deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-14365
Published: 2025-12-13
Description: The Eyewear prescription form plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 6.0.1. This is due to missing capability checks on the RemoveItems AJAX action. This makes it possible for unauthenticated attackers to delete arbitrary WooCommerce product categories, including all of their child categories, via the 'catIds' parameter.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/eyewear-prescription-form/tags/6.0.1/admin/class-eyewear_prescription_form-admin.php#L326; https://plugins.trac.wordpress.org/browser/eyewear-prescription-form/tags/6.0.1/admin/class-eyewear_prescription_form-admin.php#L74; https://www.wordfence.com/threat-intel/vulnerabilities/id/b85fc103-20e5-4599-8ed5-5bd5d9c447ee?source=cve
CVE: CVE-2025-14366
Published: 2025-12-13
Description: The Eyewear prescription form plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 6.0.1. This is due to missing authorization checks on the SubmitCatProductRequest AJAX action. This makes it possible for unauthenticated attackers to create arbitrary WooCommerce products with custom names, prices, and category assignments via the 'Name', 'Price', and 'Parent' parameters.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/eyewear-prescription-form/tags/6.0.1/admin/class-eyewear_prescription_form-admin.php#L369; https://plugins.trac.wordpress.org/browser/eyewear-prescription-form/tags/6.0.1/admin/class-eyewear_prescription_form-admin.php#L71; https://www.wordfence.com/threat-intel/vulnerabilities/id/0f21d7a2-3b4f-487f-a64a-b963427233b3?source=cve
CVE: CVE-2025-14367
Published: 2025-12-13
Description: The Easy Theme Options plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.0. This is due to missing authorization checks in the eto_import_settings function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to import arbitrary plugin settings via the 'eto_import_settings' parameter.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/easy-theme-options/tags/1.0/easy-theme-options.php#L277; https://plugins.trac.wordpress.org/browser/easy-theme-options/tags/1.0/easy-theme-options.php#L282; https://www.wordfence.com/threat-intel/vulnerabilities/id/8405e80d-fd72-4d87-b08a-19a686eb2982?source=cve
CVE: CVE-2025-14378
Published: 2025-12-13
Description: The Quick Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/quick-testimonials/; https://www.wordfence.com/threat-intel/vulnerabilities/id/1907308f-a722-48ce-8da4-a6c21ee29575?source=cve
CVE: CVE-2025-14394
Published: 2025-12-13
Description: The Popover Windows plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2. This is due to missing or incorrect nonce validation. This makes it possible for unauthenticated attackers to update the plugin's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://plugins.trac.wordpress.org/browser/popover-windows/tags/1.2/popoveroptions.php#L98; https://www.wordfence.com/threat-intel/vulnerabilities/id/c2af263f-960b-4807-bc85-d136136fa30f?source=cve
CVE: CVE-2025-14395
Published: 2025-12-13
Description: The Popover Windows plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on multiple ajax actions (e.g., pop_submit, poptheme_submit) in all versions up to, and including, 1.2. This makes it possible for authenticated attackers, with subscriber-level access and above, to modify the plugin's settings and content.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/popover-windows/tags/1.2/popoveroptions.php#L98; https://www.wordfence.com/threat-intel/vulnerabilities/id/0cae43cb-a0b7-4067-95b3-26fec31ebf42?source=cve
CVE: CVE-2025-14397
Published: 2025-12-13
Description: The Postem Ipsum plugin for WordPress is vulnerable to unauthorized modification of data to Privilege Escalation due to a missing capability check on the postem_ipsum_generate_users() function in all versions up to, and including, 3.0.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create arbitrary user accounts with the administrator role.
CVSS Score: 8.8 (HIGH)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/postem-ipsum/trunk/admin/postem-ipsum-admin.php#L1150; https://www.wordfence.com/threat-intel/vulnerabilities/id/229c146d-3f99-4f63-9a6f[PII_REDACTED]15?source=cve
CVE: CVE-2025-14440
Published: 2025-12-13
Description: The JAY Login & Register plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.4.01. This is due to incorrect authentication checking in the 'jay_login_register_process_switch_back' function with the 'jay_login_register_process_switch_back' cookie value. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the user id.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-565
References: https://plugins.trac.wordpress.org/browser/jay-login-register/tags/2.4.01/includes/jay-login-register-user-switching.php#L98; https://plugins.trac.wordpress.org/changeset/3418754/; https://www.wordfence.com/threat-intel/vulnerabilities/id/928877a6-eeeb-4ed5-900b-9b1560e1bf87?source=cve
CVE: CVE-2025-14446
Published: 2025-12-13
Description: The Popup Builder (Easy Notify Lite) plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the easynotify_cp_reset() function in all versions up to, and including, 1.1.37. This makes it possible for authenticated attackers, with Subscriber-level access and above, to reset plugin settings to their default values.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/easy-notify-lite/tags/1.1.37/inc/functions/enoty-functions.php#L304; https://plugins.trac.wordpress.org/browser/easy-notify-lite/trunk/inc/functions/enoty-functions.php#L304; https://plugins.trac.wordpress.org/changeset/3418678/
CVE: CVE-2025-14447
Published: 2025-12-13
Description: The AnnunciFunebri Impresa plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the annfu_reset_options() function in all versions up to, and including, 4.7.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete all 29 plugin options, effectively resetting the plugin to its default state.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/annuncifunebri-onoranza/tags/4.7.0/functions.inc.php#L845; https://plugins.trac.wordpress.org/browser/annuncifunebri-onoranza/trunk/functions.inc.php#L845; https://plugins.trac.wordpress.org/changeset/3456966/#file235
CVE: CVE-2025-14451
Published: 2025-12-13
Description: The Solutions Ad Manager plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 1.0.0. This is due to insufficient validation on the redirect URL supplied via the 'sam-redirect-to' parameter. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites if they can successfully trick them into performing an action.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-601
References: https://plugins.trac.wordpress.org/browser/solutions-ad-manager/tags/1.0.0/public/class-solutions-ad-manager-public.php#L30; https://plugins.trac.wordpress.org/browser/solutions-ad-manager/trunk/public/class-solutions-ad-manager-public.php#L30; https://www.wordfence.com/threat-intel/vulnerabilities/id/696495c5-c8f8-4790-af89-1ee911767b1b?source=cve
CVE: CVE-2025-14454
Published: 2025-12-13
Description: The Image Slider by Ays- Responsive Slider and Carousel plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.7.0. This is due to missing or incorrect nonce validation on the bulk delete functionality. This makes it possible for unauthenticated attackers to delete arbitrary sliders via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://plugins.trac.wordpress.org/browser/ays-slider/tags/2.7.0/includes/lists/class-ays-slider-list-table.php#L430; https://plugins.trac.wordpress.org/browser/ays-slider/trunk/includes/lists/class-ays-slider-list-table.php#L430; https://plugins.trac.wordpress.org/changeset/3417916/ays-slider/tags/2.7.1/includes/lists/class-ays-slider-list-table.php?old=3278880&old_path=ays-slider%2Ftags%2F2.7.0%2Fincludes%2Flists%2Fclass-ays-slider-list-table.php
CVE: CVE-2025-14462
Published: 2025-12-13
Description: The Lucky Draw Contests plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.2. This is due to missing or incorrect nonce validation in misc-settings.php. This makes it possible for unauthenticated attackers to update plugin settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://plugins.trac.wordpress.org/browser/lucky-draw/tags/4.2/includes/misc-settings.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/49364a21-775a-4de0-84f8-e62aa1a5fefd?source=cve
CVE: CVE-2025-14475
Published: 2025-12-13
Description: The Extensive VC Addons for WPBakery page builder plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.9.1 via the `extensive_vc_get_module_template_part` function. This is due to insufficient path normalization and validation of the user-supplied `shortcode_name` parameter in the `extensive_vc_init_shortcode_pagination` AJAX action. This makes it possible for unauthenticated attackers to include and execute arbitrary PHP files on the server, allowing the execution of any PHP code in those files via the `shortcode_name` parameter.
CVSS Score: 8.1 (HIGH)
CWE: CWE-98
References: https://plugins.trac.wordpress.org/browser/extensive-vc-addon/tags/1.9.1/lib/helpers-functions.php#L78; https://plugins.trac.wordpress.org/browser/extensive-vc-addon/tags/1.9.1/shortcodes/shortcodes-functions.php#L122; https://plugins.trac.wordpress.org/browser/extensive-vc-addon/tags/1.9.1/shortcodes/shortcodes-functions.php#L142
CVE: CVE-2025-14476
Published: 2025-12-13
Description: The Doubly – Cross Domain Copy Paste for WordPress plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.0.46 via deserialization of untrusted input from the content.txt file within uploaded ZIP archives. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject a PHP Object. The additional presence of a POP chain allows attackers to execute arbitrary code, delete files, retrieve sensitive data, or perform other actions depending on the available gadgets. This is only exploitable by subscribers, when administrators have explicitly enabled that access.
CVSS Score: 8.8 (HIGH)
CWE: CWE-502
References: https://plugins.trac.wordpress.org/browser/doubly/tags/1.0.46/inc_php/functions.class.php#L1040; https://plugins.trac.wordpress.org/browser/doubly/tags/1.0.46/inc_php/importer.class.php#L2536; https://plugins.trac.wordpress.org/browser/doubly/trunk/inc_php/functions.class.php#L1040
CVE: CVE-2025-14477
Published: 2025-12-13
Description: The 404 Solution plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 3.1.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This is due to improper sanitization of the `filterText` parameter in the `ajaxUpdatePaginationLinks` AJAX action. The sanitization logic can be bypassed by using the sequence `*$/` which becomes `*/` after the `$` character is removed, allowing attackers to escape SQL comment contexts. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database via a time-based blind SQL injection technique.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-89
References: https://plugins.trac.wordpress.org/browser/404-solution/tags/2.36.10/includes/DataAccess.php#L977; https://plugins.trac.wordpress.org/browser/404-solution/tags/2.36.10/includes/DataAccess.php#L987; https://plugins.trac.wordpress.org/browser/404-solution/tags/2.36.10/includes/PluginLogic.php#L1595
CVE: CVE-2025-14508
Published: 2025-12-13
Description: The MediaCommander – Bring Folders to Media, Posts, and Pages plugin for WordPress is vulnerable to unauthorized data deletion due to a missing capability check on the import-csv REST API endpoint in all versions up to, and including, 2.3.1. This is due to the endpoint using `upload_files` capability check (Author level) for a destructive operation that can delete all folders. This makes it possible for authenticated attackers, with Author-level access and above, to delete all folder organization data created by Administrators and other users.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/mediacommander/trunk/includes/Models/FoldersModel.php#L793; https://plugins.trac.wordpress.org/browser/mediacommander/trunk/includes/Rest/Controllers/FoldersController.php#L127; https://plugins.trac.wordpress.org/changeset/3417928/
CVE: CVE-2025-14539
Published: 2025-12-13
Description: The The Shortcode Ajax plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.0. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-94
References: https://plugins.trac.wordpress.org/browser/shortcode-ajax/trunk/shortcode-ajax.php#L29; https://www.wordfence.com/threat-intel/vulnerabilities/id/8e2a994f-7a42-4ccb-8fa0-77107ba1150c?source=cve
CVE: CVE-2025-14540
Published: 2025-12-13
Description: The Userback plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the userback_get_json function in all versions up to, and including, 1.0.15. This makes it possible for authenticated attackers, with Subscriber-level access and above, to extract plugin's configuration data including the Userback API access token and site's posts/pages contents, including those that have private and draft status.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/userback/tags/1.0.15/index.php#L148; https://www.wordfence.com/threat-intel/vulnerabilities/id/1add8693-20df-431e-ad3b-b23322f1fa03?source=cve
CVE: CVE-2025-14542
Published: 2025-12-13
Description: The vulnerability arises when a client fetches a tools’ JSON specification, known as a Manual, from a remote Manual Endpoint. While a provider may initially serve a benign manual (e.g., one defining an HTTP tool call), earning the clients’ trust, a malicious provider can later change the manual to exploit the client.
CVSS Score: 7.5 (HIGH)
CWE: CWE-501
References: https://github.com/universal-tool-calling-protocol/python-utcp/commit/2dc9c02df72cad3770c934959325ec344b441444; https://research.jfrog.com/vulnerabilities/python-utcp-untrusted-manual-command-execution-jfsa-2[PII_REDACTED]29/
CVE: CVE-2025-14581
Published: 2025-12-13
Description: The HAPPY – Helpdesk Support Ticket System plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the 'submit_form_reply' AJAX action in all versions up to, and including, 1.0.9. This makes it possible for authenticated attackers, with Subscriber-level access and above, to submit replies to arbitrary support tickets by manipulating the 'happy_topic_id' parameter, regardless of whether they are the ticket owner or have been assigned to the ticket.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/happy-helpdesk-support-ticket-system/tags/1.0.9/inc/happy-replies.php#L585; https://plugins.trac.wordpress.org/browser/happy-helpdesk-support-ticket-system/trunk/inc/happy-replies.php#L585; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3417847%40happy-helpdesk-support-ticket-system&new=3417847%40happy-helpdesk-support-ticket-system&sfp_email=&sfph_mail=
CVE: CVE-2025-14586
Published: 2025-12-13
Description: A vulnerability was determined in TOTOLINK X5000R 9.1.0cu.2089_B20211224. Affected by this issue is the function snprintf of the file /cgi-bin/cstecgi.cgi?action=exportOvpn&type=user. This manipulation of the argument User causes os command injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-77, CWE-78, CWE-78
References: https://github.com/awigwu76/TOTOLINK_X5000R/blob/main/1.md; https://vuldb.com/?ctiid.336206; https://vuldb.com/?id.336206
CVE: CVE-2025-14587
Published: 2025-12-13
Description: A vulnerability was identified in itsourcecode Online Pet Shop Management System 1.0. This affects an unknown part of the file /pet1/available.php. Such manipulation of the argument Name leads to sql injection. The attack can be executed remotely. The exploit is publicly available and might be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/tzm113/CVE/issues/1; https://itsourcecode.com/; https://vuldb.com/?ctiid.336207
CVE: CVE-2025-14588
Published: 2025-12-13
Description: A security flaw has been discovered in itsourcecode Student Management System 1.0. This vulnerability affects unknown code of the file /update_program.php. Performing manipulation of the argument ID results in sql injection. The attack is possible to be carried out remotely. The exploit has been released to the public and may be exploited.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/ltranquility/CVE/issues/24; https://itsourcecode.com/; https://vuldb.com/?ctiid.336208
CVE: CVE-2025-14589
Published: 2025-12-13
Description: A weakness has been identified in code-projects Prison Management System 2.0. This issue affects some unknown processing of the file /admin/search.php. Executing a manipulation of the argument keyname can lead to sql injection. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://code-projects.org/; https://github.com/asd1238525/cve/blob/main/SQL18.md; https://vuldb.com/?ctiid.336209
CVE: CVE-2025-14590
Published: 2025-12-13
Description: A security vulnerability has been detected in code-projects Prison Management System 2.0. Impacted is an unknown function of the file /admin/search1.php. The manipulation of the argument keyname leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://code-projects.org/; https://github.com/asd1238525/cve/blob/main/SQL19.md; https://vuldb.com/?ctiid.336210
CVE: CVE-2025-14606
Published: 2025-12-13
Description: A security vulnerability has been detected in tiny-rdm Tiny RDM up to 1.2.5. Affected by this vulnerability is the function pickle.loads of the file pickle_convert.go of the component Pickle Decoding. The manipulation leads to deserialization. The attack can be initiated remotely. A high degree of complexity is needed for the attack. The exploitation appears to be difficult. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20, CWE-502
References: https://github.com/tiny-craft/tiny-rdm/issues/512; https://vuldb.com/?ctiid.336282; https://vuldb.com/?id.336282
CVE: CVE-2025-14607
Published: 2025-12-13
Description: A vulnerability was detected in OFFIS DCMTK up to 3.6.9. Affected by this issue is the function DcmByteString::makeDicomByteString of the file dcmdata/libsrc/dcbytstr.cc of the component dcmdata. The manipulation results in memory corruption. The attack can be launched remotely. Upgrading to version 3.7.0 can resolve this issue. The patch is identified as 4c0e5c10079392c594d6a7abd95dd78ac0aa556a. You should upgrade the affected component.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-119
References: https://github.com/DCMTK/dcmtk/commit/4c0e5c10079392c594d6a7abd95dd78ac0aa556a; https://support.dcmtk.org/redmine/issues/1184; https://support.dcmtk.org/redmine/projects/dcmtk/activity?from=2025-12-02
CVE: CVE-2025-14617
Published: 2025-12-13
Description: A vulnerability has been found in Jehovahs Witnesses JW Library App up to 15.5.1 on Android. Affected is an unknown function of the component org.jw.jwlibrary.mobile.activity.SiloContainer. Such manipulation leads to path traversal. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-22
References: https://github.com/Secsys-FDU/AF_CVEs/issues/1; https://vuldb.com/?ctiid.336303; https://vuldb.com/?id.336303
CVE: CVE-2025-14619
Published: 2025-12-13
Description: A vulnerability was found in code-projects Student File Management System 1.0. Affected by this vulnerability is an unknown functionality of the file login_query.php. Performing manipulation of the argument stud_no results in sql injection. The attack may be initiated remotely. The exploit has been made public and could be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://code-projects.org/; https://github.com/jjjjj-zr/jjjjjzr2/issues/2; https://vuldb.com/?ctiid.336304
CVE: CVE-2025-14620
Published: 2025-12-13
Description: A vulnerability was determined in code-projects Student File Management System 1.0. Affected by this issue is some unknown functionality of the file /admin/login_query.php. Executing manipulation of the argument Username can lead to sql injection. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/jjjjj-zr/jjjjjzr3/issues/1; https://vuldb.com/?ctiid.336305
CVE: CVE-2025-36747
Published: 2025-12-13
Description: ShineLan-X contains a set of credentials for an FTP server was found within the firmware, allowing testers to establish an insecure FTP connection with the server. This may allow an attacker to replace legitimate files being deployed to devices with their own malicious versions, since the firmware signature verification is not enforced.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: https://csirt.divd.nl/CVE-2025-36747/