deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-12426
Published: 2025-01-07
Description: Exposure of Environmental Variables and arbitrary INI file values to an Unauthorized Actor vulnerability in The Document Foundation LibreOffice.




URLs could be constructed which expanded environmental variables or INI file values, so potentially sensitive information could be exfiltrated to a remote server on opening a document containing such links.


This issue affects LibreOffice: from 24.8 before < 24.8.4.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: https://www.libreoffice.org/about-us/security/advisories/cve-2024-12426; https://lists.debian.org/debian-lts-announce/2025/01/msg00013.html
CVE: CVE-2024-12738
Published: 2025-01-07
Description: The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several user meta parameters in all versions up to, and including, 3.12.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page and clicks a link to show user meta.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/profile-builder/tags/3.12.8/features/email-confirmation/class-email-confirmation.php; https://plugins.trac.wordpress.org/browser/profile-builder/tags/3.12.8/features/email-confirmation/class-email-confirmation.php#L95; https://plugins.trac.wordpress.org/changeset/3217544/
CVE: CVE-2024-45100
Published: 2025-01-07
Description: IBM Security ReaQta 3.12 could allow a privileged user to cause a denial of service by sending multiple administration requests due to improper allocation of resources.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-770
References: https://www.ibm.com/support/pages/node/7180313
CVE: CVE-2024-45640
Published: 2025-01-07
Description: IBM Security ReaQta 3.12 returns sensitive information in an HTTP response that could be used in further attacks against the system.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-497
References: https://www.ibm.com/support/pages/node/7180313
CVE: CVE-2025-0294
Published: 2025-01-07
Description: A vulnerability has been found in SourceCodester Home Clean Services Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /public_html/admin/process.php. The manipulation of the argument type/length/business leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://github.com/xiaosguang/cve/blob/main/Home%20Clean%20Services%20Management/Home%20Clean%20Services%20Management%20System%20process.php%20id%20SQL%20injection.md; https://vuldb.com/?ctiid.290443; https://vuldb.com/?id.290443
CVE: CVE-2024-11681
Published: 2025-01-07
Description: A malicious or compromised MacPorts mirror can execute arbitrary commands as root on the machine of a client running port selfupdate against the mirror.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-78, CWE-78
References: https://github.com/google/security-research/security/advisories/GHSA-2j38-pjh8-wfxw
CVE: CVE-2025-0295
Published: 2025-01-07
Description: A vulnerability was found in code-projects Online Book Shop 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /booklist.php?subcatid=1. The manipulation of the argument subcatnm leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94, CWE-79
References: https://code-projects.org/; https://gist.github.com/th4s1s/19d21e7fdbaf3512fccfd75df3080657; https://vuldb.com/?ctiid.290444
CVE: CVE-2025-0296
Published: 2025-01-07
Description: A vulnerability was found in code-projects Online Book Shop 1.0. It has been classified as critical. This affects an unknown part of the file /booklist.php. The manipulation of the argument subcatid leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://code-projects.org/; https://gist.github.com/th4s1s/4ebf1c60bbec213119f2eaac9cd29118; https://vuldb.com/?ctiid.290445
CVE: CVE-2021-20455
Published: 2025-01-07
Description: IBM Cognos Controller 11.0.0 through 11.0.1 and IBM Controller 11.1.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system.
CVSS Score: 3.7 (LOW)
CWE: CWE-209
References: https://www.ibm.com/support/pages/node/7179163
CVE: CVE-2022-22363
Published: 2025-01-07
Description: IBM Cognos Controller 11.0.0 through 11.0.1 and IBM Controller 11.1.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-209
References: https://www.ibm.com/support/pages/node/7179163
CVE: CVE-2024-25037
Published: 2025-01-07
Description: IBM Cognos Controller 11.0.0 through 11.0.1 and IBM Controller 11.1.0 could allow a remote attacker to obtain sensitive information when a stack trace is returned in the browser.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-209
References: https://www.ibm.com/support/pages/node/7179163
CVE: CVE-2024-28778
Published: 2025-01-07
Description: IBM Cognos Controller 11.0.0 through 11.0.1 and IBM Controller 11.1.0 is vulnerable to exposure of Artifactory API keys. This vulnerability allows users to publish code to private packages or repositories under the name of the organization.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-798
References: https://www.ibm.com/support/pages/node/7179163
CVE: CVE-2024-40702
Published: 2025-01-07
Description: IBM Cognos Controller 11.0.0 through 11.0.1 and IBM Controller 11.1.0 could allow an unauthorized user to obtain valid tokens to gain access to protected resources due to improper certificate validation.
CVSS Score: 8.2 (HIGH)
CWE: CWE-295
References: https://www.ibm.com/support/pages/node/7179163
CVE: CVE-2024-46242
Published: 2025-01-07
Description: An issue in the validate_email function in CTFd/utils/validators/__init__.py of CTFd 3.7.3 allows attackers to cause a Regular expression Denial of Service (ReDoS) via supplying a crafted string as e-mail address during registration.
CVSS Score: 7.5 (HIGH)
CWE: CWE-1333
References: http://ctfd.com; https://gist.github.com/salvatore-abello/4f01f3fa54672febc0a492a11a26592c
CVE: CVE-2024-46601
Published: 2025-01-07
Description: Elspec Engineering G5 Digital Fault Recorder Firmware v1.2.1.12 was discovered to contain a buffer overflow.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120
References: https://www.elspec-ltd.com/support/security-advisories/
CVE: CVE-2024-46602
Published: 2025-01-07
Description: An issue was discovered in Elspec G5 digital fault recorder version 1.2.1.12 and earlier. An XML External Entity (XXE) vulnerability may allow an attacker to cause a Denial of Service (DoS) via a crafted XML payload.
CVSS Score: 7.5 (HIGH)
CWE: CWE-611
References: https://www.elspec-ltd.com/support/security-advisories.
CVE: CVE-2024-46603
Published: 2025-01-07
Description: An XML External Entity (XXE) vulnerability in Elspec Engineering G5 Digital Fault Recorder Firmware v1.2.1.12 allows attackers to cause a Denial of Service (DoS) via a crafted XML payload.
CVSS Score: 7.5 (HIGH)
CWE: CWE-611
References: https://www.elspec-ltd.com/support/security-advisories/
CVE: CVE-2024-48245
Published: 2025-01-07
Description: Vehicle Management System 1.0 is vulnerable to SQL Injection. A guest user can exploit vulnerable POST parameters in various administrative actions, such as booking a vehicle or confirming a booking. The affected parameters include "Booking ID", "Action Name", and "Payment Confirmation ID", which are present in /newvehicle.php and /newdriver.php.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: http://vehicle.com; https://github.com/ShadowByte1/CVE-2024-48245
CVE: CVE-2024-52813
Published: 2025-01-07
Description: matrix-rust-sdk is an implementation of a Matrix client-server library in Rust. Versions of the matrix-sdk-crypto Rust crate before 0.8.0 lack a dedicated mechanism to notify that a user's cryptographic identity has changed from a verified to an unverified one, which could cause client applications relying on the SDK to overlook such changes. matrix-sdk-crypto 0.8.0 adds a new VerificationLevel::VerificationViolation enum variant which indicates that a previously verified identity has been changed.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-223
References: https://github.com/matrix-org/matrix-rust-sdk/pull/3795; https://github.com/matrix-org/matrix-rust-sdk/security/advisories/GHSA-r5vf-wf4h-82gg
CVE: CVE-2024-53345
Published: 2025-01-07
Description: An authenticated arbitrary file upload vulnerability in Car Rental Management System v1.0 to v1.3 allows attackers to execute arbitrary code via uploading a crafted file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: http://car.com; https://github.com/ShadowByte1/CVE-2024-53345
CVE: CVE-2024-53800
Published: 2025-01-07
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in rezgo Rezgo rezgo allows PHP Local File Inclusion.This issue affects Rezgo: from n/a through <= 4.17.
CVSS Score: 8.1 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Plugin/rezgo/vulnerability/wordpress-rezgo-online-booking-plugin-4-15-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2024-55008
Published: 2025-01-07
Description: JATOS 3.9.4 contains a denial-of-service (DoS) vulnerability in the authentication system, where an attacker can prevent legitimate users from accessing their accounts by repeatedly sending multiple failed login attempts. Specifically, by submitting 3 incorrect login attempts every minute, the attacker can trigger the account lockout mechanism on the account level, effectively locking the user out indefinitely. Since the lockout is applied to the user account and not based on the IP address, any attacker can trigger the lockout on any user account, regardless of their privileges.
CVSS Score: 7.5 (HIGH)
CWE: CWE-307
References: http://jatos.com; https://hacking-notes.medium.com/cve-2024-51379-jatos-v3-9-4-account-lockout-denial-of-service-cc970f4ca58f; https://hacking-notes.medium.com/cve-2024-51379-jatos-v3-9-4-account-lockout-denial-of-service-cc970f4ca58f
CVE: CVE-2024-55556
Published: 2025-01-07
Description: A vulnerability in Crater Invoice allows an unauthenticated attacker with knowledge of the APP_KEY to achieve remote command execution on the server by manipulating the laravel_session cookie, exploiting arbitrary deserialization through the encrypted session data. The exploitation vector of this vulnerability relies on an attacker obtaining Laravel's secret APP_KEY, which would allow them to decrypt and manipulate session cookies (laravel_session) containing serialized data. By altering this data and re-encrypting it with the APP_KEY, the attacker could trigger arbitrary deserialization on the server, potentially leading to remote command execution (RCE). The vulnerability is primarily exploited by accessing an exposed cookie and manipulating it using the secret key to gain malicious access to the server.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://github.com/crater-invoice/crater; https://www.synacktiv.com/; https://www.synacktiv.com/advisories/crater-invoice-unauthenticated-remote-command-execution-when-appkey-known
CVE: CVE-2024-56056
Published: 2025-01-07
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in kmfoysal06 SimpleCharm simplecharm allows Reflected XSS.This issue affects SimpleCharm: from n/a through <= 1.4.3.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Theme/simplecharm/vulnerability/wordpress-simplecharm-theme-1-4-3-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-0237
Published: 2025-01-07
Description: The WebChannel API, which is used to transport various information across processes, did not check the sending principal but rather accepted the principal being sent. This could have led to privilege escalation attacks. This vulnerability was fixed in Firefox 134, Firefox ESR 128.6, Thunderbird 134, and Thunderbird 128.6.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-863
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1915257; https://www.mozilla.org/security/advisories/mfsa2025-01/; https://www.mozilla.org/security/advisories/mfsa2025-02/
CVE: CVE-2025-0238
Published: 2025-01-07
Description: Assuming a controlled failed memory allocation, an attacker could have caused a use-after-free, leading to a potentially exploitable crash. This vulnerability was fixed in Firefox 134, Firefox ESR 128.6, Firefox ESR 115.19, Thunderbird 134, and Thunderbird 128.6.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-416
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1915535; https://www.mozilla.org/security/advisories/mfsa2025-01/; https://www.mozilla.org/security/advisories/mfsa2025-02/
CVE: CVE-2025-0239
Published: 2025-01-07
Description: When using Alt-Svc, ALPN did not properly validate certificates when the original server is redirecting to an insecure site. This vulnerability was fixed in Firefox 134, Firefox ESR 128.6, Thunderbird 134, and Thunderbird 128.6.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-295
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1929156; https://www.mozilla.org/security/advisories/mfsa2025-01/; https://www.mozilla.org/security/advisories/mfsa2025-02/
CVE: CVE-2025-0240
Published: 2025-01-07
Description: Parsing a JavaScript module as JSON could, under some circumstances, cause cross-compartment access, which may result in a use-after-free. This vulnerability was fixed in Firefox 134, Firefox ESR 128.6, Thunderbird 134, and Thunderbird 128.6.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-416
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1929623; https://www.mozilla.org/security/advisories/mfsa2025-01/; https://www.mozilla.org/security/advisories/mfsa2025-02/
CVE: CVE-2025-0241
Published: 2025-01-07
Description: When segmenting specially crafted text, segmentation would corrupt memory leading to a potentially exploitable crash. This vulnerability was fixed in Firefox 134, Firefox ESR 128.6, Thunderbird 134, and Thunderbird 128.6.
CVSS Score: 7.7 (HIGH)
CWE: CWE-401
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1933023; https://www.mozilla.org/security/advisories/mfsa2025-01/; https://www.mozilla.org/security/advisories/mfsa2025-02/
CVE: CVE-2025-0242
Published: 2025-01-07
Description: Memory safety bugs present in Firefox 133, Thunderbird 133, Firefox ESR 115.18, Firefox ESR 128.5, Thunderbird 115.18, and Thunderbird 128.5. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 134, Firefox ESR 128.6, Firefox ESR 115.19, Thunderbird 134, and Thunderbird 128.6.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787
References: https://bugzilla.mozilla.org/buglist.cgi?bug_id=1874523%2C1926454%2C1931873%2C1932169; https://www.mozilla.org/security/advisories/mfsa2025-01/; https://www.mozilla.org/security/advisories/mfsa2025-02/
CVE: CVE-2025-0243
Published: 2025-01-07
Description: Memory safety bugs present in Firefox 133, Thunderbird 133, Firefox ESR 128.5, and Thunderbird 128.5. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 134, Firefox ESR 128.6, Thunderbird 134, and Thunderbird 128.6.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-787
References: https://bugzilla.mozilla.org/buglist.cgi?bug_id=1827142%2C1932783; https://www.mozilla.org/security/advisories/mfsa2025-01/; https://www.mozilla.org/security/advisories/mfsa2025-02/
CVE: CVE-2025-0244
Published: 2025-01-07
Description: When redirecting to an invalid protocol scheme, an attacker could spoof the address bar. 
*Note: This issue only affected Android operating systems. Other operating systems are unaffected.*. This vulnerability was fixed in Firefox 134.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-601
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1929584; https://www.mozilla.org/security/advisories/mfsa2025-01/
CVE: CVE-2025-0245
Published: 2025-01-07
Description: Under certain circumstances, a user opt-in setting that Focus should require authentication before use could have been be bypassed. This vulnerability was fixed in Firefox 134.
CVSS Score: 3.3 (LOW)
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1895342; https://www.mozilla.org/security/advisories/mfsa2025-01/
CVE: CVE-2025-0246
Published: 2025-01-07
Description: When using an invalid protocol scheme, an attacker could spoof the address bar. 
*Note: This issue only affected Android operating systems. Other operating systems are unaffected.*
*Note: This issue is a different issue from CVE-2025-0244. This vulnerability was fixed in Firefox 134.
CVSS Score: 6.5 (MEDIUM)
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1912709; https://www.mozilla.org/security/advisories/mfsa2025-01/
CVE: CVE-2025-0247
Published: 2025-01-07
Description: Memory safety bugs present in Firefox 133 and Thunderbird 133. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 134 and Thunderbird 134.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://bugzilla.mozilla.org/buglist.cgi?bug_id=1835193%2C1910021%2C1919803%2C1931576%2C1931948%2C1932173; https://www.mozilla.org/security/advisories/mfsa2025-01/; https://www.mozilla.org/security/advisories/mfsa2025-04/
CVE: CVE-2025-0297
Published: 2025-01-07
Description: A vulnerability was found in code-projects Online Book Shop 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /detail.php. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://gist.github.com/th4s1s/782f2e19784f48bb80e4d658a49bd680; https://vuldb.com/?ctiid.290446
CVE: CVE-2025-0298
Published: 2025-01-07
Description: A vulnerability was found in code-projects Online Book Shop 1.0. It has been rated as critical. This issue affects some unknown processing of the file /process_login.php. The manipulation of the argument usernm leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://code-projects.org/; https://gist.github.com/th4s1s/5435e605e6e9f14a5b76c313483eb58a; https://vuldb.com/?ctiid.290447
CVE: CVE-2025-21622
Published: 2025-01-07
Description: ClipBucket V5 provides open source video hosting with PHP. During the user avatar upload workflow, a user can choose to upload and change their avatar at any time. During deletion, ClipBucket checks for the avatar_url as a filepath within the avatars subdirectory. If the URL path exists within the avatars directory, ClipBucket will delete it. There is no check for path traversal sequences in the provided user input (stored in the DB as avatar_url) therefore the final $file variable could be tainted with path traversal sequences. This leads to file deletion outside of the intended scope of the avatars folder. This vulnerability is fixed in 5.5.1 - 237.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://github.com/MacWarrior/clipbucket-v5/commit/22329c4675e82c7c95e74024ba247f837ac9e00b; https://github.com/MacWarrior/clipbucket-v5/security/advisories/GHSA-5qpx-23rw-36gg; https://github.com/MacWarrior/clipbucket-v5/security/advisories/GHSA-5qpx-23rw-36gg
CVE: CVE-2025-21623
Published: 2025-01-07
Description: ClipBucket V5 provides open source video hosting with PHP. Prior to 5.5.1 - 238, ClipBucket V5 allows unauthenticated attackers to change the template directory via a directory traversal, which results in a denial of service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-306
References: https://github.com/MacWarrior/clipbucket-v5/commit/75d663f010cd8569eb9e278f030838174fb30188; https://github.com/MacWarrior/clipbucket-v5/security/advisories/GHSA-ffhj-hprx-7qvr; https://github.com/MacWarrior/clipbucket-v5/security/advisories/GHSA-ffhj-hprx-7qvr
CVE: CVE-2025-21624
Published: 2025-01-07
Description: ClipBucket V5 provides open source video hosting with PHP. Prior to 5.5.1 - 239, a file upload vulnerability exists in the Manage Playlist functionality of the application, specifically surrounding the uploading of playlist cover images. Without proper checks, an attacker can upload a PHP script file instead of an image file, thus allowing a webshell or other malicious files to be stored and executed on the server. This attack vector exists in both the admin area and low-level user area. This vulnerability is fixed in 5.5.1 - 239.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://github.com/MacWarrior/clipbucket-v5/commit/893bfb0f1236c4a59b5e2843ab8d27a1e491b12b; https://github.com/MacWarrior/clipbucket-v5/security/advisories/GHSA-98vm-2xqm-xrcc; https://github.com/MacWarrior/clipbucket-v5/security/advisories/GHSA-98vm-2xqm-xrcc
CVE: CVE-2025-22294
Published: 2025-01-07
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in theme funda Custom Field For WP Job Manager custom-field-for-wp-job-manager allows Reflected XSS.This issue affects Custom Field For WP Job Manager: from n/a through <= 1.3.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/custom-field-for-wp-job-manager/vulnerability/wordpress-custom-field-for-wp-job-manager-plugin-1-3-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-22335
Published: 2025-01-07
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in rajib.dewan Opencart Product in WP opencart-product-in-wp allows Reflected XSS.This issue affects Opencart Product in WP: from n/a through <= 1.0.1.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/opencart-product-in-wp/vulnerability/wordpress-opencart-product-in-wp-plugin-1-0-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-22338
Published: 2025-01-07
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in lich_wang WP-tagMaker tagmaker allows Reflected XSS.This issue affects WP-tagMaker: from n/a through <= 0.2.2.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/tagmaker/vulnerability/wordpress-wp-tagmaker-plugin-0-2-2-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-22502
Published: 2025-01-07
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Mindvalley MindValley Super PageMash mindvalley-pagemash allows SQL Injection.This issue affects MindValley Super PageMash: from n/a through <= 1.1.
CVSS Score: 7.6 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/mindvalley-pagemash/vulnerability/wordpress-mindvalley-super-pagemash-plugin-1-1-sql-injection-vulnerability?_s_id=cve