deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-47630
Published: 2025-05-07
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Darren Cooney Ajax Load More ajax-load-more allows Stored XSS.This issue affects Ajax Load More: from n/a through <= 7.3.1.2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/ajax-load-more/vulnerability/wordpress-ajax-load-more-7-3-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-47632
Published: 2025-05-07
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Raihanul Islam Awesome Gallery awesome-gallery allows Stored XSS.This issue affects Awesome Gallery: from n/a through <= 1.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/awesome-gallery/vulnerability/wordpress-awesome-gallery-1-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-47633
Published: 2025-05-07
Description: Cross-Site Request Forgery (CSRF) vulnerability in Awin Awin – Advertiser Tracking for WooCommerce awin-advertiser-tracking allows Cross Site Request Forgery.This issue affects Awin – Advertiser Tracking for WooCommerce: from n/a through <= 2.0.0.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/awin-advertiser-tracking/vulnerability/wordpress-awin-advertiser-tracking-for-woocommerce-plugin-2-0-0-csrf-to-product-feed-regeneration-vulnerability?_s_id=cve
CVE: CVE-2025-47635
Published: 2025-05-07
Description: Server-Side Request Forgery (SSRF) vulnerability in WPWebinarSystem WebinarPress wp-webinarsystem allows Server Side Request Forgery.This issue affects WebinarPress: from n/a through <= 1.33.28.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-918, CWE-918
References: https://patchstack.com/database/Wordpress/Plugin/wp-webinarsystem/vulnerability/wordpress-webinarpress-1-33-27-server-side-request-forgery-ssrf-vulnerability?_s_id=cve
CVE: CVE-2025-47636
Published: 2025-05-07
Description: Path Traversal: '.../...//' vulnerability in Fernando Briano List category posts list-category-posts allows PHP Local File Inclusion.This issue affects List category posts: from n/a through <= 0.91.0.
CVSS Score: 7.5 (HIGH)
CWE: CWE-35
References: https://patchstack.com/database/Wordpress/Plugin/list-category-posts/vulnerability/wordpress-list-category-posts-0-90-3-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-47638
Published: 2025-05-07
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sarvesh M Rao WP Discord Invite wp-discord-invite allows Stored XSS.This issue affects WP Discord Invite: from n/a through <= 2.5.3.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wp-discord-invite/vulnerability/wordpress-wp-discord-invite-2-5-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-47639
Published: 2025-05-07
Description: Cross-Site Request Forgery (CSRF) vulnerability in Supertext Supertext Translation and Proofreading polylang-supertext allows Stored XSS.This issue affects Supertext Translation and Proofreading: from n/a through <= 4.26.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/polylang-supertext/vulnerability/wordpress-supertext-translation-and-proofreading-plugin-4-25-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE: CVE-2025-47643
Published: 2025-05-07
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ELEXtensions ELEX Product Feed for WooCommerce allows SQL Injection. This issue affects ELEX Product Feed for WooCommerce: from n/a through 3.1.2.
CVSS Score: 7.6 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/wordpress/plugin/elex-product-feed/vulnerability/wordpress-elex-product-feed-for-woocommerce-3-1-2-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-47644
Published: 2025-05-07
Description: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in formsintegrations Integrations of Zoho CRM with Elementor form integrations-of-zoho-crm-with-elementor-form allows Phishing.This issue affects Integrations of Zoho CRM with Elementor form: from n/a through <= 1.0.8.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-601
References: https://patchstack.com/database/Wordpress/Plugin/integrations-of-zoho-crm-with-elementor-form/vulnerability/wordpress-integrations-of-zoho-crm-with-elementor-form-1-0-7-open-redirection-vulnerability?_s_id=cve
CVE: CVE-2025-47647
Published: 2025-05-07
Description: Cross-Site Request Forgery (CSRF) vulnerability in OTWthemes Sidebar Manager Light sidebar-manager-light allows Cross Site Request Forgery.This issue affects Sidebar Manager Light: from n/a through <= 1.18.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/sidebar-manager-light/vulnerability/wordpress-sidebar-manager-light-1-18-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-47648
Published: 2025-05-07
Description: Cross-Site Request Forgery (CSRF) vulnerability in axima Pays – WooCommerce Payment Gateway axima-payment-gateway allows Stored XSS.This issue affects Pays – WooCommerce Payment Gateway: from n/a through <= 2.6.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/axima-payment-gateway/vulnerability/wordpress-pays-woocommerce-payment-gateway-2-6-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-47649
Published: 2025-05-07
Description: Path Traversal: '.../...//' vulnerability in StackWC Open Close WooCommerce Store woc-open-close allows PHP Local File Inclusion.This issue affects Open Close WooCommerce Store: from n/a through <= 4.9.9.
CVSS Score: 8.8 (HIGH)
CWE: CWE-35
References: https://patchstack.com/database/Wordpress/Plugin/woc-open-close/vulnerability/wordpress-open-close-woocommerce-store-4-9-5-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-47653
Published: 2025-05-07
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in tggfref WP-Recall allows PHP Local File Inclusion. This issue affects WP-Recall: from n/a through 16.26.14.
CVSS Score: 7.5 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/wordpress/plugin/wp-recall/vulnerability/wordpress-wp-recall-16-26-14-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-47655
Published: 2025-05-07
Description: Cross-Site Request Forgery (CSRF) vulnerability in themarketer2023 theMarketer themarketer allows Stored XSS.This issue affects theMarketer: from n/a through <= 1.4.7.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/themarketer/vulnerability/wordpress-themarketer-plugin-1-4-7-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE: CVE-2025-47656
Published: 2025-05-07
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Spiracle Themes Spiraclethemes Site Library spiraclethemes-site-library allows Stored XSS.This issue affects Spiraclethemes Site Library: from n/a through <= 1.5.4.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/spiraclethemes-site-library/vulnerability/wordpress-spiraclethemes-site-library-1-4-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-47657
Published: 2025-05-07
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Productive Minds Productive Commerce productive-commerce allows SQL Injection.This issue affects Productive Commerce: from n/a through <= 1.1.40.
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/productive-commerce/vulnerability/wordpress-productive-commerce-1-1-22-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-47659
Published: 2025-05-07
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in voidcoders WPBakery Visual Composer WHMCS Elements void-visual-whmcs-element allows Stored XSS.This issue affects WPBakery Visual Composer WHMCS Elements: from n/a through <= 1.0.4.3.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/void-visual-whmcs-element/vulnerability/wordpress-wpbakery-visual-composer-whmcs-elements-1-0-4-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-47661
Published: 2025-05-07
Description: Cross-Site Request Forgery (CSRF) vulnerability in codemstory 워드프레스 결제 심플페이 pgall-for-woocommerce allows Cross Site Request Forgery.This issue affects 워드프레스 결제 심플페이: from n/a through <= 5.2.11.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/pgall-for-woocommerce/vulnerability/wordpress-5-2-11-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-47662
Published: 2025-05-07
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in woobox Woobox woobox allows Stored XSS.This issue affects Woobox: from n/a through <= 1.6.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/woobox/vulnerability/wordpress-woobox-1-6-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-47664
Published: 2025-05-07
Description: Server-Side Request Forgery (SSRF) vulnerability in ThimPress WP Pipes allows Server Side Request Forgery. This issue affects WP Pipes: from n/a through 1.4.2.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-918
References: https://patchstack.com/database/wordpress/plugin/wp-pipes/vulnerability/wordpress-wp-pipes-1-4-2-server-side-request-forgery-ssrf-vulnerability?_s_id=cve
CVE: CVE-2025-47665
Published: 2025-05-07
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bistromatic N360 | Splash Screen n360-splash-screen allows Stored XSS.This issue affects N360 | Splash Screen: from n/a through <= 1.0.6.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/n360-splash-screen/vulnerability/wordpress-n360-splash-screen-1-0-6-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-47667
Published: 2025-05-07
Description: Cross-Site Request Forgery (CSRF) vulnerability in qusupport LiveAgent liveagent allows Cross Site Request Forgery.This issue affects LiveAgent: from n/a through <= 4.4.7.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/liveagent/vulnerability/wordpress-liveagent-4-4-7-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-47668
Published: 2025-05-07
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in cookiecode CookieCode cookiecode allows Stored XSS.This issue affects CookieCode: from n/a through <= 2.4.4.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/cookiecode/vulnerability/wordpress-cookiecode-2-4-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-47669
Published: 2025-05-07
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sabuj Kundu CBX Map for Google Map & OpenStreetMap cbxgooglemap allows DOM-Based XSS.This issue affects CBX Map for Google Map & OpenStreetMap: from n/a through <= 1.1.12.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/cbxgooglemap/vulnerability/wordpress-cbx-map-for-google-map-openstreetmap-1-1-12-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-47674
Published: 2025-05-07
Description: Cross-Site Request Forgery (CSRF) vulnerability in Credova Financial Credova_Financial credova-financial allows Cross Site Request Forgery.This issue affects Credova_Financial: from n/a through <= 2.5.0.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/credova-financial/vulnerability/wordpress-credova-financial-2-5-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-47675
Published: 2025-05-07
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in woobox Woobox woobox allows DOM-Based XSS.This issue affects Woobox: from n/a through <= 1.6.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/woobox/vulnerability/wordpress-woobox-1-6-cross-site-scripting-xss-vulnerability-2?_s_id=cve
CVE: CVE-2025-47676
Published: 2025-05-07
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Faiyaz Alam User Login History user-login-history allows Stored XSS.This issue affects User Login History: from n/a through <= 2.1.6.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/user-login-history/vulnerability/wordpress-user-login-history-2-1-6-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-47677
Published: 2025-05-07
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in gt3themes Photo Gallery gt3-photo-video-gallery allows Stored XSS.This issue affects Photo Gallery: from n/a through <= 2.7.7.25.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/gt3-photo-video-gallery/vulnerability/wordpress-photo-gallery-gt3-image-gallery-gutenberg-block-gallery-2-7-7-25-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-47679
Published: 2025-05-07
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RS WP THEMES RS WP Book Showcase rs-wp-books-showcase allows DOM-Based XSS.This issue affects RS WP Book Showcase: from n/a through <= 6.7.59.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/rs-wp-books-showcase/vulnerability/wordpress-rs-wp-book-showcase-6-7-40-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-47681
Published: 2025-05-07
Description: Cross-Site Request Forgery (CSRF) vulnerability in Ability, Inc Web Accessibility with Max Access accessibility-toolbar allows Cross Site Request Forgery.This issue affects Web Accessibility with Max Access: from n/a through <= 2.0.9.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/accessibility-toolbar/vulnerability/wordpress-web-accessibility-with-max-access-2-0-9-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-47683
Published: 2025-05-07
Description: Deserialization of Untrusted Data vulnerability in Florent Maillefaud WP Maintenance wp-maintenance allows Object Injection.This issue affects WP Maintenance: from n/a through <= 6.1.9.7.
CVSS Score: 7.2 (HIGH)
CWE: CWE-502
References: https://patchstack.com/database/Wordpress/Plugin/wp-maintenance/vulnerability/wordpress-wp-maintenance-6-1-9-7-php-object-injection-vulnerability?_s_id=cve
CVE: CVE-2025-47684
Published: 2025-05-07
Description: Cross-Site Request Forgery (CSRF) vulnerability in Smaily Smaily for WP smaily-for-wp allows Cross Site Request Forgery.This issue affects Smaily for WP: from n/a through <= 3.1.7.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/smaily-for-wp/vulnerability/wordpress-smaily-for-wp-3-1-6-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-47685
Published: 2025-05-07
Description: Cross-Site Request Forgery (CSRF) vulnerability in Moloni Contribuinte Checkout contribuinte-checkout allows Stored XSS.This issue affects Contribuinte Checkout: from n/a through <= 2.0.03.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/contribuinte-checkout/vulnerability/wordpress-contribuinte-checkout-plugin-2-0-02-cross-site-request-forgery-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE: CVE-2025-47686
Published: 2025-05-07
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DELUCKS DELUCKS SEO delucks-seo allows Stored XSS.This issue affects DELUCKS SEO: from n/a through <= 2.5.9.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/delucks-seo/vulnerability/wordpress-delucks-seo-2-5-9-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-47688
Published: 2025-05-07
Description: Missing Authorization vulnerability in Saad Iqbal Advanced File Manager file-manager-advanced allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Advanced File Manager: from n/a through <= 5.3.1.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/file-manager-advanced/vulnerability/wordpress-advanced-file-manager-plugin-5-3-1-broken-access-control-to-notice-dismissal-vulnerability?_s_id=cve
CVE: CVE-2025-47691
Published: 2025-05-07
Description: Improper Control of Generation of Code ('Code Injection') vulnerability in Ultimate Member Ultimate Member ultimate-member allows Code Injection.This issue affects Ultimate Member: from n/a through <= 2.10.3.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-94
References: https://patchstack.com/database/Wordpress/Plugin/ultimate-member/vulnerability/wordpress-ultimate-member-plugin-2-10-3-arbitrary-function-call-vulnerability?_s_id=cve
CVE: CVE-2025-47692
Published: 2025-05-07
Description: Missing Authorization vulnerability in contentstudio Contentstudio contentstudio allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Contentstudio: from n/a through <= 1.3.5.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/contentstudio/vulnerability/wordpress-contentstudio-1-3-3-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-47619
Published: 2025-05-07
Description: syslog-ng is an enhanced log daemo. Prior to version 4.8.2, `tls_wildcard_match()` matches on certificates such as `foo.*.bar` although that is not allowed. It is also possible to pass partial wildcards such as `foo.a*c.bar` which glib matches but should be avoided / invalidated. This issue could have an impact on TLS connections, such as in man-in-the-middle situations. Version 4.8.2 contains a fix for the issue.
CVSS Score: 7.5 (HIGH)
CWE: CWE-295
References: https://github.com/syslog-ng/syslog-ng/blob/b0ccc8952d333fbc2d97e51fddc0b569a15e7a7d/lib/transport/tls-verifier.c#L78-L110; https://github.com/syslog-ng/syslog-ng/commit/dadfdbecde5bfe710b0a6ee5699f96926b3f9006; https://github.com/syslog-ng/syslog-ng/releases/tag/syslog-ng-4.8.2
CVE: CVE-2025-46827
Published: 2025-05-07
Description: Graylog is a free and open log management platform. Prior to versions 6.0.14, 6.1.10, and 6.2.0, it is possible to obtain user session cookies by submitting an HTML form as part of an Event Definition Remediation Step field. For this attack to succeed, the attacker needs a user account with permissions to create event definitions, while the user must have permissions to view alerts. Additionally, an active Input must be present on the Graylog server that is capable of receiving form data (e.g. a HTTP input, TCP raw or syslog etc). Versions 6.0.14, 6.1.10, and 6.2.0 fix the issue. No known workarounds are available, as long as the relatively rare prerequisites are met.
CVSS Score: 8.0 (HIGH)
CWE: CWE-79
References: https://github.com/Graylog2/graylog2-server/security/advisories/GHSA-76vf-mpmx-777j
CVE: CVE-2025-46551
Published: 2025-05-07
Description: JRuby-OpenSSL is an add-on gem for JRuby that emulates the Ruby OpenSSL native library. Starting in JRuby-OpenSSL version 0.12.1 and prior to version 0.15.4 (corresponding to JRuby versions starting in 9.3.4.0 prior to 9.4.12.1 and 10.0.0.0 prior to 10.0.0.1), when verifying SSL certificates, JRuby-OpenSSL does not verify that the hostname presented in the certificate matches the one the user tries to connect to. This means a man-in-the-middle could just present any valid cert for a completely different domain they own, and JRuby would accept the cert. Anybody using JRuby to make requests of external APIs, or scraping the web, that depends on https to connect securely. JRuby-OpenSSL version 0.15.4 contains a fix for the issue. This fix is included in JRuby versions 10.0.0.1 and 9.4.12.1.
CVSS Score: 3.7 (LOW)
CWE: CWE-295
References: https://github.com/jruby/jruby-openssl/commit/31a56d690ce9b8af47af09aaaf809081949ed285; https://github.com/jruby/jruby-openssl/security/advisories/GHSA-72qj-48g4-5xgx; https://github.com/jruby/jruby-openssl/security/advisories/GHSA-72qj-48g4-5xgx
CVE: CVE-2025-20122
Published: 2025-05-07
Description: A vulnerability in the CLI of Cisco Catalyst SD-WAN Manager, formerly Cisco SD-WAN vManage, could allow an authenticated, local attacker to gain privileges of the root user on the underlying operating system.

This vulnerability is due to insufficient input validation. An authenticated attacker with read-only privileges on the SD-WAN Manager system could exploit this vulnerability by sending a crafted request to the CLI of the SD-WAN Manager. A successful exploit could allow the attacker to gain root privileges on the underlying operating system.
CVSS Score: 7.8 (HIGH)
CWE: CWE-300
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-priviesc-WCk7bmmt
CVE: CVE-2025-20137
Published: 2025-05-07
Description: A vulnerability in the access control list (ACL) programming of Cisco IOS Software that is running on Cisco Catalyst 1000 Switches and Cisco Catalyst 2960L Switches could allow an unauthenticated, remote attacker to bypass a configured ACL.
 This vulnerability is due to the use of both an IPv4 ACL and a dynamic ACL of IP Source Guard on the same interface, which is an unsupported configuration. An attacker could exploit this vulnerability by attempting to send traffic through an affected device. A successful exploit could allow the attacker to bypass an ACL on the affected device.
 Note: Cisco documentation has been updated to reflect that this is an unsupported configuration. However, Cisco is publishing this advisory because the device will not prevent an administrator from configuring both features on the same interface. There are no plans to implement the ability to configure both features on the same interface on Cisco Catalyst 1000 or Catalyst 2960L Switches.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-284
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ipsgacl-pg6qfZk
CVE: CVE-2025-20140
Published: 2025-05-07
Description: A vulnerability in the Wireless Network Control daemon (wncd) of Cisco IOS XE Software for Wireless LAN Controllers (WLCs) could allow an unauthenticated, adjacent wireless attacker to cause a denial of service (DoS) condition.
 This vulnerability is due to improper memory management. An attacker could exploit this vulnerability by sending a series of IPv6 network requests from an associated wireless IPv6 client to an affected device. To associate a client to a device, an attacker may first need to authenticate to the network, or associate freely in the case of a configured open network. A successful exploit could allow the attacker to cause the wncd process to consume available memory and eventually cause the device to stop responding, resulting in a DoS condition.
CVSS Score: 7.4 (HIGH)
CWE: CWE-789
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-wlc-wncd-p6Gvt6HL