deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-47571
Published: 2025-09-09
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in highwarden Super Store Finder superstorefinder-wp allows PHP Local File Inclusion.This issue affects Super Store Finder: from n/a through < 7.8.
CVSS Score: 7.5 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Plugin/superstorefinder-wp/vulnerability/wordpress-super-store-finder-plugin-6-9-7-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-47579
Published: 2025-09-09
Description: Deserialization of Untrusted Data vulnerability in ThemeGoods Photography photography allows Object Injection.This issue affects Photography: from n/a through <= 7.7.2.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-502
References: https://patchstack.com/database/Wordpress/Theme/photography/vulnerability/wordpress-photography-theme-7-5-2-unauthenticated-php-object-injection-vulnerability?_s_id=cve
CVE: CVE-2025-47694
Published: 2025-09-09
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in solwin Blog Designer PRO blog-designer-pro.This issue affects Blog Designer PRO: from n/a through <= 3.4.7.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/blog-designer-pro/vulnerability/wordpress-blog-designer-pro-plugin-3-4-7-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-47695
Published: 2025-09-09
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in solwin Blog Designer PRO blog-designer-pro.This issue affects Blog Designer PRO: from n/a through <= 3.4.7.
CVSS Score: 7.5 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Plugin/blog-designer-pro/vulnerability/wordpress-blog-designer-pro-plugin-3-4-7-authenticated-non-arbitrary-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-47997
Published: 2025-09-09
Description: Concurrent execution using shared resource with improper synchronization ('race condition') in SQL Server allows an authorized attacker to disclose information over a network.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200, CWE-362
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-47997
CVE: CVE-2025-48101
Published: 2025-09-09
Description: Deserialization of Untrusted Data vulnerability in webdevstudios Constant Contact for WordPress allows Object Injection. This issue affects Constant Contact for WordPress: from n/a through 4.1.1.
CVSS Score: 8.8 (HIGH)
CWE: CWE-502
References: https://patchstack.com/database/wordpress/plugin/constant-contact-api/vulnerability/wordpress-constant-contact-for-wordpress-plugin-4-1-1-php-object-injection-vulnerability?_s_id=cve
CVE: CVE-2025-49430
Published: 2025-09-09
Description: Server-Side Request Forgery (SSRF) vulnerability in FWDesign Ultimate Video Player fwduvp allows Server Side Request Forgery.This issue affects Ultimate Video Player: from n/a through <= 10.1.
CVSS Score: 7.2 (HIGH)
CWE: CWE-918
References: https://patchstack.com/database/Wordpress/Plugin/fwduvp/vulnerability/wordpress-ultimate-video-player-plugin-10-1-server-side-request-forgery-ssrf-vulnerability?_s_id=cve
CVE: CVE-2025-49692
Published: 2025-09-09
Description: Improper access control in Azure Windows Virtual Machine Agent allows an authorized attacker to elevate privileges locally.
CVSS Score: 7.8 (HIGH)
CWE: CWE-284
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49692
CVE: CVE-2025-49734
Published: 2025-09-09
Description: Improper restriction of communication channel to intended endpoints in Windows PowerShell allows an authorized attacker to elevate privileges locally.
CVSS Score: 7.0 (HIGH)
CWE: CWE-923
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49734
CVE: CVE-2025-49860
Published: 2025-09-09
Description: Missing Authorization vulnerability in Majestic Support Majestic Support majestic-support.This issue affects Majestic Support: from n/a through <= 1.1.0.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/majestic-support/vulnerability/wordpress-majestic-support-plugin-1-1-0-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-53291
Published: 2025-09-09
Description: Missing Authorization vulnerability in spoddev2021 Spreadconnect wc-spod.This issue affects Spreadconnect: from n/a through <= 2.1.5.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/wc-spod/vulnerability/wordpress-spreadconnect-plugin-2-1-5-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-53303
Published: 2025-09-09
Description: Deserialization of Untrusted Data vulnerability in ThemeMove ThemeMove Core thememove-core allows Object Injection.This issue affects ThemeMove Core: from n/a through <= 1.4.2.
CVSS Score: 8.8 (HIGH)
CWE: CWE-502
References: https://patchstack.com/database/Wordpress/Plugin/thememove-core/vulnerability/wordpress-thememove-core-plugin-1-4-2-php-object-injection-vulnerability?_s_id=cve
CVE: CVE-2025-53340
Published: 2025-09-09
Description: Missing Authorization vulnerability in awesomesupport Awesome Support awesome-support allows Retrieve Embedded Sensitive Data.This issue affects Awesome Support: from n/a through <= 6.3.6.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/awesome-support/vulnerability/wordpress-awesome-support-plugin-plugin-6-3-4-sensitive-data-exposure-vulnerability?_s_id=cve
CVE: CVE-2025-53348
Published: 2025-09-09
Description: Missing Authorization vulnerability in Laborator Kalium kalium allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kalium: from n/a through <= 3.18.3.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Theme/kalium/vulnerability/wordpress-kalium-theme-3-18-3-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-53796
Published: 2025-09-09
Description: Buffer over-read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-126
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53796
CVE: CVE-2025-53797
Published: 2025-09-09
Description: Buffer over-read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-126
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53797
CVE: CVE-2025-53798
Published: 2025-09-09
Description: Buffer over-read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-126
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53798
CVE: CVE-2025-53799
Published: 2025-09-09
Description: Use of uninitialized resource in Windows Imaging Component allows an unauthorized attacker to disclose information locally.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-908
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53799
CVE: CVE-2025-53800
Published: 2025-09-09
Description: No cwe for this issue in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally.
CVSS Score: 7.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53800
CVE: CVE-2025-53801
Published: 2025-09-09
Description: Untrusted pointer dereference in Windows DWM allows an authorized attacker to elevate privileges locally.
CVSS Score: 7.8 (HIGH)
CWE: CWE-822
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53801
CVE: CVE-2025-53802
Published: 2025-09-09
Description: Use after free in Windows Bluetooth Service allows an authorized attacker to elevate privileges locally.
CVSS Score: 7.0 (HIGH)
CWE: CWE-416
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53802
CVE: CVE-2025-53803
Published: 2025-09-09
Description: Generation of error message containing sensitive information in Windows Kernel allows an authorized attacker to disclose information locally.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-209
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53803
CVE: CVE-2025-53804
Published: 2025-09-09
Description: Exposure of sensitive information to an unauthorized actor in Windows Kernel allows an authorized attacker to disclose information locally.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53804
CVE: CVE-2025-53805
Published: 2025-09-09
Description: Out-of-bounds read in Windows Internet Information Services allows an unauthorized attacker to deny service over a network.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53805
CVE: CVE-2025-53806
Published: 2025-09-09
Description: Buffer over-read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125, CWE-126
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53806
CVE: CVE-2025-53807
Published: 2025-09-09
Description: Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally.
CVSS Score: 7.0 (HIGH)
CWE: CWE-362, CWE-416
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53807
CVE: CVE-2025-53808
Published: 2025-09-09
Description: Access of resource using incompatible type ('type confusion') in Windows Defender Firewall Service allows an authorized attacker to elevate privileges locally.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-843
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53808
CVE: CVE-2025-53809
Published: 2025-09-09
Description: Improper input validation in Windows Local Security Authority Subsystem Service (LSASS) allows an authorized attacker to deny service over a network.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53809
CVE: CVE-2025-53810
Published: 2025-09-09
Description: Access of resource using incompatible type ('type confusion') in Windows Defender Firewall Service allows an authorized attacker to elevate privileges locally.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-843
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53810
CVE: CVE-2025-54091
Published: 2025-09-09
Description: Integer overflow or wraparound in Windows Hyper-V allows an authorized attacker to elevate privileges locally.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122, CWE-190
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-54091
CVE: CVE-2025-54092
Published: 2025-09-09
Description: Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Hyper-V allows an authorized attacker to elevate privileges locally.
CVSS Score: 7.8 (HIGH)
CWE: CWE-362, CWE-416
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-54092
CVE: CVE-2025-54093
Published: 2025-09-09
Description: Time-of-check time-of-use (toctou) race condition in Windows TCP/IP allows an authorized attacker to elevate privileges locally.
CVSS Score: 7.0 (HIGH)
CWE: CWE-367
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-54093
CVE: CVE-2025-54094
Published: 2025-09-09
Description: Access of resource using incompatible type ('type confusion') in Windows Defender Firewall Service allows an authorized attacker to elevate privileges locally.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-843
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-54094
CVE: CVE-2025-54095
Published: 2025-09-09
Description: Out-of-bounds read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-54095
CVE: CVE-2025-54096
Published: 2025-09-09
Description: Out-of-bounds read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-54096
CVE: CVE-2025-54097
Published: 2025-09-09
Description: Out-of-bounds read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-54097
CVE: CVE-2025-54098
Published: 2025-09-09
Description: Improper access control in Windows Hyper-V allows an authorized attacker to elevate privileges locally.
CVSS Score: 7.8 (HIGH)
CWE: CWE-284
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-54098
CVE: CVE-2025-54099
Published: 2025-09-09
Description: Stack-based buffer overflow in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.
CVSS Score: 7.0 (HIGH)
CWE: CWE-121
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-54099
CVE: CVE-2025-54101
Published: 2025-09-09
Description: Use after free in Windows SMBv3 Client allows an authorized attacker to execute code over a network.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-416
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-54101; https://www.vicarius.io/vsociety/posts/cve-2025-54101-detection-script-remote-code-execution-vulnerability-affecting-windows-smbv3; https://www.vicarius.io/vsociety/posts/cve-2025-54101-mitigation-script-remote-code-execution-vulnerability-affecting-windows-smbv3
CVE: CVE-2025-54102
Published: 2025-09-09
Description: Use after free in Windows Connected Devices Platform Service allows an authorized attacker to elevate privileges locally.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-54102
CVE: CVE-2025-54103
Published: 2025-09-09
Description: Use after free in Windows Management Services allows an unauthorized attacker to elevate privileges locally.
CVSS Score: 7.4 (HIGH)
CWE: CWE-416
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-54103
CVE: CVE-2025-54104
Published: 2025-09-09
Description: Access of resource using incompatible type ('type confusion') in Windows Defender Firewall Service allows an authorized attacker to elevate privileges locally.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-843
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-54104
CVE: CVE-2025-54105
Published: 2025-09-09
Description: Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Brokering File System allows an authorized attacker to elevate privileges locally.
CVSS Score: 7.0 (HIGH)
CWE: CWE-362, CWE-416
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-54105
CVE: CVE-2025-54106
Published: 2025-09-09
Description: Integer overflow or wraparound in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to execute code over a network.
CVSS Score: 8.8 (HIGH)
CWE: CWE-190
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-54106
CVE: CVE-2025-54107
Published: 2025-09-09
Description: Improper resolution of path equivalence in Windows MapUrlToZone allows an unauthorized attacker to bypass a security feature over a network.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-41
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-54107
CVE: CVE-2025-54108
Published: 2025-09-09
Description: Concurrent execution using shared resource with improper synchronization ('race condition') in Capability Access Management Service (camsvc) allows an authorized attacker to elevate privileges locally.
CVSS Score: 7.0 (HIGH)
CWE: CWE-362, CWE-416
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-54108
CVE: CVE-2025-54109
Published: 2025-09-09
Description: Access of resource using incompatible type ('type confusion') in Windows Defender Firewall Service allows an authorized attacker to elevate privileges locally.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-843
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-54109
CVE: CVE-2025-54110
Published: 2025-09-09
Description: Integer overflow or wraparound in Windows Kernel allows an authorized attacker to elevate privileges locally.
CVSS Score: 8.8 (HIGH)
CWE: CWE-190
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-54110
CVE: CVE-2025-54111
Published: 2025-09-09
Description: Use after free in Windows UI XAML Phone DatePickerFlyout allows an authorized attacker to elevate privileges locally.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-54111
CVE: CVE-2025-54112
Published: 2025-09-09
Description: Use after free in Microsoft Virtual Hard Drive allows an authorized attacker to elevate privileges locally.
CVSS Score: 7.0 (HIGH)
CWE: CWE-416
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-54112
CVE: CVE-2025-54113
Published: 2025-09-09
Description: Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to execute code over a network.
CVSS Score: 8.8 (HIGH)
CWE: CWE-122
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-54113
CVE: CVE-2025-54114
Published: 2025-09-09
Description: Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Connected Devices Platform Service allows an authorized attacker to elevate privileges locally.
CVSS Score: 7.0 (HIGH)
CWE: CWE-362, CWE-822
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-54114
CVE: CVE-2025-54115
Published: 2025-09-09
Description: Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Hyper-V allows an authorized attacker to elevate privileges locally.
CVSS Score: 7.0 (HIGH)
CWE: CWE-362
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-54115; https://www.vicarius.io/vsociety/posts/cve-2025-54115-detection-script-privilege-elevation-vulnerability-in-windows-hyper-v; https://www.vicarius.io/vsociety/posts/cve-2025-54115-mitigation-script-privilege-elevation-vulnerability-in-windows-hyper-v
CVE: CVE-2025-54116
Published: 2025-09-09
Description: Improper access control in Windows MultiPoint Services allows an authorized attacker to elevate privileges locally.
CVSS Score: 7.3 (HIGH)
CWE: CWE-284
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-54116
CVE: CVE-2025-54246
Published: 2025-09-09
Description: Adobe Experience Manager versions 6.5.23.0 and earlier are affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-863
References: https://helpx.adobe.com/security/products/experience-manager/apsb25-90.html
CVE: CVE-2025-54247
Published: 2025-09-09
Description: Adobe Experience Manager versions 6.5.23.0 and earlier are affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized read access.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: https://helpx.adobe.com/security/products/experience-manager/apsb25-90.html
CVE: CVE-2025-54248
Published: 2025-09-09
Description: Adobe Experience Manager versions 6.5.23.0 and earlier are affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized read access. Scope is changed
CVSS Score: 7.7 (HIGH)
CWE: CWE-20
References: https://helpx.adobe.com/security/products/experience-manager/apsb25-90.html
CVE: CVE-2025-54249
Published: 2025-09-09
Description: Adobe Experience Manager versions 6.5.23.0 and earlier are affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to manipulate server-side requests and bypass security controls allowing unauthorized read access.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-918
References: https://helpx.adobe.com/security/products/experience-manager/apsb25-90.html
CVE: CVE-2025-54250
Published: 2025-09-09
Description: Adobe Experience Manager versions 6.5.23.0 and earlier are affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. A high-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-20
References: https://helpx.adobe.com/security/products/experience-manager/apsb25-90.html
CVE: CVE-2025-54251
Published: 2025-09-09
Description: Adobe Experience Manager versions 6.5.23.0 and earlier are affected by an XML Injection vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to manipulate XML queries and gain limited unauthorized write access.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-91
References: https://helpx.adobe.com/security/products/experience-manager/apsb25-90.html
CVE: CVE-2025-54252
Published: 2025-09-09
Description: Adobe Experience Manager versions 6.5.23.0 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. This could result in bypassing security features within the application. Exploitation of this issue requires user interaction in that a victim must browse to the page containing the vulnerable field.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://helpx.adobe.com/security/products/experience-manager/apsb25-90.html
CVE: CVE-2025-54261
Published: 2025-09-09
Description: ColdFusion versions 2025.3, 2023.15, 2021.21 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary code execution by an attacker. The victim must have optional configurations enabled. Scope is changed.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-22
References: https://helpx.adobe.com/security/products/coldfusion/apsb25-93.html
CVE: CVE-2025-54709
Published: 2025-09-09
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in uxper Sala. This issue affects Sala: from n/a through 1.1.6.
CVSS Score: 8.1 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/wordpress/theme/sala/vulnerability/wordpress-sala-theme-1-1-6-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-54894
Published: 2025-09-09
Description: Local Security Authority Subsystem Service Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-122
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-54894
CVE: CVE-2025-54895
Published: 2025-09-09
Description: Integer overflow or wraparound in Windows SPNEGO Extended Negotiation allows an authorized attacker to elevate privileges locally.
CVSS Score: 7.8 (HIGH)
CWE: CWE-190, CWE-367
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-54895
CVE: CVE-2025-54896
Published: 2025-09-09
Description: Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-54896