deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-5292
Published: 2025-05-31
Description: The Element Pack Addons for Elementor – Best Elementor addons with Ready Templates, Blocks, Widgets and WooCommerce Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'marker_content’ parameter in all versions up to, and including, 5.11.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset/3302152/; https://www.wordfence.com/threat-intel/vulnerabilities/id/ab8dfdd8-820c-4066-8014-2cb5b9f935a4?source=cve
CVE: CVE-2025-3813
Published: 2025-05-31
Description: The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘_elementor_data’ parameter in all versions up to, and including, 1.7.1020 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/royal-elementor-addons/tags/1.7.1021/classes/modules/forms/wpr-submissions-cpt.php?rev=3301438; https://plugins.trac.wordpress.org/browser/royal-elementor-addons/trunk/classes/modules/forms/wpr-submissions-cpt.php#L24; https://plugins.trac.wordpress.org/browser/royal-elementor-addons/trunk/classes/modules/forms/wpr-submissions-cpt.php#L75
CVE: CVE-2025-5290
Published: 2025-05-31
Description: The Borderless – Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘title’ parameter in all versions up to, and including, 1.7.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/borderless/trunk/assets/scripts/borderless-elementor.min.js#L230; https://plugins.trac.wordpress.org/browser/borderless/trunk/assets/scripts/borderless-elementor.min.js#L288; https://plugins.trac.wordpress.org/browser/borderless/trunk/assets/scripts/borderless-elementor.min.js#L72
CVE: CVE-2025-5371
Published: 2025-05-31
Description: A vulnerability, which was classified as critical, has been found in SourceCodester Health Center Patient Record Management System 1.0. Affected by this issue is some unknown functionality of the file /admin/admin.php. The manipulation of the argument Username leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/shanranne/myCVE/issues/4; https://vuldb.com/?ctiid.310664; https://vuldb.com/?id.310664
CVE: CVE-2025-5373
Published: 2025-05-31
Description: A vulnerability has been found in PHPGurukul Online Birth Certificate System 2.0 and classified as critical. This vulnerability affects unknown code of the file /admin/users-applications.php. The manipulation of the argument userid leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/f1rstb100d/myCVE/issues/27; https://phpgurukul.com/; https://vuldb.com/?ctiid.310666
CVE: CVE-2025-5374
Published: 2025-05-31
Description: A vulnerability was found in PHPGurukul Online Birth Certificate System 2.0 and classified as critical. This issue affects some unknown processing of the file /admin/all-applications.php. The manipulation of the argument del leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/f1rstb100d/myCVE/issues/28; https://phpgurukul.com/; https://vuldb.com/?ctiid.310667
CVE: CVE-2025-5375
Published: 2025-05-31
Description: A vulnerability was found in PHPGurukul HPGurukul Online Birth Certificate System 2.0. It has been classified as critical. Affected is an unknown function of the file /admin/registered-users.php. The manipulation of the argument del leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/f1rstb100d/myCVE/issues/29; https://phpgurukul.com/; https://vuldb.com/?ctiid.310668
CVE: CVE-2025-4691
Published: 2025-05-31
Description: The Free Booking Plugin for Hotels, Restaurants and Car Rentals – eaSYNC Booking plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.3.21 via the 'view_request_details' due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to view the details of any booking request. The vulnerability was partially patched in versions 1.3.18 and 1.3.21.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-639
References: https://plugins.trac.wordpress.org/browser/easync-booking/tags/1.3.17/easync.php#L4859; https://plugins.trac.wordpress.org/changeset/3243634/; https://plugins.trac.wordpress.org/changeset/3293607/
CVE: CVE-2025-4857
Published: 2025-05-31
Description: The Newsletters plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.9.9.9 via the 'file' parameter. This makes it possible for authenticated attackers, with Administrator-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
CVSS Score: 7.2 (HIGH)
CWE: CWE-22
References: https://plugins.trac.wordpress.org/browser/newsletters-lite/trunk/wp-mailinglist.php#L1584; https://plugins.trac.wordpress.org/changeset/3303758/; https://www.wordfence.com/threat-intel/vulnerabilities/id/33c0838a-5f86-4368-8bf9-da0582acbabf?source=cve
CVE: CVE-2025-5376
Published: 2025-05-31
Description: A vulnerability was found in SourceCodester Health Center Patient Record Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /patient.php. The manipulation of the argument itr_no leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/shanranne/myCVE/issues/5; https://vuldb.com/?ctiid.310669; https://vuldb.com/?id.310669
CVE: CVE-2025-5377
Published: 2025-05-31
Description: A vulnerability was found in Astun Technology iShare Maps 5.4.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file historic1.asp. The manipulation of the argument Zoom leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79, CWE-94, CWE-79
References: https://vuldb.com/?ctiid.310670; https://vuldb.com/?id.310670; https://vuldb.com/?submit.582835
CVE: CVE-2025-5378
Published: 2025-05-31
Description: A vulnerability classified as problematic has been found in Astun Technology iShare Maps 5.4.0. This affects an unknown part of the file mycouncil2.aspx. The manipulation of the argument atTxtStreet leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79, CWE-94, CWE-79
References: https://vuldb.com/?ctiid.310671; https://vuldb.com/?id.310671; https://vuldb.com/?submit.582841
CVE: CVE-2025-5379
Published: 2025-05-31
Description: A vulnerability classified as critical was found in NuCom NC-WR744G 8.5.5 Build 20200530.307. This vulnerability affects unknown code of the component Console Application. The manipulation of the argument CMCCAdmin/useradmin/CUAdmin leads to hard-coded credentials. The attack can be initiated remotely. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-259, CWE-798
References: https://vuldb.com/?ctiid.310672; https://vuldb.com/?id.310672; https://vuldb.com/?submit.582868
CVE: CVE-2025-5380
Published: 2025-05-31
Description: A vulnerability, which was classified as critical, has been found in ashinigit 天青一白 XueShengZhuSu 学生住宿管理系统 up to 4d3f0ada0e71482c1e51fd5f5615e5a3d8bcbfbb. This issue affects some unknown processing of the file /upload/ of the component Image File Upload. The manipulation of the argument File leads to path traversal. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-22
References: https://gitee.com/ashinigit/XueShengZhuSu/issues/IC9VZD; https://vuldb.com/?ctiid.310673; https://vuldb.com/?id.310673
CVE: CVE-2025-5381
Published: 2025-05-31
Description: A vulnerability, which was classified as problematic, was found in Yifang CMS up to 2.0.2. Affected is the function downloadFile of the file /api/File/downloadFile of the component Admin Panel. The manipulation of the argument File leads to path traversal. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 2.7 (LOW)
CWE: CWE-22, CWE-22
References: https://gitee.com/wanglongcn/yifang/issues/IC0RCX; https://vuldb.com/?ctiid.310674; https://vuldb.com/?id.310674
CVE: CVE-2025-5383
Published: 2025-05-31
Description: A vulnerability was found in Yifang CMS up to 2.0.2 and classified as problematic. Affected by this issue is some unknown functionality of the component Article Management Module. The manipulation of the argument Default Value leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 2.4 (LOW)
CWE: CWE-79, CWE-94, CWE-79
References: https://gitee.com/wanglongcn/yifang/issues/IC41YQ; https://vuldb.com/?ctiid.310676; https://vuldb.com/?id.310676
CVE: CVE-2025-5384
Published: 2025-05-31
Description: A vulnerability was found in JeeWMS up to 20250504. It has been classified as critical. This affects the function CgAutoListController of the file /cgAutoListController.do?datagrid. The manipulation leads to sql injection. It is possible to initiate the attack remotely. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://gitee.com/erzhongxmu/JEEWMS/issues/IC5FNV; https://vuldb.com/?ctiid.310677; https://vuldb.com/?id.310677
CVE: CVE-2025-5385
Published: 2025-05-31
Description: A vulnerability was found in JeeWMS up to 20250504. It has been declared as critical. This vulnerability affects the function doAdd of the file /cgformTemplateController.do?doAdd. The manipulation leads to path traversal. The attack can be initiated remotely. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-22
References: https://gitee.com/erzhongxmu/JEEWMS/issues/IC5FNV; https://vuldb.com/?ctiid.310678; https://vuldb.com/?id.310678
CVE: CVE-2025-5386
Published: 2025-05-31
Description: A vulnerability was found in JeeWMS up to 20250504. It has been rated as critical. This issue affects the function transEditor of the file /cgformTransController.do?transEditor. The manipulation leads to sql injection. The attack may be initiated remotely. This product does not use versioning. This is why information about affected and unaffected releases are unavailable.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://gitee.com/erzhongxmu/JEEWMS/issues/IC5FNV; https://vuldb.com/?ctiid.310679; https://vuldb.com/?id.310679
CVE: CVE-2025-5387
Published: 2025-05-31
Description: A vulnerability classified as critical has been found in JeeWMS up to 20250504. Affected is the function dogenerate of the file /generateController.do?dogenerate of the component File Handler. The manipulation leads to improper access controls. It is possible to launch the attack remotely. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-266, CWE-284
References: https://gitee.com/erzhongxmu/JEEWMS/issues/IC5FNV; https://vuldb.com/?ctiid.310680; https://vuldb.com/?id.310680
CVE: CVE-2025-5388
Published: 2025-05-31
Description: A vulnerability classified as critical was found in JeeWMS up to 20250504. Affected by this vulnerability is the function dogenerate of the file /generateController.do?dogenerate. The manipulation leads to sql injection. The attack can be launched remotely. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://gitee.com/erzhongxmu/JEEWMS/issues/IC5FNV; https://vuldb.com/?ctiid.310681; https://vuldb.com/?id.310681
CVE: CVE-2025-5389
Published: 2025-05-31
Description: A vulnerability, which was classified as critical, has been found in JeeWMS up to 20250504. Affected by this issue is the function dogenerateOne2Many of the file /generateController.do?dogenerateOne2Many of the component File Handler. The manipulation leads to improper access controls. The attack may be launched remotely. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-266, CWE-284
References: https://gitee.com/erzhongxmu/JEEWMS/issues/IC5FNV; https://vuldb.com/?ctiid.310682; https://vuldb.com/?id.310682
CVE: CVE-2025-5390
Published: 2025-05-31
Description: A vulnerability, which was classified as critical, was found in JeeWMS up to 20250504. This affects the function filedeal of the file /systemController/filedeal.do of the component File Handler. The manipulation leads to improper access controls. It is possible to initiate the attack remotely. This product does not use versioning. This is why information about affected and unaffected releases are unavailable.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-266, CWE-284
References: https://gitee.com/erzhongxmu/JEEWMS/issues/IC5FNV; https://vuldb.com/?ctiid.310683; https://vuldb.com/?id.310683
CVE: CVE-2025-5400
Published: 2025-06-01
Description: A vulnerability was found in chaitak-gorai Blogbook up to 92f5cf90f8a7e6566b576fe0952e14e1c6736513. It has been classified as critical. Affected is an unknown function of the file /user.php of the component GET Parameter Handler. The manipulation of the argument u_id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/rllvusgnzm98/Report/blob/main/blogbook/BlogBook%20user.php%20u_id%20Parameter%20SQL%20Injection.md; https://vuldb.com/?ctiid.310740; https://vuldb.com/?id.310740
CVE: CVE-2025-1499
Published: 2025-06-01
Description: IBM InfoSphere Information Server 11.7 stores credential information for database authentication in a cleartext parameter file that could be viewed by an authenticated user.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-312
References: https://www.ibm.com/support/pages/node/7233154
CVE: CVE-2025-25044
Published: 2025-06-01
Description: IBM Planning Analytics Local 2.0 and 2.1 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.ibm.com/support/pages/node/7235182
CVE: CVE-2025-2896
Published: 2025-06-01
Description: IBM Planning Analytics Local 2.0 and 2.1 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://www.ibm.com/support/pages/node/7235182
CVE: CVE-2025-33004
Published: 2025-06-01
Description: IBM Planning Analytics Local 2.0 and 2.1 could allow a privileged user to delete files from directories due to improper pathname restriction.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://www.ibm.com/support/pages/node/7235182
CVE: CVE-2025-33005
Published: 2025-06-01
Description: IBM Planning Analytics Local 2.0 and 2.1 does not invalidate session after a logout which could allow an authenticated user to impersonate another user on the system.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-613, CWE-613
References: https://www.ibm.com/support/pages/node/7235182
CVE: CVE-2025-5401
Published: 2025-06-01
Description: A vulnerability was found in chaitak-gorai Blogbook up to 92f5cf90f8a7e6566b576fe0952e14e1c6736513. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /post.php of the component GET Parameter Handler. The manipulation of the argument p_id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/rllvusgnzm98/Report/blob/main/blogbook/BlogBook%20post.php%20p_id%20Parameter%20SQL%20Injection.md; https://vuldb.com/?ctiid.310741; https://vuldb.com/?id.310741
CVE: CVE-2025-40908
Published: 2025-06-01
Description: YAML-LibYAML prior to 0.903.0 for Perl uses 2-args open, allowing existing files to be modified
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-552
References: https://github.com/ingydotnet/yaml-libyaml-pm/issues/120; https://github.com/ingydotnet/yaml-libyaml-pm/pull/121; https://github.com/ingydotnet/yaml-libyaml-pm/pull/122
CVE: CVE-2025-5402
Published: 2025-06-01
Description: A vulnerability was found in chaitak-gorai Blogbook up to 92f5cf90f8a7e6566b576fe0952e14e1c6736513. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin/includes/edit_post.php of the component GET Parameter Handler. The manipulation of the argument edit_post_id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/rllvusgnzm98/Report/blob/main/blogbook/BlogBook%20posts.php%20edit_post%20p_id%20Parameter%20SQL%20Injection.md; https://vuldb.com/?ctiid.310742; https://vuldb.com/?id.310742
CVE: CVE-2025-5403
Published: 2025-06-01
Description: A vulnerability classified as critical has been found in chaitak-gorai Blogbook up to 92f5cf90f8a7e6566b576fe0952e14e1c6736513. This affects an unknown part of the file /admin/view_all_posts.php of the component GET Parameter Handler. The manipulation of the argument post_id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/rllvusgnzm98/Report/blob/main/blogbook/BlogBook%20posts.php%20delete_post%20delete%20Parameter%20SQL%20Injection.md; https://vuldb.com/?ctiid.310743; https://vuldb.com/?id.310743
CVE: CVE-2025-5404
Published: 2025-06-01
Description: A vulnerability classified as problematic was found in chaitak-gorai Blogbook up to 92f5cf90f8a7e6566b576fe0952e14e1c6736513. This vulnerability affects unknown code of the file /search.php of the component GET Parameter Handler. The manipulation of the argument Search leads to denial of service. The exploit has been disclosed to the public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-404
References: https://github.com/rllvusgnzm98/Report/blob/main/blogbook/BlogBook%20search.php%20search%20Parameter%20SQL%20Injection.md; https://vuldb.com/?ctiid.310744; https://vuldb.com/?id.310744
CVE: CVE-2025-5405
Published: 2025-06-01
Description: A vulnerability, which was classified as problematic, has been found in chaitak-gorai Blogbook up to 92f5cf90f8a7e6566b576fe0952e14e1c6736513. This issue affects some unknown processing of the file /post.php. The manipulation of the argument comment_author/comment_email/comment_content leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94, CWE-79
References: https://github.com/rllvusgnzm98/Report/blob/main/blogbook/BlogBook%20post.php%20Stored%20Cross-Site%20Scripting%20(XSS)%20in%20Comment%20Functionality%20Leading%20to%20Admin%20and%20User%20Account%20Takeover.md; https://vuldb.com/?ctiid.310745; https://vuldb.com/?id.310745
CVE: CVE-2025-5406
Published: 2025-06-01
Description: A vulnerability, which was classified as critical, was found in chaitak-gorai Blogbook up to 92f5cf90f8a7e6566b576fe0952e14e1c6736513. Affected is an unknown function of the file /admin/posts.php?source=add_post. The manipulation of the argument image leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-284, CWE-434, CWE-434
References: https://github.com/rllvusgnzm98/Report/blob/main/blogbook/BlogBook%20posts.php%20add_post%20post_image%20Parameter%20Unrestricted%20Upload.md; https://vuldb.com/?ctiid.310746; https://vuldb.com/?id.310746