deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-5986
Published: 2025-06-11
Description: A crafted HTML email using mailbox:/// links can trigger automatic, unsolicited downloads of .pdf files to the user's desktop or home directory without prompting, even if auto-saving is disabled. This behavior can be abused to fill the disk with garbage data (e.g. using /dev/urandom on Linux) or to leak Windows credentials via SMB links when the email is viewed in HTML mode. While user interaction is required to download the .pdf file, visual obfuscation can conceal the download trigger. Viewing the email in HTML mode is enough to load external content. This vulnerability was fixed in Thunderbird 128.11.1 and Thunderbird 139.0.2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-451
References: https://bugzilla.mozilla.org/buglist.cgi?bug_id=1958580%2C1968012; https://www.mozilla.org/security/advisories/mfsa2025-49/; https://www.mozilla.org/security/advisories/mfsa2025-50/
CVE: CVE-2025-5144
Published: 2025-06-11
Description: The The Events Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘data-date-*’ parameters in all versions up to, and including, 6.13.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://bootstrap-datepicker.readthedocs.io/en/latest/index.html#data-api; https://github.com/uxsolutions/bootstrap-datepicker/blob/master/js/bootstrap-datepicker.js#L131; https://plugins.trac.wordpress.org/browser/the-events-calendar/tags/6.12.0.1/vendor/bootstrap-datepicker/js/bootstrap-datepicker.min.js
CVE: CVE-2025-32711
Published: 2025-06-11
Description: Ai command injection in M365 Copilot allows an unauthorized attacker to disclose information over a network.
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-74
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-32711; https://www.aim.security/lp/aim-labs-echoleak-m365
CVE: CVE-2025-35941
Published: 2025-06-11
Description: A password is exposed locally.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-522
References: https://www.tenable.com/security/research/tra-2025-18
CVE: CVE-2025-40914
Published: 2025-06-11
Description: Perl CryptX before version 0.087 contains a dependency that may be susceptible to an integer overflow.

CryptX embeds a version of the libtommath library that is susceptible to an integer overflow associated with CVE-2023-36328.
CVSS Score: 9.8 (CRITICAL)
References: https://github.com/advisories/GHSA-j3xv-6967-cv88; https://github.com/libtom/libtommath/pull/546; https://metacpan.org/release/MIK/CryptX-0.086/source/src/ltm/bn_mp_grow.c
CVE: CVE-2025-4605
Published: 2025-06-11
Description: A maliciously crafted .usdc file, when loaded through Autodesk Maya, can force an uncontrolled memory allocation vulnerability. A malicious actor may leverage this vulnerability to cause a denial-of-service (DoS), or cause data corruption.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-789, CWE-770
References: https://github.com/Autodesk/3dsmax-usd; https://github.com/Autodesk/maya-usd; https://www.autodesk.com/products/autodesk-access/overview
CVE: CVE-2025-4922
Published: 2025-06-11
Description: Nomad Community and Nomad Enterprise (“Nomad”) prefix-based ACL policy lookup can lead to incorrect rule application and shadowing. This vulnerability, identified as CVE-2025-4922, is fixed in Nomad Community Edition 1.10.2 and Nomad Enterprise 1.10.2, 1.9.10, and 1.8.14.
CVSS Score: 8.1 (HIGH)
CWE: CWE-266
References: https://discuss.hashicorp.com/t/hcsec-2025-12-nomad-vulnerable-to-incorrect-acl-policy-lookup-attached-to-a-job/75396
CVE: CVE-2025-0163
Published: 2025-06-11
Description: IBM Security Verify Access Appliance and Docker 10.0 through 10.0.8 could allow a remote attacker to enumerate usernames due to an observable response discrepancy of disabled accounts.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-204
References: https://www.ibm.com/support/pages/node/7236314
CVE: CVE-2025-3473
Published: 2025-06-11
Description: IBM Security Guardium 12.1 could allow a local privileged user to escalate their privileges to root due to insecure inherited permissions created by the program.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-277
References: https://www.ibm.com/support/pages/node/7236356
CVE: CVE-2025-48013
Published: 2025-06-11
Description: Missing Authorization vulnerability in Drupal Quick Node Block allows Forceful Browsing.This issue affects Quick Node Block: from 0.0.0 before 2.0.0.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://www.drupal.org/sa-contrib-2025-065
CVE: CVE-2025-48444
Published: 2025-06-11
Description: Missing Authorization vulnerability in Drupal Quick Node Block allows Forceful Browsing.This issue affects Quick Node Block: from 0.0.0 before 2.0.0.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://www.drupal.org/sa-contrib-2025-064
CVE: CVE-2025-48445
Published: 2025-06-11
Description: Incorrect Authorization vulnerability in Drupal Commerce Eurobank (Redirect) allows Functionality Misuse.This issue affects Commerce Eurobank (Redirect): from 0.0.0 before 2.1.1.
CVSS Score: 8.8 (HIGH)
CWE: CWE-863
References: https://www.drupal.org/sa-contrib-2025-066
CVE: CVE-2025-48446
Published: 2025-06-11
Description: Incorrect Authorization vulnerability in Drupal Commerce Alphabank Redirect allows Functionality Misuse.This issue affects Commerce Alphabank Redirect: from 0.0.0 before 1.0.3.
CVSS Score: 8.8 (HIGH)
CWE: CWE-863
References: https://www.drupal.org/sa-contrib-2025-067
CVE: CVE-2025-48447
Published: 2025-06-11
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Lightgallery allows Cross-Site Scripting (XSS).This issue affects Lightgallery: from 0.0.0 before 1.6.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://www.drupal.org/sa-contrib-2025-069
CVE: CVE-2025-48448
Published: 2025-06-11
Description: Allocation of Resources Without Limits or Throttling vulnerability in Drupal Admin Audit Trail allows Excessive Allocation.This issue affects Admin Audit Trail: from 0.0.0 before 1.0.5.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-770
References: https://www.drupal.org/sa-contrib-2025-068
CVE: CVE-2025-49146
Published: 2025-06-11
Description: pgjdbc is an open source postgresql JDBC Driver. From 42.7.4 and until 42.7.7, when the PostgreSQL JDBC driver is configured with channel binding set to required (default value is prefer), the driver would incorrectly allow connections to proceed with authentication methods that do not support channel binding (such as password, MD5, GSS, or SSPI authentication). This could allow a man-in-the-middle attacker to intercept connections that users believed were protected by channel binding requirements. This vulnerability is fixed in 42.7.7.
CVSS Score: 8.2 (HIGH)
CWE: CWE-287
References: https://github.com/pgjdbc/pgjdbc/commit/9217ed16cb2918ab1b6b9258ae97e6ede244d8a0; https://github.com/pgjdbc/pgjdbc/security/advisories/GHSA-hq9p-pm7w-8p54
CVE: CVE-2025-49148
Published: 2025-06-11
Description: ClipShare is a lightweight and cross-platform tool for clipboard sharing. Prior to 3.8.5, ClipShare Server for Windows uses the default Windows DLL search order and loads system libraries like CRYPTBASE.dll and WindowsCodecs.dll from its own directory before the system path. A local, non-privileged user who can write to the folder containing clip_share.exe can place malicious DLLs there, leading to arbitrary code execution in the context of the server, and, if launched by an Administrator (or another elevated user), it results in a reliable local privilege escalation. This vulnerability is fixed in 3.8.5.
CVSS Score: 7.3 (HIGH)
CWE: CWE-427
References: https://github.com/thevindu-w/clip_share_server/security/advisories/GHSA-rc47-h83g-2r8j
CVE: CVE-2025-26383
Published: 2025-06-11
Description: The iSTAR Configuration Utility (ICU) tool leaks memory, which could result in the unintended exposure of unauthorized data from the Windows PC that ICU is running on.
CWE: CWE-457
References: https://www.cisa.gov/news-events/ics-advisories/icsa-25-146-01; https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories
CVE: CVE-2025-1698
Published: 2025-06-11
Description: Null pointer exception vulnerabilities were reported in the fingerprint sensor service that could allow a local attacker to cause a denial of service.
CVSS Score: 2.8 (LOW)
CWE: CWE-476
References: https://en-us.support.motorola.com/app/answers/detail/a_id/186728
CVE: CVE-2025-1699
Published: 2025-06-11
Description: An incorrect default permissions vulnerability was reported in the MotoSignature application that could result in unauthorized access.
CVSS Score: 2.8 (LOW)
CWE: CWE-276
References: https://en-us.support.motorola.com/app/answers/detail/a_id/186729
CVE: CVE-2025-22874
Published: 2025-06-11
Description: Calling Verify with a VerifyOptions.KeyUsages that contains ExtKeyUsageAny unintentionally disabledpolicy validation. This only affected certificate chains which contain policy graphs, which are rather uncommon.
CVSS Score: 7.5 (HIGH)
References: https://go.dev/cl/670375; https://go.dev/issue/73612; https://groups.google.com/g/golang-announce/c/ufZ8WpEsA3A
CVE: CVE-2025-40915
Published: 2025-06-11
Description: Mojolicious::Plugin::CSRF 1.03 for Perl uses a weak random number source for generating CSRF tokens.

That version of the module generates tokens as an MD5 of the process id, the current time, and a single call to the built-in rand() function.
CVSS Score: 7.0 (HIGH)
CWE: CWE-338
References: https://metacpan.org/release/GRYPHON/Mojolicious-Plugin-CSRF-1.04/changes; https://metacpan.org/release/GRYPHON/Mojolicious-Plugin-CSRF-1.04/diff/GRYPHON/Mojolicious-Plugin-CSRF-1.03
CVE: CVE-2025-4673
Published: 2025-06-11
Description: Proxy-Authorization and Proxy-Authenticate headers persisted on cross-origin redirects potentially leaking sensitive information.
CVSS Score: 6.8 (MEDIUM)
References: https://go.dev/cl/679257; https://go.dev/issue/73816; https://groups.google.com/g/golang-announce/c/ufZ8WpEsA3A
CVE: CVE-2025-6001
Published: 2025-06-11
Description: A Cross-Site Request Forgery (CSRF) vulnerability exists in the product image upload function of VirtueMart that bypasses the CSRF protection token. An attacker is able to craft a special CSRF request which will allow unrestricted file upload into the VirtueMart media manager.
CVSS Score: 8.3 (HIGH)
CWE: CWE-352
References: https://blog.blacklanternsecurity.com/p/doomla-zero-days
CVE: CVE-2025-6002
Published: 2025-06-11
Description: An unrestricted file upload vulnerability exists in the Product Image section of the VirtueMart backend. Authenticated attackers can upload files with arbitrary extensions, including executable or malicious files, potentially leading to remote code execution or other security impacts depending on server configuration.
CVSS Score: 7.2 (HIGH)
CWE: CWE-434
References: https://blog.blacklanternsecurity.com/p/doomla-zero-days
CVE: CVE-2025-0913
Published: 2025-06-11
Description: os.OpenFile(path, os.O_CREATE|O_EXCL) behaved differently on Unix and Windows systems when the target path was a dangling symlink. On Unix systems, OpenFile with O_CREATE and O_EXCL flags never follows symlinks. On Windows, when the target path was a symlink to a nonexistent location, OpenFile would create a file in that location. OpenFile now always returns an error when the O_CREATE and O_EXCL flags are both set and the target path is a symlink.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-59
References: https://go.dev/cl/672396; https://go.dev/issue/73702; https://groups.google.com/g/golang-announce/c/ufZ8WpEsA3A
CVE: CVE-2025-0917
Published: 2025-06-11
Description: IBM Cognos Analytics 11.2.0, 11.2.1, 11.2.2, 11.2.3, 11.2.4, 12.0.0, 12.0.1, 12.0.2, 12.0.3, and 12.0.4 is vulnerable to stored cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-79
References: https://www.ibm.com/support/pages/node/7234674
CVE: CVE-2025-0923
Published: 2025-06-11
Description: IBM Cognos Analytics 11.2.0, 11.2.1, 11.2.2, 11.2.3, 11.2.4, 12.0.0, 12.0.1, 12.0.2, 12.0.3, and 12.0.4 stores source code on the web server that could aid in further attacks against the system.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-540
References: https://www.ibm.com/support/pages/node/7234674
CVE: CVE-2025-25032
Published: 2025-06-11
Description: IBM Cognos Analytics 11.2.0, 11.2.1, 11.2.2, 11.2.3, 11.2.4, 12.0.0, 12.0.1, 12.0.2, 12.0.3, and 12.0.4 could allow an authenticated user to cause a denial of service by sending a specially crafted request that would exhaust memory resources.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770
References: https://www.ibm.com/support/pages/node/7234674
CVE: CVE-2025-40912
Published: 2025-06-11
Description: CryptX for Perl before version 0.065 contains a dependency that may be susceptible to malformed unicode.

CryptX embeds the tomcrypt library. The versions of that library in CryptX before 0.065 may be susceptible to CVE-2019-17362.
CVSS Score: 9.8 (CRITICAL)
References: https://github.com/libtom/libtomcrypt/issues/507
CVE: CVE-2025-49150
Published: 2025-06-11
Description: Cursor is a code editor built for programming with AI. Prior to 0.51.0, by default, the setting json.schemaDownload.enable was set to True. This means that by writing a JSON file, an attacker can trigger an arbitrary HTTP GET request that does not require user confirmation. Since the Cursor Agent can edit JSON files, this means a malicious agent, for example, after a prompt injection attack already succeeded, could trigger a GET request to an attacker controlled URL, potentially exfiltrating other data the agent may have access to. This vulnerability is fixed in 0.51.0.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-200
References: https://github.com/getcursor/cursor/security/advisories/GHSA-9h3v-h59j-v6rj
CVE: CVE-2025-30085
Published: 2025-06-11
Description: Remote code execution vulnerability in RSForm!pro component 3.0.0 - 3.3.14 for Joomla was discovered. The issue occurs within the submission export feature and requires administrative access to the export feature.
CWE: CWE-94
References: https://rsjoomla.com/
CVE: CVE-2025-32465
Published: 2025-06-11
Description: A stored XSS vulnerability in RSTickets! component 1.9.12 - 3.3.0 for Joomla was discovered. It allows attackers to perform cross-site scripting (XSS) attacks via sending crafted payload.
CWE: CWE-79
References: https://rsjoomla.com/
CVE: CVE-2025-32466
Published: 2025-06-11
Description: A SQL injection vulnerability in RSMediaGallery! component 1.7.4 - 2.1.7 for Joomla was discovered. The issue occurs within the dashboard  component, where user-supplied input is not properly sanitized before being stored and rendered. An attacker can inject malicious JavaScript code into text fields or other input points, which is subsequently executed in the browser of any user who clicks on the crafted text in the dashboard.
CWE: CWE-89
References: https://rsjoomla.com/
CVE: CVE-2022-4976
Published: 2025-06-12
Description: Archive::Unzip::Burst from 0.01 through 0.09 for Perl contains a bundled InfoZip library that is affected by several vulnerabilities.

The bundled library is affected by CVE-2014-8139, CVE-2014-8140 and CVE-2014-8141.
CVSS Score: 9.8 (CRITICAL)
References: https://rt.cpan.org/Public/Bug/Display.html?id=143547
CVE: CVE-2025-6005
Published: 2025-06-12
Description: A vulnerability classified as critical was found in kiCode111 like-girl 5.2.0. This vulnerability affects unknown code of the file /admin/aboutPost.php. The manipulation of the argument title/aboutimg/info1/info2/info3/btn1/btn2/infox1/infox2/infox3/infox4/infox5/infox6/btnx2/infof1/infof2/infof3/infof4/btnf3/infod1/infod2/infod3/infod4/infod5 leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/adminnerr/cve/issues/6; https://vuldb.com/?ctiid.312328; https://vuldb.com/?id.312328
CVE: CVE-2025-6006
Published: 2025-06-12
Description: A vulnerability, which was classified as critical, has been found in kiCode111 like-girl 5.2.0. This issue affects some unknown processing of the file /admin/ImgUpdaPost.php. The manipulation of the argument id/imgText/imgDatd/imgUrl leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/adminnerr/cve/issues/10; https://github.com/adminnerr/cve/issues/7; https://vuldb.com/?ctiid.312329
CVE: CVE-2025-6007
Published: 2025-06-12
Description: A vulnerability, which was classified as critical, was found in kiCode111 like-girl 5.2.0. Affected is an unknown function of the file /admin/CopyadminPost.php. The manipulation of the argument icp/Copyright leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/adminnerr/cve/issues/8; https://vuldb.com/?ctiid.312330; https://vuldb.com/?id.312330
CVE: CVE-2025-6008
Published: 2025-06-12
Description: A vulnerability has been found in kiCode111 like-girl 5.2.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin/ImgAddPost.php. The manipulation of the argument imgDatd/imgText/imgUrl leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/adminnerr/cve/issues/9; https://vuldb.com/?ctiid.312331; https://vuldb.com/?id.312331
CVE: CVE-2025-6009
Published: 2025-06-12
Description: A vulnerability was found in kiCode111 like-girl 5.2.0 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/ipAddPost.php. The manipulation of the argument bz/ipdz leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/adminnerr/cve/issues/11; https://vuldb.com/?ctiid.312332; https://vuldb.com/?id.312332
CVE: CVE-2025-35978
Published: 2025-06-12
Description: Improper restriction of communication channel to intended endpoints issue exists in UpdateNavi V1.4 L10 to L33 and UpdateNaviInstallService Service 1.2.0091 to 1.2.0125. If a local authenticated attacker send malicious data, an arbitrary registry value may be modified or arbitrary code may be executed.
CVSS Score: 7.1 (HIGH)
CWE: CWE-923
References: https://azby.fmworld.net/support/security/information/updatenavi202506/; https://jvn.jp/en/jp/JVN17860456/
CVE: CVE-2025-4973
Published: 2025-06-12
Description: The Workreap plugin for WordPress, used by the Workreap - Freelance Marketplace WordPress Theme, is vulnerable to authentication bypass in all versions up to, and including, 3.3.1. This is due to the plugin not properly verifying a user's identity prior to logging them in when verifying an account with an email address. This makes it possible for unauthenticated attackers to log in as registered users, including administrators, if they know user's email address. This is only exploitable fi the user's confirmation_key has not already been set by the plugin.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-288
References: https://themeforest.net/item/workreap-freelance-marketplace-wordpress-theme/23712454#item-description__release-3-3-2-23-may-2025; https://www.wordfence.com/threat-intel/vulnerabilities/id/8e7693a3-642a-4eff-902c-d29a3c12deb0?source=cve
CVE: CVE-2025-5012
Published: 2025-06-12
Description: The Workreap plugin for WordPress, used by the Workreap - Freelance Marketplace WordPress Theme, is vulnerable to arbitrary file uploads due to missing file type validation in the 'workreap_temp_upload_to_media' function in all versions up to, and including, 3.3.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://themeforest.net/item/workreap-freelance-marketplace-wordpress-theme/23712454#item-description__release-3-3-3-06-june-2025; https://www.wordfence.com/threat-intel/vulnerabilities/id/185371b1-5c72-424d-a5b8-42c67aa9380c?source=cve
CVE: CVE-2025-40592
Published: 2025-06-12
Description: A vulnerability has been identified in Mendix Studio Pro 10 (All versions < V10.23.0), Mendix Studio Pro 10.12 (All versions < V10.12.17), Mendix Studio Pro 10.18 (All versions < V10.18.7), Mendix Studio Pro 10.6 (All versions < V10.6.24), Mendix Studio Pro 11 (All versions < V11.0.0), Mendix Studio Pro 8 (All versions < V8.18.35), Mendix Studio Pro 9 (All versions < V9.24.35). A zip path traversal vulnerability exists in the module installation process of Studio Pro. By crafting a malicious module and distributing it via (for example) the Mendix Marketplace, an attacker could write or modify arbitrary files in directories outside a developer’s project directory upon module installation.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-22
References: https://cert-portal.siemens.com/productcert/html/ssa-627195.html
CVE: CVE-2025-5301
Published: 2025-06-12
Description: ONLYOFFICE Docs (DocumentServer) in versions equal and below 8.3.1 are affected by a reflected cross-site scripting (XSS) issue when opening files via the WOPI protocol. Attackers could inject malicious scripts via crafted HTTP POST requests, which are then reflected in the server's HTML response.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/ONLYOFFICE/DocumentServer/blob/master/CHANGELOG.md#832; https://r.sec-consult.com/onlyoffice; http://seclists.org/fulldisclosure/2025/Jun/18
CVE: CVE-2025-4613
Published: 2025-06-12
Description: Path traversal in Google Web Designer's template handling versions prior to 16.3.0.0407 on Windows allows attacker to achieve remote code execution by tricking users into downloading a malicious ad template
CVSS Score: 8.8 (HIGH)
CWE: CWE-20, CWE-22
References: https://balintmagyar.com/articles/google-web-designer-path-traversal-client-side-rce-cve-2025-4613
CVE: CVE-2025-6003
Published: 2025-06-12
Description: The WordPress Single Sign-On (SSO) plugin for WordPress is vulnerable to unauthorized access due to a misconfigured capability check on a function in all versions up to, and including, the *.5.3 versions of the plugin. This makes it possible for unauthenticated attackers to extract sensitive data including site content that has been restricted to certain users and/or roles.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-863
References: https://plugins.miniorange.com/wordpress-sso; https://www.wordfence.com/threat-intel/vulnerabilities/id/51aa5531-e5b3-4c47-8d06-58eac6dd92fb?source=cve
CVE: CVE-2025-1478
Published: 2025-06-12
Description: An issue has been discovered in GitLab CE/EE affecting all versions from 8.13 before 17.10.7, 17.11 before 17.11.3, and 18.0 before 18.0.1. A lack of input validation in Board Names could be used to trigger a denial of service.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-770
References: https://gitlab.com/gitlab-org/gitlab/-/issues/520354; https://hackerone.com/reports/2987444