deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-9185
Published: 2025-08-19
Description: Memory safety bugs present in Firefox ESR 115.26, Firefox ESR 128.13, Thunderbird ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 142, Firefox ESR 115.27, Firefox ESR 128.14, Firefox ESR 140.2, Thunderbird 142, Thunderbird 128.14, and Thunderbird 140.2.
CVSS Score: 8.1 (HIGH)
CWE: CWE-119
References: https://bugzilla.mozilla.org/buglist.cgi?bug_id=1970154%2C1976782%2C1977166; https://www.mozilla.org/security/advisories/mfsa2025-64/; https://www.mozilla.org/security/advisories/mfsa2025-65/
CVE: CVE-2025-9186
Published: 2025-08-19
Description: Spoofing issue in the Address Bar component of Firefox Focus for Android. This vulnerability was fixed in Firefox 142.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-451
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1445758; https://www.mozilla.org/security/advisories/mfsa2025-64/
CVE: CVE-2025-9187
Published: 2025-08-19
Description: Memory safety bugs present in Firefox 141 and Thunderbird 141. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 142 and Thunderbird 142.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: https://bugzilla.mozilla.org/buglist.cgi?bug_id=1825621%2C1970079%2C1976736%2C1979072; https://www.mozilla.org/security/advisories/mfsa2025-64/; https://www.mozilla.org/security/advisories/mfsa2025-70/
CVE: CVE-2025-9169
Published: 2025-08-19
Description: A vulnerability was determined in SolidInvoice up to 2.4.0. Impacted is an unknown function of the file /quotes of the component Quote Module. This manipulation of the argument Name causes cross site scripting. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94
References: https://github.com/Gabrielmouraofc/PoC_Vuldb/blob/main/%F0%9F%93%84PoC%20-%20Stored%20XSS%203.md; https://github.com/Gabrielmouraofc/PoC_Vuldb/blob/main/%F0%9F%93%84PoC%20-%20Stored%20XSS%203.md#-exploitation-steps; https://vuldb.com/?ctiid.320546
CVE: CVE-2025-9170
Published: 2025-08-19
Description: A vulnerability was identified in SolidInvoice up to 2.4.0. The affected element is an unknown function of the file /tax/rates of the component Tax Rates Module. Such manipulation of the argument Name leads to cross site scripting. The attack can be executed remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94
References: https://github.com/Gabrielmouraofc/PoC_Vuldb/blob/main/%F0%9F%93%84PoC%20-Stored%20XSS%204.md; https://github.com/Gabrielmouraofc/PoC_Vuldb/blob/main/%F0%9F%93%84PoC%20-Stored%20XSS%204.md#-exploitation-steps; https://vuldb.com/?ctiid.320547
CVE: CVE-2025-9171
Published: 2025-08-19
Description: A security flaw has been discovered in SolidInvoice up to 2.4.0. The impacted element is an unknown function of the file /clients of the component Clients Module. Performing manipulation of the argument Name results in cross site scripting. The attack is possible to be carried out remotely. The exploit has been released to the public and may be exploited. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94
References: https://github.com/Gabrielmouraofc/PoC_Vuldb/blob/main/%F0%9F%95%B5%EF%B8%8F%E2%80%8D%E2%99%82%EF%B8%8F%20PoC%20%E2%80%93%20Stored%20XSS%205.md; https://github.com/Gabrielmouraofc/PoC_Vuldb/blob/main/%F0%9F%95%B5%EF%B8%8F%E2%80%8D%E2%99%82%EF%B8%8F%20PoC%20%E2%80%93%20Stored%20XSS%205.md#-exploitation-steps; https://vuldb.com/?ctiid.320548
CVE: CVE-2025-9174
Published: 2025-08-19
Description: A vulnerability was determined in neurobin shc up to 4.0.3. This vulnerability affects the function make of the file src/shc.c of the component Filename Handler. Executing manipulation can lead to os command injection. The attack can only be executed locally. The exploit has been publicly disclosed and may be utilized.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-77, CWE-78, CWE-78
References: https://magnificent-dill-351.notion.site/Command-Execution-in-shc-4-0-3-249c693918ed8040abe3e636c7f18c96; https://vuldb.com/?ctiid.320555; https://vuldb.com/?id.320555
CVE: CVE-2025-9175
Published: 2025-08-19
Description: A vulnerability was identified in neurobin shc up to 4.0.3. This issue affects the function make of the file src/shc.c. The manipulation leads to stack-based buffer overflow. The attack can only be performed from a local environment. The exploit is publicly available and might be used.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-119, CWE-121, CWE-787
References: https://magnificent-dill-351.notion.site/Stack-Overflow-in-shc-4-0-3-249c693918ed804b8c44ee11eb0af087; https://vuldb.com/?ctiid.320556; https://vuldb.com/?id.320556
CVE: CVE-2025-9176
Published: 2025-08-20
Description: A security flaw has been discovered in neurobin shc up to 4.0.3. Impacted is the function make of the file src/shc.c of the component Environment Variable Handler. The manipulation results in os command injection. The attack is only possible with local access. The exploit has been released to the public and may be exploited.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-77, CWE-78, CWE-78
References: https://magnificent-dill-351.notion.site/Command-Execution-of-env-in-shc-4-0-3-249c693918ed80c997f4e9420f945d01; https://vuldb.com/?ctiid.320557; https://vuldb.com/?id.320557
CVE: CVE-2025-9193
Published: 2025-08-20
Description: A flaw has been found in TOTVS Portal Meu RH up to 12.1.17. Impacted is an unknown function of the component Password Reset Handler. Executing manipulation of the argument redirectUrl can lead to open redirect. The attack may be performed from a remote location. The exploit has been published and may be used. Upgrading to version 12.1.2410.274, 12.1.2502.178 and 12.1.2506.121 is recommended to address this issue. It is recommended to upgrade the affected component. The vendor explains, that "[o]ur internal validation (...) confirms that the reported behavior does not exist in currently supported releases. In these tests, the redirectUrl parameter is ignored, and no malicious redirection occurs." This vulnerability only affects products that are no longer supported by the maintainer.
CVSS Score: 3.5 (LOW)
CWE: CWE-601
References: https://drive.google.com/file/d/1iorjSJ8gh3hTDZUy1fHyV-TJXFP43yIo/view?usp=sharing; https://vuldb.com/?ctiid.320579; https://vuldb.com/?id.320579
CVE: CVE-2024-12223
Published: 2025-08-20
Description: Prism Central versions prior to 2024.3.1 are vulnerable to a stored cross-site scripting attack via the Events component, allowing an attacker to hijack a victim user’s session and perform actions in their security context.
CWE: CWE-79
References: https://www.themissinglink.com.au/security-advisories/cve-2024-12223
CVE: CVE-2025-9132
Published: 2025-08-20
Description: Out of bounds write in V8 in Google Chrome prior to 139.0.7258.138 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://chromereleases.googleblog.com/2025/08/stable-channel-update-for-desktop_19.html; https://issues.chromium.org/issues/436181695
CVE: CVE-2025-54363
Published: 2025-08-20
Description: Microsoft Knack 0.12.0 allows Regular expression Denial of Service (ReDoS) in the knack.introspection module. extract_full_summary_from_signature employs an inefficient regular expression pattern: "\s(:param)\s+(.+?)\s:(.*)" that is susceptible to catastrophic backtracking when processing crafted docstrings containing a large volume of whitespace without a terminating colon. An attacker who can control or inject docstring content into affected applications can trigger excessive CPU consumption. This software is used by Azure CLI.
CWE: CWE-1333
References: https://github.com/microsoft/knack; https://github.com/microsoft/knack/issues/281; https://www.vulncheck.com/advisories/microsoft-knack-python-package-regular-expression-dos
CVE: CVE-2025-54364
Published: 2025-08-20
Description: Microsoft Knack 0.12.0 allows Regular expression Denial of Service (ReDoS) in the knack.introspection module. option_descriptions employs an inefficient regular expression pattern: "\s(:param)\s+(.+?)\s:(.*)" that is susceptible to catastrophic backtracking when processing crafted docstrings containing a large volume of whitespace without a terminating colon. An attacker who can control or inject docstring content into affected applications can trigger excessive CPU consumption. This software is used by Azure CLI.
CWE: CWE-1333
References: https://github.com/microsoft/knack; https://www.vulncheck.com/advisories/microsoft-knack-python-package-regular-expression-dos
CVE: CVE-2025-8141
Published: 2025-08-20
Description: The Redirection for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_associated_files function in all versions up to, and including, 3.2.4. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
CVSS Score: 8.8 (HIGH)
CWE: CWE-22
References: https://plugins.trac.wordpress.org/browser/wpcf7-redirect/tags/3.2.3/classes/class-wpcf7r-save-files.php#L80; https://www.wordfence.com/threat-intel/vulnerabilities/id/fafd0159-25ab-430d-88ef-c4d09d23baa7?source=cve
CVE: CVE-2025-8145
Published: 2025-08-20
Description: The Redirection for Contact Form 7 plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.2.4 via deserialization of untrusted input in the get_lead_fields function. This makes it possible for unauthenticated attackers to inject a PHP Object. The additional presence of a POP chain in a Contact Form 7 plugin allows attackers to delete arbitrary files. Additionally, in certain server configurations, Remote Code Execution is possible
CVSS Score: 8.8 (HIGH)
CWE: CWE-502
References: https://plugins.trac.wordpress.org/browser/wpcf7-redirect/tags/3.2.3/classes/class-wpcf7r-lead.php#L144; https://www.wordfence.com/threat-intel/vulnerabilities/id/2cb275d5-ec4b-419f-84e1-84172d381411?source=cve
CVE: CVE-2025-8289
Published: 2025-08-20
Description: The Redirection for Contact Form 7 plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.2.4 via deserialization of untrusted input in the delete_associated_files function. This makes it possible for unauthenticated attackers to inject a PHP Object. This vulnerability may be exploited by unauthenticated attackers when a form is present on the site with a file upload action, and doesn't affect sites with PHP version > 8. This vulnerability also requires the 'Redirection For Contact Form 7 Extension - Create Post' extension to be installed and activated in order to be exploited. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present. We confirmed there is a usable gadget in Contact Form 7 plugin that makes arbitrary file deletion possible when installed with this plugin. Given Contact Form 7 is a requirement of this plugin, it is likely that any site with this plugin and the 'Redirection For Contact Form 7 Extension - Create Post' extension enabled is vulnerable to arbitrary file deletion.
CVSS Score: 7.5 (HIGH)
CWE: CWE-502
References: https://plugins.trac.wordpress.org/browser/wpcf7-redirect/tags/3.2.4/classes/class-wpcf7r-save-files.php#L80; https://www.wordfence.com/threat-intel/vulnerabilities/id/c7909b75-8087-4d38-8325-c619bf84d997?source=cve
CVE: CVE-2025-57788
Published: 2025-08-20
Description: A vulnerability in a known login mechanism allows unauthenticated attackers to execute API calls without requiring user credentials. RBAC helps limit the exposure but does not eliminate risk.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-259
References: https://documentation.commvault.com/securityadvisories/CV_2025_08_3.html; https://labs.watchtowr.com/guess-who-would-be-stupid-enough-to-rob-the-same-vault-twice-pre-auth-rce-chains-in-commvault/#wt-2025-0047hardcoded-credentials
CVE: CVE-2025-57789
Published: 2025-08-20
Description: During the brief window between installation and the first administrator login, remote attackers may exploit the default credential to gain admin control. This is limited to the setup phase, before any jobs have been configured.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-257
References: https://documentation.commvault.com/securityadvisories/CV_2025_08_4.html
CVE: CVE-2025-57790
Published: 2025-08-20
Description: A security vulnerability has been identified that allows remote attackers to perform unauthorized file system access through a path traversal issue. The vulnerability may lead to remote code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-36
References: https://documentation.commvault.com/securityadvisories/CV_2025_08_2.html
CVE: CVE-2025-57791
Published: 2025-08-20
Description: A security vulnerability has been identified that allows remote attackers to inject or manipulate command-line arguments passed to internal components due to insufficient input validation. Successful exploitation results in a valid user session for a low privilege role.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-88
References: https://documentation.commvault.com/securityadvisories/CV_2025_08_1.html
CVE: CVE-2025-53522
Published: 2025-08-20
Description: Movable Type contains an issue with use of less trusted source. If exploited, tampered email to reset a password may be sent by a remote unauthenticated attacker.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-348
References: https://jvn.jp/en/jp/JVN76729865/; https://movabletype.org/news/2025/08/mt-843-released.html
CVE: CVE-2025-54551
Published: 2025-08-20
Description: Synapse Mobility 8.0, 8.0.1, 8.0.2, 8.1, and 8.1.1 contain a privilege escalation vulnerability through external control of Web parameter. If exploited, a user of the product may escalate the privilege and access data that the user do not have permission to view by altering the parameters of the search function.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-472
References: https://healthcaresolutions-us.fujifilm.com/synapse-mobility-vulnerability-notification; https://jvn.jp/en/vu/JVNVU94286093/
CVE: CVE-2025-55706
Published: 2025-08-20
Description: URL redirection to untrusted site ('Open Redirect')  issue exists in Movable Type. If this vulnerability is exploited, an invalid parameter may be inserted into the password reset page, which may lead to redirection to an arbitrary URL.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-601
References: https://jvn.jp/en/jp/JVN76729865/; https://movabletype.org/news/2025/08/mt-843-released.html
CVE: CVE-2025-8618
Published: 2025-08-20
Description: The WPC Smart Quick View for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's woosq_btn shortcode in all versions up to, and including, 4.2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/woo-smart-quick-view/trunk/wpc-smart-quick-view.php#L545; https://plugins.trac.wordpress.org/changeset/3346074/; https://wordpress.org/plugins/woo-smart-quick-view
CVE: CVE-2025-9202
Published: 2025-08-20
Description: The ColorMag theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the welcome_notice_import_handler() function in all versions up to, and including, 4.0.19. This makes it possible for authenticated attackers, with Subscriber-level access and above, to install the ThemeGrill Demo Importer plugin.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://research.cleantalk.org/CVE-2025-9202; https://themes.trac.wordpress.org/changeset/283558/colormag/4.0.20/inc/admin/class-colormag-welcome-notice.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/b1922b16-e76c-4ee6-83ad-77970c8c25c0?source=cve
CVE: CVE-2025-28977
Published: 2025-08-20
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThimPress WP Pipes allows Reflected XSS. This issue affects WP Pipes: from n/a through 1.4.3.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/wordpress/plugin/wp-pipes/vulnerability/wordpress-wp-pipes-plugin-1-4-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-30975
Published: 2025-08-20
Description: Improper Control of Generation of Code ('Code Injection') vulnerability in SaifuMak Add Custom Codes add-custom-codes allows Code Injection.This issue affects Add Custom Codes: from n/a through <= 4.80.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: https://patchstack.com/database/Wordpress/Plugin/add-custom-codes/vulnerability/wordpress-add-custom-codes-4-80-arbitrary-code-execution-vulnerability?_s_id=cve
CVE: CVE-2025-47650
Published: 2025-08-20
Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Infility Infility Global infility-global allows Path Traversal.This issue affects Infility Global: from n/a through <= 2.15.06.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://patchstack.com/database/Wordpress/Plugin/infility-global/vulnerability/wordpress-infility-global-2-11-2-arbitrary-file-download-vulnerability?_s_id=cve
CVE: CVE-2025-48142
Published: 2025-08-20
Description: Incorrect Privilege Assignment vulnerability in Saad Iqbal Bookify bookify allows Privilege Escalation.This issue affects Bookify: from n/a through <= 1.0.9.
CVSS Score: 8.8 (HIGH)
CWE: CWE-266
References: https://patchstack.com/database/Wordpress/Plugin/bookify/vulnerability/wordpress-bookify-1-0-9-privilege-escalation-vulnerability?_s_id=cve
CVE: CVE-2025-48148
Published: 2025-08-20
Description: Unrestricted Upload of File with Dangerous Type vulnerability in StoreKeeper B.V. StoreKeeper for WooCommerce storekeeper-for-woocommerce allows Using Malicious Files.This issue affects StoreKeeper for WooCommerce: from n/a through <= 14.4.4.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-434
References: https://patchstack.com/database/Wordpress/Plugin/storekeeper-for-woocommerce/vulnerability/wordpress-storekeeper-for-woocommerce-plugin-14-4-4-arbitrary-file-upload-vulnerability?_s_id=cve
CVE: CVE-2025-48149
Published: 2025-08-20
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in dedalx Cook&Meal cookandmeal allows PHP Local File Inclusion.This issue affects Cook&Meal: from n/a through <= 1.2.3.
CVSS Score: 8.1 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Theme/cookandmeal/vulnerability/wordpress-cook-meal-1-2-3-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-48151
Published: 2025-08-20
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CreativeMindsSolutions CM Map Locations cm-map-locations allows Reflected XSS.This issue affects CM Map Locations: from n/a through <= 2.1.6.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/cm-map-locations/vulnerability/wordpress-cm-map-locations-2-1-6-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-48152
Published: 2025-08-20
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dimafreund Rentsyst rentsyst allows Reflected XSS.This issue affects Rentsyst: from n/a through <= 2.0.100.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/rentsyst/vulnerability/wordpress-rentsyst-plugin-2-0-100-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-48154
Published: 2025-08-20
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup Multimedia Playlist Slider Addon for WPBakery Page Builder lbg_vp_youtube_vimeo_addon_visual_composer allows Reflected XSS.This issue affects Multimedia Playlist Slider Addon for WPBakery Page Builder: from n/a through <= 2.1.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/lbg_vp_youtube_vimeo_addon_visual_composer/vulnerability/wordpress-multimedia-playlist-slider-addon-for-wpbakery-page-builder-plugin-2-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-48157
Published: 2025-08-20
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Michele Giorgi Formality formality allows PHP Local File Inclusion.This issue affects Formality: from n/a through <= 1.5.9.
CVSS Score: 8.1 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Plugin/formality/vulnerability/wordpress-formality-1-5-9-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-48158
Published: 2025-08-20
Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Alex Githatu BuddyPress XProfile Custom Image Field buddypress-xprofile-image-field allows Path Traversal.This issue affects BuddyPress XProfile Custom Image Field: from n/a through <= 3.0.1.
CVSS Score: 8.6 (HIGH)
CWE: CWE-22
References: https://patchstack.com/database/Wordpress/Plugin/buddypress-xprofile-image-field/vulnerability/wordpress-buddypress-xprofile-custom-image-field-plugin-3-0-1-arbitrary-file-deletion-vulnerability?_s_id=cve
CVE: CVE-2025-48159
Published: 2025-08-20
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup Youtube Vimeo Video Player and Slider WP Plugin video-player-youtube-vimeo allows Reflected XSS.This issue affects Youtube Vimeo Video Player and Slider WP Plugin: from n/a through <= 3.8.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/video-player-youtube-vimeo/vulnerability/wordpress-youtube-vimeo-video-player-and-slider-wp-plugin-3-8-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-48160
Published: 2025-08-20
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in CocoBasic Caliris caliris-wp allows PHP Local File Inclusion.This issue affects Caliris: from n/a through <= 1.5.
CVSS Score: 8.1 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Theme/caliris-wp/vulnerability/wordpress-caliris-1-5-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-48162
Published: 2025-08-20
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in quantumcloud Simple Business Directory Pro simple-business-directory-pro allows Reflected XSS.This issue affects Simple Business Directory Pro: from n/a through <= 15.5.1.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/simple-business-directory-pro/vulnerability/wordpress-simple-business-directory-pro-15-5-1-cross-site-scripting-xss-vulnerability?_s_id=cve