deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-0961
Published: 2025-02-01
Description: A vulnerability, which was classified as problematic, has been found in code-projects Job Recruitment 1.0. Affected by this issue is some unknown functionality of the file /_parse/load_job-details.php. The manipulation of the argument business_stream_name/company_website_url leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94
References: https://code-projects.org/; https://github.com/J0hnFFFF/j0hn_upload_one/blob/main/xss.pdf; https://vuldb.com/?ctiid.294356
CVE: CVE-2024-0131
Published: 2025-02-02
Description: NVIDIA GPU kernel driver for Windows and Linux contains a vulnerability where a potential user-mode attacker could read  a buffer with an incorrect length. A successful exploit of this vulnerability might lead to denial of service.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-805
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5614
CVE: CVE-2025-0967
Published: 2025-02-02
Description: A vulnerability was found in code-projects Chat System 1.0 and classified as critical. This issue affects some unknown processing of the file /user/add_chatroom.php. The manipulation of the argument chatname/chatpass leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://code-projects.org/; https://github.com/Team-intN18-SoybeanSeclab/CVE/blob/main/sqlinject1.md; https://vuldb.com/?ctiid.294359
CVE: CVE-2025-0970
Published: 2025-02-02
Description: A vulnerability was found in Zenvia Movidesk up to 25.01.22. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /Account/Login. The manipulation of the argument ReturnUrl leads to open redirect. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 25.01.22.245a473c54 is able to address this issue. It is recommended to upgrade the affected component.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-601
References: https://vuldb.com/?ctiid.294361; https://vuldb.com/?id.294361; https://vuldb.com/?submit.485985
CVE: CVE-2025-0971
Published: 2025-02-03
Description: A vulnerability was found in Zenvia Movidesk up to 25.01.22. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /Account/EditProfile of the component Profile Editing. The manipulation of the argument username leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 25.01.22.245a473c54 is able to address this issue. It is recommended to upgrade the affected component.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94
References: https://vuldb.com/?ctiid.294362; https://vuldb.com/?id.294362; https://vuldb.com/?submit.486023
CVE: CVE-2025-0972
Published: 2025-02-03
Description: A vulnerability classified as problematic has been found in Zenvia Movidesk up to 25.01.22. This affects an unknown part of the component New Ticket Handler. The manipulation of the argument subject leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 25.01.22.245a473c54 is able to address this issue. It is recommended to upgrade the affected component.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94
References: https://github.com/yago3008/cves/blob/main/Moviedesk%20-%20Stored%20Cross%20Site%20Script%20On%20Create%20TIcket%20Field.pdf; https://vuldb.com/?ctiid.294363; https://vuldb.com/?id.294363
CVE: CVE-2025-0973
Published: 2025-02-03
Description: A vulnerability classified as critical was found in CmsEasy 7.7.7.9. This vulnerability affects the function backAll_action in the library lib/admin/database_admin.php of the file /index.php?case=database&act=backAll&admin_dir=admin&site=default. The manipulation of the argument select[] leads to path traversal. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-22
References: https://github.com/Sinon2003/cve/blob/main/CmsEasy/CmsEasy-V7.7.7.9%[PII_REDACTED]-Directory%20Traversal.md; https://vuldb.com/?ctiid.294364; https://vuldb.com/?id.294364
CVE: CVE-2025-0974
Published: 2025-02-03
Description: A vulnerability was determined in MaxD Lightning Module 4.43/4.44 on OpenCart. This issue affects some unknown processing. Executing a manipulation of the argument li_op/md can lead to deserialization. The attack may be launched remotely. The attack requires a high level of complexity. The exploitability is assessed as difficult. The exploit has been publicly disclosed and may be utilized. Upgrading to version 4.45 is capable of addressing this issue. Upgrading the affected component is advised.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20, CWE-502
References: https://gist.github.com/mcdruid/f8153d7d535c0fcba920e83a64953d4e; https://lightning.devs.mx/download; https://vuldb.com/submit/489672
CVE: CVE-2024-20141
Published: 2025-02-03
Description: In V5 DA, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege, if an attacker has physical access to the device, with no additional execution privileges needed. User interaction is needed for exploitation. Patch ID: ALPS09291402; Issue ID: MSV-2073.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-123, CWE-787
References: https://corp.mediatek.com/product-security-bulletin/February-2025
CVE: CVE-2024-20142
Published: 2025-02-03
Description: In V5 DA, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege, if an attacker has physical access to the device, with no additional execution privileges needed. User interaction is needed for exploitation. Patch ID: ALPS09291406; Issue ID: MSV-2070.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://corp.mediatek.com/product-security-bulletin/February-2025
CVE: CVE-2024-20147
Published: 2025-02-03
Description: In Bluetooth FW, there is a possible reachable assertion due to improper exception handling. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00389046 (Note: For MT79XX chipsets) / ALPS09136501 (Note: For MT2737, MT3603, MT6XXX, and MT8XXX chipsets); Issue ID: MSV-1797.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-617, CWE-617
References: https://corp.mediatek.com/product-security-bulletin/February-2025
CVE: CVE-2025-20631
Published: 2025-02-03
Description: In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00397141; Issue ID: MSV-2187.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://corp.mediatek.com/product-security-bulletin/February-2025
CVE: CVE-2025-20632
Published: 2025-02-03
Description: In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00397139; Issue ID: MSV-2188.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://corp.mediatek.com/product-security-bulletin/February-2025
CVE: CVE-2025-20633
Published: 2025-02-03
Description: In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote (proximal/adjacent) code execution with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00400889; Issue ID: MSV-2491.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://corp.mediatek.com/product-security-bulletin/February-2025
CVE: CVE-2025-20634
Published: 2025-02-03
Description: In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01289384; Issue ID: MSV-2436.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://corp.mediatek.com/product-security-bulletin/February-2025
CVE: CVE-2025-20635
Published: 2025-02-03
Description: In V6 DA, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege, if an attacker has physical access to the device, with no additional execution privileges needed. User interaction is needed for exploitation. Patch ID: ALPS09403752; Issue ID: MSV-2434.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://corp.mediatek.com/product-security-bulletin/February-2025
CVE: CVE-2025-20636
Published: 2025-02-03
Description: In secmem, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS09403554; Issue ID: MSV-2431.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://corp.mediatek.com/product-security-bulletin/February-2025
CVE: CVE-2025-20637
Published: 2025-02-03
Description: In network HW, there is a possible system hang due to an uncaught exception. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00399035; Issue ID: MSV-2380.
CVSS Score: 7.5 (HIGH)
CWE: CWE-248, CWE-754
References: https://corp.mediatek.com/product-security-bulletin/February-2025
CVE: CVE-2025-20638
Published: 2025-02-03
Description: In DA, there is a possible read of uninitialized heap data due to uninitialized data. This could lead to local information disclosure, if an attacker has physical access to the device, with no additional execution privileges needed. User interaction is needed for exploitation. Patch ID: ALPS09291449; Issue ID: MSV-2066.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-457, CWE-908
References: https://corp.mediatek.com/product-security-bulletin/February-2025
CVE: CVE-2025-20639
Published: 2025-02-03
Description: In DA, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege, if an attacker has physical access to the device, with no additional execution privileges needed. User interaction is needed for exploitation. Patch ID: ALPS09291146; Issue ID: MSV-2060.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://corp.mediatek.com/product-security-bulletin/February-2025
CVE: CVE-2025-20640
Published: 2025-02-03
Description: In DA, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure, if an attacker has physical access to the device, with no additional execution privileges needed. User interaction is needed for exploitation. Patch ID: ALPS09291146; Issue ID: MSV-2059.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://corp.mediatek.com/product-security-bulletin/February-2025
CVE: CVE-2025-20641
Published: 2025-02-03
Description: In DA, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege, if an attacker has physical access to the device, with no additional execution privileges needed. User interaction is needed for exploitation. Patch ID: ALPS09291146; Issue ID: MSV-2058.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://corp.mediatek.com/product-security-bulletin/February-2025
CVE: CVE-2025-20642
Published: 2025-02-03
Description: In DA, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege, if an attacker has physical access to the device, with no additional execution privileges needed. User interaction is needed for exploitation. Patch ID: ALPS09291146; Issue ID: MSV-2057.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://corp.mediatek.com/product-security-bulletin/February-2025
CVE: CVE-2025-20643
Published: 2025-02-03
Description: In DA, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure, if an attacker has physical access to the device, if a malicious actor has already obtained the System privilege. User interaction is needed for exploitation. Patch ID: ALPS09291146; Issue ID: MSV-2056.
CVSS Score: 3.9 (LOW)
CWE: CWE-1295, CWE-125
References: https://corp.mediatek.com/product-security-bulletin/February-2025
CVE: CVE-2025-25062
Published: 2025-02-03
Description: An XSS issue was discovered in Backdrop CMS 1.28.x before 1.28.5 and 1.29.x before 1.29.3. It doesn't sufficiently isolate long text content when the CKEditor 5 rich text editor is used. This allows a potential attacker to craft specialized HTML and JavaScript that may be executed when an administrator attempts to edit a piece of content. This vulnerability is mitigated by the fact that an attacker must have the ability to create long text content (such as through the node or comment forms) and an administrator must edit (not view) the content that contains the malicious content. This problem only exists when using the CKEditor 5 module.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-79
References: https://backdropcms.org/security/backdrop-sa-core-2025-001; https://medium.com/@rudranshsinghrajpurohit/cve-2025-25062-stored-cross-site-scripting-xss-in-backdrop-cms-5073df76612b; https://www.getastra.com/blog/vulnerability/cve-2025-25062stored-cross-site-scripting-xss-in-backdrop-cms-v1-28-2/
CVE: CVE-2025-25063
Published: 2025-02-03
Description: An XSS issue was discovered in Backdrop CMS 1.28.x before 1.28.5 and 1.29.x before 1.29.3. It does not sufficiently validate uploaded SVG images to ensure they do not contain potentially dangerous SVG tags. SVG images can contain clickable links and executable scripting, and using a crafted SVG, it is possible to execute scripting in the browser when an SVG image is viewed. This issue is mitigated by the attacker needing to be able to upload SVG images, and that Backdrop embeds all uploaded SVG images within &lt;img&gt; tags, which prevents scripting from executing. The SVG must be viewed directly by its URL in order to run any embedded scripting.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-79
References: https://backdropcms.org/security/backdrop-sa-core-2025-002
CVE: CVE-2024-57966
Published: 2025-02-03
Description: libarchiveplugin.cpp in KDE ark before 24.12.0 can extract to an absolute path from an archive.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-36
References: https://github.com/KDE/ark/commit/fe518d81b338941e0bf1c5ce5e75a9ab6de4bb58; https://github.com/KDE/ark/compare/v24.11.90...v24.12.0; https://lists.debian.org/debian-lts-announce/2025/02/msg00007.html
CVE: CVE-2024-13347
Published: 2025-02-03
Description: The Essential WP Real Estate WordPress plugin through 1.1.3 does not escape generated URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/e2f97636-4c67-409a-83c6-ad6255aa2cc5/
CVE: CVE-2025-25066
Published: 2025-02-03
Description: nDPI through 4.12 has a potential stack-based buffer overflow in ndpi_address_cache_restore in lib/ndpi_cache.c.
CVSS Score: 8.1 (HIGH)
CWE: CWE-121
References: https://github.com/ntop/nDPI/commit/678697b5eb6c3caa5dd5f8cccfe9eed8d13b94bb
CVE: CVE-2024-10395
Published: 2025-02-03
Description: No proper validation of the length of user input in http_server_get_content_type_from_extension.
CVSS Score: 8.6 (HIGH)
CWE: CWE-127
References: https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-hfww-j92m-x8fv; https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-hfww-j92m-x8fv
CVE: CVE-2024-6790
Published: 2025-02-03
Description: Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a non-privileged user process to make valid GPU memory processing operations, including via WebGL or WebGPU, to cause the whole system to become unresponsive.This issue affects Bifrost GPU Kernel Driver: r44p1, from r46p0 through r49p0, from r50p0 through r51p0; Valhall GPU Kernel Driver: r44p1, from r46p0 through r49p0, from r50p0 through r51p0; Arm 5th Gen GPU Architecture Kernel Driver: r44p1, from r46p0 through r49p0, from r50p0 through r51p0.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-835
References: https://developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20Vulnerabilities
CVE: CVE-2025-0015
Published: 2025-02-03
Description: Use After Free vulnerability in Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user process to make improper GPU processing operations to gain access to already freed memory.This issue affects Valhall GPU Kernel Driver: from r48p0 through r49p1, from r50p0 through r52p0; Arm 5th Gen GPU Architecture Kernel Driver: from r48p0 through r49p1, from r50p0 through r52p0.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20Vulnerabilities
CVE: CVE-2024-57522
Published: 2025-02-03
Description: SourceCodester Packers and Movers Management System v1.0 is vulnerable to Cross Site Scripting (XSS) in Users.php. An attacker can inject a malicious script into the username or name field during user creation.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/HackWidMaddy/CVE-2024-57522
CVE: CVE-2024-43333
Published: 2025-02-03
Description: Incorrect Privilege Assignment vulnerability in NotFound Admin and Site Enhancements (ASE) Pro allows Privilege Escalation. This issue affects Admin and Site Enhancements (ASE) Pro: from n/a through 7.6.2.1.
CVSS Score: 7.5 (HIGH)
CWE: CWE-266
References: https://patchstack.com/database/wordpress/plugin/admin-site-enhancements-pro/vulnerability/wordpress-admin-and-site-enhancements-ase-pro-plugin-7-6-2-1-privilege-escalation-vulnerability?_s_id=cve
CVE: CVE-2024-50500
Published: 2025-02-03
Description: Missing Authorization vulnerability in averta Shortcodes and extra features for Phlox theme auxin-elements allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Shortcodes and extra features for Phlox theme: from n/a through <= 2.17.4.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/auxin-elements/vulnerability/wordpress-phlox-core-elements-plugin-2-17-2-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-22260
Published: 2025-02-03
Description: Missing Authorization vulnerability in Marcus (aka @msykes) Meta Tag Manager meta-tag-manager.This issue affects Meta Tag Manager: from n/a through <= 3.1.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/meta-tag-manager/vulnerability/wordpress-meta-tag-manager-plugin-3-1-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-22292
Published: 2025-02-03
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Felipe Peixoto Powerful Auto Chat powers-triggers-of-woo-to-chat allows Stored XSS.This issue affects Powerful Auto Chat: from n/a through <= 1.9.8.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/powers-triggers-of-woo-to-chat/vulnerability/wordpress-powerful-auto-chat-plugin-1-9-8-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-22677
Published: 2025-02-03
Description: Missing Authorization vulnerability in UIUX Lab Uix Shortcodes uix-shortcodes allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Uix Shortcodes: from n/a through <= 2.0.3.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/uix-shortcodes/vulnerability/wordpress-uix-shortcodes-plugin-2-0-3-arbitrary-shortcode-execution-vulnerability?_s_id=cve
CVE: CVE-2025-22679
Published: 2025-02-03
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PickPlugins Job Board Manager job-board-manager allows Reflected XSS.This issue affects Job Board Manager: from n/a through <= 2.1.61.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/job-board-manager/vulnerability/wordpress-job-board-manager-plugin-2-1-60-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-22681
Published: 2025-02-03
Description: Missing Authorization vulnerability in Xfinitysoft Content Cloner super-seo-content-cloner allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Content Cloner: from n/a through <= 1.0.1.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/super-seo-content-cloner/vulnerability/wordpress-content-cloner-plugin-1-0-1-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-22682
Published: 2025-02-03
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Saeed Sattar Beglou Hesabfa Accounting hesabfa-accounting allows Reflected XSS.This issue affects Hesabfa Accounting: from n/a through <= 2.1.2.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/hesabfa-accounting/vulnerability/wordpress-hesabfa-accounting-plugin-2-1-2-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-22683
Published: 2025-02-03
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPDeveloper NotificationX notificationx allows Stored XSS.This issue affects NotificationX: from n/a through <= 2.9.5.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/notificationx/vulnerability/wordpress-notificationx-plugin-2-9-5-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-22684
Published: 2025-02-03
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Hakan Ozevin WP BASE Booking wp-base-booking-of-appointments-services-and-events allows Stored XSS.This issue affects WP BASE Booking: from n/a through <= 5.0.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wp-base-booking-of-appointments-services-and-events/vulnerability/wordpress-wp-base-booking-plugin-5-0-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-22685
Published: 2025-02-03
Description: Cross-Site Request Forgery (CSRF) vulnerability in CheGevara29 Tags to Keywords tags-to-meta-keywords allows Stored XSS.This issue affects Tags to Keywords: from n/a through <= 1.0.1.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/tags-to-meta-keywords/vulnerability/wordpress-tags-to-keywords-plugin-1-0-1-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE: CVE-2025-22686
Published: 2025-02-03
Description: Missing Authorization vulnerability in WesternDeal CF7 Google Sheets Connector cf7-google-sheets-connector allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CF7 Google Sheets Connector: from n/a through <= 5.0.17.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/cf7-google-sheets-connector/vulnerability/wordpress-cf7-google-sheets-connector-plugin-5-0-17-broken-access-control-vulnerability?_s_id=cve