deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-11241
Published: 2025-10-03
Description: The Yoast SEO Premium plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions 25.7 to 25.9 due to a flawed regex used to remove an attribute in post content, which can be abused to inject arbitrary HTML attributes, including JavaScript event handlers. This vulnerability allows a user with Contributor access or higher to create a post containing a malicious JavaScript payload.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-80
References: https://developer.yoast.com/changelog/yoast-seo-premium/26.0/; https://sec.stealthcopter.com/regexss/; https://www.wordfence.com/threat-intel/vulnerabilities/id/a6e3645d-ed1b-4c51-a463-c2691cb7168d?source=cve
CVE: CVE-2025-59297
Published: 2025-10-03
Description: Delta Electronics DIAScreen lacks proper validation of the user-supplied file. If a user opens a malicious file, an attacker can leverage this vulnerability to execute code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://filecenter.deltaww.com/news/download/doc/Delta-PCSA-2025-00018_DIAScreen%20File%20Parsing%20Out-Of-Bounds%20Write%20Vulnerability.pdf
CVE: CVE-2025-59298
Published: 2025-10-03
Description: Delta Electronics DIAScreen lacks proper validation of the user-supplied file. If a user opens a malicious file, an attacker can leverage this vulnerability to execute code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://filecenter.deltaww.com/news/download/doc/Delta-PCSA-2025-00018_DIAScreen%20File%20Parsing%20Out-Of-Bounds%20Write%20Vulnerability.pdf
CVE: CVE-2025-59299
Published: 2025-10-03
Description: Delta Electronics DIAScreen lacks proper validation of the user-supplied file. If a user opens a malicious file, an attacker can leverage this vulnerability to execute code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://filecenter.deltaww.com/news/download/doc/Delta-PCSA-2025-00018_DIAScreen%20File%20Parsing%20Out-Of-Bounds%20Write%20Vulnerability.pdf
CVE: CVE-2025-59300
Published: 2025-10-03
Description: Delta Electronics DIAScreen lacks proper validation of the user-supplied file. If a user opens a malicious file, an attacker can leverage this vulnerability to execute code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://filecenter.deltaww.com/news/download/doc/Delta-PCSA-2025-00018_DIAScreen%20File%20Parsing%20Out-Of-Bounds%20Write%20Vulnerability.pdf
CVE: CVE-2025-59536
Published: 2025-10-03
Description: Claude Code is an agentic coding tool. Versions before 1.0.111 were vulnerable to Code Injection due to a bug in the startup trust dialog implementation. Claude Code could be tricked to execute code contained in a project before the user accepted the startup trust dialog. Exploiting this requires a user to start Claude Code in an untrusted directory. Users on standard Claude Code auto-update will have received this fix automatically. Users performing manual updates are advised to update to the latest version. This issue is fixed in version 1.0.111.
CVSS Score: 8.8 (HIGH)
CWE: CWE-94
References: https://github.com/anthropics/claude-code/security/advisories/GHSA-4fgq-fpq9-mr3g
CVE: CVE-2025-61589
Published: 2025-10-03
Description: Cursor is a code editor built for programming with AI. In versions 1.6 and below, Mermaid (a to render diagrams) allows embedding images which then get rendered by Cursor in the chat box. An attacker can use this to exfiltrate sensitive information to a third-party attacker controlled server through an image fetch after successfully performing a prompt injection. A malicious model (or hallucination/backdoor) might also trigger this exploit at will. This issue requires prompt injection from malicious data (web, image upload, source code) in order to exploit. In that case, it can send sensitive information to an attacker-controlled external server. Some additional bypasses not covered in the initial fix to this issue were discovered, see GHSA-43wj-mwcc-x93p. This issue is fixed in version 1.7.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-200
References: https://github.com/cursor/cursor/security/advisories/GHSA-43wj-mwcc-x93p; https://github.com/cursor/cursor/security/advisories/GHSA-xw2x-252g-97w2
CVE: CVE-2025-61597
Published: 2025-10-03
Description: Emlog is an open source website building system. In versions 2.5.21 and below, an HTML template injection allows stored cross‑site scripting (XSS) via the mail template settings. Once a malicious payload is saved, any subsequent visit to the settings page in an authenticated admin context will execute attacker‑controlled JavaScript, enabling session/token theft and full admin account takeover. This issue is fixed in version 2.5.22.
CVSS Score: 7.6 (HIGH)
CWE: CWE-79
References: https://github.com/emlog/emlog/pull/179; https://github.com/emlog/emlog/security/advisories/GHSA-hj97-hp2c-6m4m
CVE: CVE-2025-61599
Published: 2025-10-03
Description: Emlog is an open source website building system. A stored Cross-Site Scripting (XSS) vulnerability exists in the "Twitter"feature of EMLOG Pro 2.5.21 and below. An authenticated user with privileges to post a "Twitter" message can inject arbitrary JavaScript code. The malicious script is stored on the server and gets executed in the browser of any user, including administrators, when they click on the malicious post to view it. This issue does not currently have a fix.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/emlog/emlog/security/advisories/GHSA-rm5c-mjpg-vm89
CVE: CVE-2025-61671
Published: 2025-10-03
Description: Rejected reason: Further research determined the issue is not an open source vulnerability.
CVE: CVE-2025-0616
Published: 2025-10-03
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Teknolojik Center Telecommunication Industry Trade Co. Ltd. B2B - Netsis Panel allows SQL Injection.This issue affects B2B - Netsis Panel: through 20251003. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 8.2 (HIGH)
CWE: CWE-89
References: https://www.usom.gov.tr/bildirim/tr-25-0311
CVE: CVE-2025-11223
Published: 2025-10-03
Description: Installer of 

Panasonic 

AutoDownloader 



 version 1.2.8
contains an issue with the DLL search path, which may lead to loading 

a crafted DLL file in the same directory.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427
References: https://content.connect.panasonic.com/jp-ja/fai/file/66248
CVE: CVE-2025-6388
Published: 2025-10-03
Description: The Spirit Framework plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.2.14. This is due to the custom_actions() function not properly validating a user's identity prior to authenticating them to the site. This makes it possible for unauthenticated attackers to log in as any user, including administrators, granted they have access to the administrator's username.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-288
References: https://themespirit.com/talemy-changelog/; https://www.wordfence.com/threat-intel/vulnerabilities/id/a4cbc0e7-4328-451f-a595-1ce17e9d0031?source=cve
CVE: CVE-2025-11234
Published: 2025-10-03
Description: A flaw was found in QEMU. If the QIOChannelWebsock object is freed while it is waiting to complete a handshake, a GSource is leaked. This can lead to the callback firing later on and triggering a use-after-free in the use of the channel. This can be abused by a malicious client with network access to the VNC WebSocket port to cause a denial of service during the WebSocket handshake prior to the VNC client authentication.
CVSS Score: 7.5 (HIGH)
CWE: CWE-416
References: https://access.redhat.com/errata/RHSA-2025:23228; https://access.redhat.com/errata/RHSA-2026:0326; https://access.redhat.com/errata/RHSA-2026:0332
CVE: CVE-2025-0876
Published: 2025-10-03
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Isin Basi Advertisement Information Technologies Trade Inc. IT's Workif allows Cross-Site Scripting (XSS).This issue affects IT's Workif: through 20251003. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.1 (MEDIUM)
CWE: CWE-79
References: https://www.usom.gov.tr/bildirim/tr-25-0312
CVE: CVE-2025-10053
Published: 2025-10-03
Description: The TableGen – Data Table Generator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.3.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/table-creator/; https://www.wordfence.com/threat-intel/vulnerabilities/id/8bea21d9-26d1-49a5-a130-26d99818d4d3?source=cve
CVE: CVE-2025-10165
Published: 2025-10-03
Description: The AP Background plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'adv_parallax_back' shortcode in all versions up to, and including, 3.8.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/ap-background/trunk/includes/shortCodeClass.php#L44; https://wordpress.org/plugins/ap-background; https://www.wordfence.com/threat-intel/vulnerabilities/id/f98b848c-9f97-4d00-97de-7651b9035731?source=cve
CVE: CVE-2025-10192
Published: 2025-10-03
Description: The WP Photo Effects plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wppe_effect' shortcode in all versions up to, and including, 1.2.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/wp-photo-effects/trunk/photo-effect.php#L132; https://wordpress.org/plugins/wp-photo-effects; https://www.wordfence.com/threat-intel/vulnerabilities/id/634e5c33-cd24-46ab-aac0-161eeb28aaff?source=cve
CVE: CVE-2025-10212
Published: 2025-10-03
Description: The SiteAlert (Formerly WP Health) plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on multiple functions in all versions up to, and including, 1.9.8. This makes it possible for unauthenticated attackers to view the site health information, including a list of installed and outdated plugins, PHP and Database version, etc.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/my-wp-health-check/tags/1.9.8/php/ajax.php#L129; https://plugins.trac.wordpress.org/browser/my-wp-health-check/tags/1.9.8/php/ajax.php#L144; https://plugins.trac.wordpress.org/browser/my-wp-health-check/tags/1.9.8/php/ajax.php#L159
CVE: CVE-2025-10302
Published: 2025-10-03
Description: The Ultimate Viral Quiz plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing or incorrect nonce validation on thesave_options() function. This makes it possible for unauthenticated attackers to update the plugin's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://plugins.trac.wordpress.org/browser/ultimate-viral-quiz/trunk/bestbugcore/classes/options.class.php#L28; https://www.wordfence.com/threat-intel/vulnerabilities/id/fbe32b9e-a6da-4257-b740-63a143cee42f?source=cve
CVE: CVE-2025-10306
Published: 2025-10-03
Description: The Backup Bolt plugin for WordPress is vulnerable to arbitrary file downloads and backup location writes in all versions up to, and including, 1.4.1 via the process_backup_batch() function. This makes it possible for authenticated attackers, with Administrator-level access and above, to download directories outside of the webroot and write backup zip files to arbitrary locations.
CVSS Score: 3.8 (LOW)
CWE: CWE-73
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3373151%40backup-bolt&new=3373151%40backup-bolt&sfp_email=&sfph_mail=; https://wordpress.org/plugins/backup-bolt/; https://www.wordfence.com/threat-intel/vulnerabilities/id/63f38644-a021-407a-9882-2c8435849c08?source=cve
CVE: CVE-2025-10309
Published: 2025-10-03
Description: The PayPal Forms plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.3. This is due to missing nonce validation on the form creation and management functions. This makes it possible for unauthenticated attackers to create new PayPal forms and modify PayPal payment settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://plugins.trac.wordpress.org/browser/paypal-forms/trunk/paypal-forms.php#L533; https://www.wordfence.com/threat-intel/vulnerabilities/id/8cc25fe1-82f0-493b-a9d3-1a4892e35613?source=cve
CVE: CVE-2025-10311
Published: 2025-10-03
Description: The Comment Info Detector plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.5. This is due to missing nonce validation on the options.php file when handling form submissions. This makes it possible for unauthenticated attackers to modify plugin settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://plugins.trac.wordpress.org/browser/comment-info-detector/trunk/options.php#L7; https://www.wordfence.com/threat-intel/vulnerabilities/id/12bcc338-9e16-410f-bf3b-3756bc9b7024?source=cve
CVE: CVE-2025-10547
Published: 2025-10-03
Description: An uninitialized variable in the HTTP CGI request arguments processing component of Vigor Routers running DrayOS may allow an attacker the ability to perform RCE on the appliance through memory corruption.
CVSS Score: 9.8 (CRITICAL)
References: https://www.draytek.com/about/security-advisory/use-of-uninitialized-variable-vulnerabilities/; https://www.kb.cert.org/vuls/id/294418
CVE: CVE-2025-10582
Published: 2025-10-03
Description: The WP Dispatcher plugin for WordPress is vulnerable to SQL Injection via the ‘id’ parameter in all versions up to, and including, 1.2.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://plugins.trac.wordpress.org/browser/wp-dispatcher/trunk/admin/class-wp-dispatcher-shortcode.php#L78; https://wordpress.org/plugins/wp-dispatcher/; https://www.wordfence.com/threat-intel/vulnerabilities/id/a9b3b6cc-faaa-46c2-ab82-00c7138a8f27?source=cve
CVE: CVE-2025-10726
Published: 2025-10-03
Description: The WPRecovery plugin for WordPress is vulnerable to SQL Injection via the 'data[id]' parameter in all versions up to, and including, 2.0. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additionally, the result of this SQL injection is passed directly to PHP's unlink() function, allowing attackers to delete arbitrary files on the server by injecting file paths through the SQL query.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-89
References: https://plugins.svn.wordpress.org/wprecovery/trunk/delete_backup.php; https://plugins.svn.wordpress.org/wprecovery/trunk/index.php; https://plugins.trac.wordpress.org/browser/wprecovery/tags/2.0/delete_backup.php#L5
CVE: CVE-2025-27231
Published: 2025-10-03
Description: The LDAP 'Bind password' value cannot be read after saving, but a Super Admin account can leak it by changing LDAP 'Host' to a rogue LDAP server. To mitigate this, the 'Bind password' value is now reset on 'Host' change.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-522
References: https://support.zabbix.com/browse/ZBX-27062
CVE: CVE-2025-27236
Published: 2025-10-03
Description: A regular Zabbix user can search other users in their user group via Zabbix API by select fields the user does not have access to view. This allows data-mining some field values the user does not have access to.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-863
References: https://support.zabbix.com/browse/ZBX-27060
CVE: CVE-2025-27237
Published: 2025-10-03
Description: In Zabbix Agent and Agent 2 on Windows, the OpenSSL configuration file is loaded from a path writable by low-privileged users, allowing malicious modification and potential local privilege escalation by injecting a DLL.
CWE: CWE-427
References: https://support.zabbix.com/browse/ZBX-27061
CVE: CVE-2025-40636
Published: 2025-10-03
Description: SQL injection vulnerability in Joomla module mod_vvisit_counter v2.0.4j3. This vulnerability allows an attacker to retrieve database content via the ‘cip_vvisitcounter’ cookie at all endpoints where the plugin counts visits.
CWE: CWE-89
References: https://www.incibe.es/en/incibe-cert/notices/aviso/sql-injection-modvvisitcounter-module
CVE: CVE-2025-49641
Published: 2025-10-03
Description: A regular Zabbix user with no permission to the Monitoring -> Problems view is still able to call the problem.view.refresh action and therefore still retrieve a list of active problems.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-863
References: https://support.zabbix.com/browse/ZBX-27063
CVE: CVE-2025-7721
Published: 2025-10-03
Description: The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 5.7.3 via the task parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-98
References: https://plugins.trac.wordpress.org/browser/joomsport-sports-league-results-management/trunk/sportleague/base/wordpress/classes/class-jsport-controller.php#L74; https://plugins.trac.wordpress.org/changeset/3371353/; https://www.wordfence.com/threat-intel/vulnerabilities/id/4f3900c7-2acb-4031-9854-b0b13e172e1f?source=cve
CVE: CVE-2025-7825
Published: 2025-10-03
Description: The Schema Plugin For Divi, Gutenberg & Shortcodes plugin for WordPress is vulnerable to Object Instantiation in all versions up to, and including, 4.3.2 via deserialization of untrusted input via the wpt_schema_breadcrumbs shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-96
References: https://wordpress.org/plugins/wp-structured-data-schema/; https://www.wordfence.com/threat-intel/vulnerabilities/id/ccb81a3e-744f-4a16-ad9b-1b9dbc09571c?source=cve
CVE: CVE-2025-8669
Published: 2025-10-03
Description: The Customify theme for WordPress is vulnerable to Cross-Site Request Forgery in version 0.4.11. This is due to missing or incorrect nonce validation on the reset_customize_section function. This makes it possible for unauthenticated attackers to reset theme customization settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://research.cleantalk.org/cve-2025-8669/; https://themes.trac.wordpress.org/browser/customify/0.4.11/inc/customizer/class-customizer.php#L55; https://themes.trac.wordpress.org/changeset/291160/customify/0.4.12/inc/customizer/class-customizer.php
CVE: CVE-2025-8776
Published: 2025-10-03
Description: The Epic Bootstrap Buttons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘icol’ parameter in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.svn.wordpress.org/epic-bootstrap-buttons/trunk/epicboot.php; https://wordpress.org/plugins/epic-bootstrap-buttons/#developers; https://www.wordfence.com/threat-intel/vulnerabilities/id/91ddc368-bfe5-4581-aa99-ac9f4bcf9da4?source=cve
CVE: CVE-2025-9045
Published: 2025-10-03
Description: The Easy Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several widget parameters in versions less than, or equal to, 2.2.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/easy-elementor-addons/tags/2.2.8/modules/countdown/widgets/countdown.php#L864; https://plugins.trac.wordpress.org/browser/easy-elementor-addons/tags/2.2.8/modules/countdown/widgets/countdown.php#L868; https://plugins.trac.wordpress.org/browser/easy-elementor-addons/tags/2.2.8/modules/countdown/widgets/countdown.php#L871
CVE: CVE-2025-9077
Published: 2025-10-03
Description: The Ultra Addons Lite for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Animated Text' field of the Typeout Widget in version 1.1.9 and below due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/ut-elementor-addons-lite/tags/1.1.9/elements/typeout.php#L276; https://plugins.trac.wordpress.org/browser/ut-elementor-addons-lite/tags/1.2.0/elements/typeout.php#L276; https://www.wordfence.com/threat-intel/vulnerabilities/id/513f116b-84d3-4848-b608-f2a2ee57a9a2?source=cve