-22
Description: TOTOLINK A800R V4.1.2cu.5137_B20200730, A810R V4.1.2cu.5182_B20201026, A830R V4.1.2cu.5182_B20201102, A950RG V4.1.2cu.5161_B20200903, A3000RU V5.9c.5185_B20201128, and A3100R V4.1.2cu.5247_B20211129 contain a pre-auth buffer overflow vulnerability in the setNoticeCfg function through the IpForm parameter.
CVSS Score: 7.3 (HIGH)
CWE: CWE-121
References: https://locrian-lightning-dc7.notion.site/BufferOverflow6-19f8e5e2b1a28052bda1f6ede9db341d; https://locrian-lightning-dc7.notion.site/BufferOverflow6-19f8e5e2b1a28052bda1f6ede9db341d
CVE: CVE-2025-28033
Published: 2025-04-22
Description: TOTOLINK A800R V4.1.2cu.5137_B20200730, A810R V4.1.2cu.5182_B20201026, A830R V4.1.2cu.5182_B20201102, A950RG V4.1.2cu.5161_B20200903, A3000RU V5.9c.5185_B20201128, and A3100R V4.1.2cu.5247_B20211129 were found to contain a pre-auth buffer overflow vulnerability in the setNoticeCfg function through the IpTo parameter.
CVSS Score: 7.3 (HIGH)
CWE: CWE-121
References: https://locrian-lightning-dc7.notion.site/BufferOverflow7-1a98e5e2b1a280708d6ec6155ce88d8c; https://locrian-lightning-dc7.notion.site/CVE-2025-28033-BufferOverflow7-1a98e5e2b1a280708d6ec6155ce88d8c
CVE: CVE-2025-28034
Published: 2025-04-22
Description: TOTOLINK A800R V4.1.2cu.5137_B20200730, A810R V4.1.2cu.5182_B20201026, A830R V4.1.2cu.5182_B20201102, A950RG V4.1.2cu.5161_B20200903, A3000RU V5.9c.5185_B20201128, and A3100R V4.1.2cu.5247_B20211129 were found to contain a pre-auth remote command execution vulnerability in the NTPSyncWithHost function through the hostTime parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://locrian-lightning-dc7.notion.site/RCE2-1a98e5e2b1a280bebf53d868f1b1a711?pvs=74; https://locrian-lightning-dc7.notion.site/CVE-2025-28034-RCE2-1a98e5e2b1a280bebf53d868f1b1a711
CVE: CVE-2025-1950
Published: 2025-04-22
Description: IBM Hardware Management Console - Power Systems V10.2.1030.0 and V10.3.1050.0 could allow a local user to execute commands locally due to improper validation of libraries of an untrusted source.
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-114
References: https://www.ibm.com/support/pages/node/7231507
CVE: CVE-2025-1951
Published: 2025-04-22
Description: IBM Hardware Management Console - Power Systems V10.2.1030.0 and V10.3.1050.0 could allow a local user to execute commands as a privileged user due to execution of commands with unnecessary privileges.
CVSS Score: 8.4 (HIGH)
CWE: CWE-250
References: https://www.ibm.com/support/pages/node/7231389
CVE: CVE-2025-23176
Published: 2025-04-22
Description: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://www.gov.il/en/departments/dynamiccollectors/cve_advisories_listing?skip=0
CVE: CVE-2025-29547
Published: 2025-04-22
Description: In Rollback Rx Professional 12.8.0.0, the driver file shieldm.sys allows local users to cause a denial of service because of a null pointer dereference from IOCtl 0x96202000.
CVSS Score: 7.0 (HIGH)
CWE: CWE-476
References: https://horizondatasys.com/rollback-rx-time-machine/rollback-rx-professional/; https://packetstorm.news/files/id/190491/
CVE: CVE-2024-33452
Published: 2025-04-22
Description: An issue in OpenResty lua-nginx-module v.0.10.26 and before allows a remote attacker to conduct HTTP request smuggling via a crafted HEAD request.
CVSS Score: 7.7 (HIGH)
CWE: CWE-444
References: https://portswigger.net/research/http-desync-attacks-request-smuggling-reborn; https://www.benasin.space/2025/03/18/OpenResty-lua-nginx-module-v0-10-26-HTTP-Request-Smuggling-in-HEAD-requests/; https://lists.debian.org/debian-lts-announce/2025/06/msg00026.html
CVE: CVE-2025-23249
Published: 2025-04-22
Description: NVIDIA NeMo Framework contains a vulnerability where a user could cause a deserialization of untrusted data by remote code execution. A successful exploit of this vulnerability might lead to code execution and data tampering.
CVSS Score: 7.6 (HIGH)
CWE: CWE-502
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5641
CVE: CVE-2025-23250
Published: 2025-04-22
Description: NVIDIA NeMo Framework contains a vulnerability where an attacker could cause an improper limitation of a pathname to a restricted directory by an arbitrary file write. A successful exploit of this vulnerability might lead to code execution and data tampering.
CVSS Score: 7.6 (HIGH)
CWE: CWE-22
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5641
CVE: CVE-2025-23251
Published: 2025-04-22
Description: NVIDIA NeMo Framework contains a vulnerability where a user could cause an improper control of generation of code by remote code execution. A successful exploit of this vulnerability might lead to code execution and data tampering.
CVSS Score: 7.6 (HIGH)
CWE: CWE-94
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5641
CVE: CVE-2025-28024
Published: 2025-04-22
Description: TOTOLINK A810R V4.1.2cu.5182_B20201026 was found to contain a buffer overflow vulnerability in the cstecgi.cgi
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://locrian-lightning-dc7.notion.site/BufferOverflow5-1978e5e2b1a2800caaced7ae3fb4783c
CVE: CVE-2025-28030
Published: 2025-04-22
Description: TOTOLINK A810R V4.1.2cu.5182_B20201026 was discovered to contain a stack overflow via the startTime and endTime parameters in setParentalRules function.
CVSS Score: 8.8 (HIGH)
CWE: CWE-121
References: https://locrian-lightning-dc7.notion.site/BufferOverflow6-19f8e5e2b1a2803db1d9ce7b4d06e2e0?pvs=73
CVE: CVE-2025-28031
Published: 2025-04-22
Description: TOTOLINK A810R V4.1.2cu.5182_B20201026 was discovered to contain a hardcoded password for the telnet service in product.ini.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-259
References: https://locrian-lightning-dc7.notion.site/Hard-code-Password-19f8e5e2b1a2803f864afbbc4262152e?pvs=73
CVE: CVE-2025-28037
Published: 2025-04-22
Description: TOTOLINK A810R V4.1.2cu.5182_B20201026 and A950RG V4.1.2cu.5161_B20200903 were found to contain a pre-auth remote command execution vulnerability in the setDiagnosisCfg function through the ipDomain parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://locrian-lightning-dc7.notion.site/RCE3-1ad8e5e2b1a280e192e8cff9fef896cc; https://locrian-lightning-dc7.notion.site/RCE3-1ad8e5e2b1a280e192e8cff9fef896cc
CVE: CVE-2025-3767
Published: 2025-04-22
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Centreon BAM (Boolean KPi Listing modules) allows SQL Injection.


This page is only accessible to authenticated users with high privileges.

This issue affects Centreon BAM: from 24.10 before 24.10.1, from 24.04 before 24.04.5, from 23.10 before 23.10.10, from 23.04 before 23.04.10.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/centreon/centreon/releases; https://thewatch.centreon.com/latest-security-bulletins-64/cve-2024-46924-cve-2025-3767-centreon-bam-high-severity-4459
CVE: CVE-2025-27907
Published: 2025-04-22
Description: IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.
CVSS Score: 4.1 (MEDIUM)
CWE: CWE-918
References: https://www.ibm.com/support/pages/node/7231514
CVE: CVE-2025-29339
Published: 2025-04-22
Description: An issue in UPF in Open5GS UPF versions up to v2.7.2 results an assertion failure vulnerability in PFCP session parameter validation. When processing a PFCP Session Establishment Request with PDN Type=0, the UPF fails to handle the invalid value propagated from SMF (or via direct attack), triggering a fatal assertion check and causing a daemon crash.
CVSS Score: 7.5 (HIGH)
CWE: CWE-617
References: https://github.com/open5gs/open5gs/issues/3727
CVE: CVE-2025-34028
Published: 2025-04-22
Description: The Commvault Command Center Innovation Release allows an unauthenticated actor to upload ZIP files that represent install packages that, when expanded by the target server, are vulnerable to path traversal vulnerability that can result in Remote Code Execution via malicious JSP.





This issue affects Command Center Innovation Release: 11.38.0 to 11.38.20. The vulnerability is fixed in 11.38.20 with SP38-CU20-433 and SP38-CU20-436 and also fixed in 11.38.25 with SP38-CU25-434 and SP38-CU25-438.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-22, CWE-306, CWE-22, CWE-306
References: https://documentation.commvault.com/securityadvisories/CV_2025_04_1.html; https://github.com/watchtowrlabs/watchTowr-vs-Commvault-PreAuth-RCE-CVE-2025-34028; https://labs.watchtowr.com/fire-in-the-hole-were-breaching-the-vault-commvault-remote-code-execution-cve-2025-34028/