deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-48080
Published: 2025-05-16
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Uncanny Owl Uncanny Toolkit for LearnDash uncanny-learndash-toolkit allows Stored XSS.This issue affects Uncanny Toolkit for LearnDash: from n/a through <= 3.7.0.2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/uncanny-learndash-toolkit/vulnerability/wordpress-uncanny-toolkit-for-learndash-3-7-0-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-48112
Published: 2025-05-16
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in karimmughal Dot html,php,xml etc pages dot-htmlphpxml-etc-pages allows Reflected XSS.This issue affects Dot html,php,xml etc pages: from n/a through <= 1.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/dot-htmlphpxml-etc-pages/vulnerability/wordpress-dot-html-php-xml-etc-pages-plugin-1-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-48113
Published: 2025-05-16
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Broadstreet Broadstreet Ads broadstreet allows Stored XSS.This issue affects Broadstreet Ads: from n/a through <= 1.51.2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/broadstreet/vulnerability/wordpress-broadstreet-1-51-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-48114
Published: 2025-05-16
Description: Cross-Site Request Forgery (CSRF) vulnerability in Shayan Farhang Pazhooh ShayanWeb Admin FontChanger shayanweb-admin-fontchanger allows Stored XSS.This issue affects ShayanWeb Admin FontChanger: from n/a through <= 1.9.1.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/shayanweb-admin-fontchanger/vulnerability/wordpress-shayanweb-admin-fontchanger-plugin-1-8-1-cross-site-request-forgery-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE: CVE-2025-48115
Published: 2025-05-16
Description: Cross-Site Request Forgery (CSRF) vulnerability in Javier Revilla ValidateCertify validar-certificados-de-cursos allows Cross Site Request Forgery.This issue affects ValidateCertify: from n/a through <= 1.6.4.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/validar-certificados-de-cursos/vulnerability/wordpress-validatecertify-1-6-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-48116
Published: 2025-05-16
Description: Missing Authorization vulnerability in Ashan Perera EventON eventon-lite allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects EventON: from n/a through <= 2.4.4.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/eventon-lite/vulnerability/wordpress-eventon-2-4-4-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-48117
Published: 2025-05-16
Description: Missing Authorization vulnerability in kilbot WooCommerce POS woocommerce-pos allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooCommerce POS: from n/a through <= 1.7.8.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/woocommerce-pos/vulnerability/wordpress-woocommerce-pos-1-7-8-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-48119
Published: 2025-05-16
Description: Improper Control of Generation of Code ('Code Injection') vulnerability in RS WP THEMES RS WP Book Showcase rs-wp-books-showcase allows Code Injection.This issue affects RS WP Book Showcase: from n/a through <= 6.7.59.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-94
References: https://patchstack.com/database/Wordpress/Plugin/rs-wp-books-showcase/vulnerability/wordpress-rs-wp-book-showcase-plugin-6-7-40-arbitrary-shortcode-execution-vulnerability?_s_id=cve
CVE: CVE-2025-48120
Published: 2025-05-16
Description: Improper Control of Generation of Code ('Code Injection') vulnerability in RomanCode MapSVG mapsvg-lite-interactive-vector-maps allows Code Injection.This issue affects MapSVG: from n/a through <= 8.6.9.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-94
References: https://patchstack.com/database/Wordpress/Plugin/mapsvg-lite-interactive-vector-maps/vulnerability/wordpress-mapsvg-lite-plugin-8-5-41-arbitrary-shortcode-execution-vulnerability?_s_id=cve
CVE: CVE-2025-48121
Published: 2025-05-16
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Steve Puddick WP Notes Widget wp-notes-widget allows DOM-Based XSS.This issue affects WP Notes Widget: from n/a through <= 1.0.6.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wp-notes-widget/vulnerability/wordpress-wp-notes-widget-1-0-6-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-48127
Published: 2025-05-16
Description: Missing Authorization vulnerability in App Cheap Push notification for Mobile and Web app push-notification-mobile-and-web-app allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Push notification for Mobile and Web app: from n/a through <= 2.0.3.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/push-notification-mobile-and-web-app/vulnerability/wordpress-push-notification-for-mobile-and-web-app-2-0-3-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-48128
Published: 2025-05-16
Description: Missing Authorization vulnerability in Sharespine Sharespine Woocommerce Connector sharespine-woocommerce-connector allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sharespine Woocommerce Connector: from n/a through <= 4.7.55.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/sharespine-woocommerce-connector/vulnerability/wordpress-sharespine-woocommerce-connector-4-7-55-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-48131
Published: 2025-05-16
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Saiful Islam UltraAddons Elementor Lite ultraaddons-elementor-lite allows Stored XSS.This issue affects UltraAddons Elementor Lite: from n/a through <= 2.0.2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/ultraaddons-elementor-lite/vulnerability/wordpress-ultraaddons-elementor-lite-2-0-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-48132
Published: 2025-05-16
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pencilwp X Addons for Elementor x-addons-elementor allows Stored XSS.This issue affects X Addons for Elementor: from n/a through <= 1.0.16.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/x-addons-elementor/vulnerability/wordpress-x-addons-for-elementor-1-0-14-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-48134
Published: 2025-05-16
Description: Deserialization of Untrusted Data vulnerability in ShapedPlugin LLC WP Tabs wp-expand-tabs-free allows Object Injection.This issue affects WP Tabs: from n/a through <= 2.2.12.
CVSS Score: 7.2 (HIGH)
CWE: CWE-502
References: https://patchstack.com/database/Wordpress/Plugin/wp-expand-tabs-free/vulnerability/wordpress-wp-tabs-2-2-11-php-object-injection-vulnerability?_s_id=cve
CVE: CVE-2025-48135
Published: 2025-05-16
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in aptivadadev Aptivada for WP aptivada-for-wp allows DOM-Based XSS.This issue affects Aptivada for WP: from n/a through <= 2.0.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/aptivada-for-wp/vulnerability/wordpress-aptivada-for-wp-2-0-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-48136
Published: 2025-05-16
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Estatik Mortgage Calculator Estatik estatik-mortgage-calculator allows PHP Local File Inclusion.This issue affects Mortgage Calculator Estatik: from n/a through <= 2.0.12.
CVSS Score: 7.5 (HIGH)
CWE: CWE-98, CWE-706
References: https://patchstack.com/database/Wordpress/Plugin/estatik-mortgage-calculator/vulnerability/wordpress-mortgage-calculator-estatik-2-0-12-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-48137
Published: 2025-05-16
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in proxymis Interview interview allows SQL Injection.This issue affects Interview: from n/a through <= 1.01.
CVSS Score: 8.5 (HIGH)
CWE: CWE-89, CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/interview/vulnerability/wordpress-interview-1-01-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-48138
Published: 2025-05-16
Description: Missing Authorization vulnerability in Bertha AI – Andrew Palmer BERTHA AI bertha-ai-free allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BERTHA AI: from n/a through <= 1.13.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/bertha-ai-free/vulnerability/wordpress-bertha-ai-1-12-11-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-48144
Published: 2025-05-16
Description: Cross-Site Request Forgery (CSRF) vulnerability in sidngr Import Export For WooCommerce import-export-for-woocommerce allows Stored XSS.This issue affects Import Export For WooCommerce: from n/a through <= 1.6.2.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/import-export-for-woocommerce/vulnerability/wordpress-import-export-for-woocommerce-plugin-1-6-2-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE: CVE-2025-48146
Published: 2025-05-16
Description: Cross-Site Request Forgery (CSRF) vulnerability in Michael Lups SEO Flow by LupsOnline lupsonline-link-netwerk allows Stored XSS.This issue affects SEO Flow by LupsOnline: from n/a through <= 2.2.1.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/lupsonline-link-netwerk/vulnerability/wordpress-seo-flow-by-lupsonline-plugin-2-2-0-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE: CVE-2025-4786
Published: 2025-05-16
Description: A vulnerability was found in SourceCodester/oretnom23 Stock Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /admin/?page=return/view_return. The manipulation of the argument ID leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/th3w0lf-1337/Vulnerabilities/blob/main/SMS-PHP/SQLi/Return-List/info.md; https://vuldb.com/?ctiid.309095; https://vuldb.com/?id.309095
CVE: CVE-2025-4787
Published: 2025-05-16
Description: A vulnerability classified as critical has been found in SourceCodester/oretnom23 Stock Management System 1.0. Affected is an unknown function of the file /admin/?page=sales/view_sale. The manipulation of the argument ID leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/th3w0lf-1337/Vulnerabilities/blob/main/SMS-PHP/SQLi/Sale-List/info.md; https://vuldb.com/?ctiid.309096; https://vuldb.com/?id.309096
CVE: CVE-2025-4788
Published: 2025-05-16
Description: A vulnerability classified as critical was found in FreeFloat FTP Server 1.0. Affected by this vulnerability is an unknown functionality of the component DELETE Command Handler. The manipulation leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-119, CWE-120, CWE-787
References: https://fitoxs.com/exploit/exploit-cd619c9271a231511f4fa2de1cf569b7040376a5cfe23dc6060884c32638254e.txt; https://vuldb.com/?ctiid.309097; https://vuldb.com/?id.309097
CVE: CVE-2025-4789
Published: 2025-05-16
Description: A vulnerability, which was classified as critical, has been found in FreeFloat FTP Server 1.0. Affected by this issue is some unknown functionality of the component LCD Command Handler. The manipulation leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-119, CWE-120, CWE-787
References: https://fitoxs.com/exploit/exploit-23d12ba21a827aadd1af628488c8d5308103beb3a2038981aa59a1a6ee3fc7dd.txt; https://vuldb.com/?ctiid.309098; https://vuldb.com/?id.309098
CVE: CVE-2025-4790
Published: 2025-05-16
Description: A vulnerability, which was classified as critical, was found in FreeFloat FTP Server 1.0. This affects an unknown part of the component GLOB Command Handler. The manipulation leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-119, CWE-120, CWE-787
References: https://fitoxs.com/exploit/exploit-3b4e822c5e445f2fe48f704745994fc63a9300dacddaaeb5290b1149dd2d7704.txt; https://vuldb.com/?ctiid.309099; https://vuldb.com/?id.309099
CVE: CVE-2025-4791
Published: 2025-05-16
Description: A vulnerability has been found in FreeFloat FTP Server 1.0 and classified as critical. This vulnerability affects unknown code of the component HASH Command Handler. The manipulation leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-119, CWE-120, CWE-787
References: https://fitoxs.com/exploit/exploit-bc230ff2f41a996bdab8ab4072a38e2e99aa486f2d7f50f8f9e983adb7dc4536.txt; https://vuldb.com/?ctiid.309100; https://vuldb.com/?id.309100
CVE: CVE-2025-4476
Published: 2025-05-16
Description: A denial-of-service vulnerability has been identified in the libsoup HTTP client library. This flaw can be triggered when a libsoup client receives a 401 (Unauthorized) HTTP response containing a specifically crafted domain parameter within the WWW-Authenticate header. Processing this malformed header can lead to a crash of the client application using libsoup. An attacker could exploit this by setting up a malicious HTTP server. If a user's application using the vulnerable libsoup library connects to this malicious server, it could result in a denial-of-service. Successful exploitation requires tricking a user's client application into connecting to the attacker's malicious server.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-476
References: https://access.redhat.com/security/cve/CVE-2025-4476; https://bugzilla.redhat.com/show_bug.cgi?id=2366513; https://gitlab.gnome.org/GNOME/libsoup/-/issues/440
CVE: CVE-2025-4792
Published: 2025-05-16
Description: A vulnerability was found in FreeFloat FTP Server 1.0 and classified as critical. This issue affects some unknown processing of the component MDELETE Command Handler. The manipulation leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-119, CWE-120
References: https://fitoxs.com/exploit/exploit-fb7e880a8c21bdec1f4d3953a2c57bcc582b95ffc83513c7d709f45c15d60504.txt; https://vuldb.com/?ctiid.309101; https://vuldb.com/?id.309101
CVE: CVE-2025-4793
Published: 2025-05-16
Description: A vulnerability was found in PHPGurukul Online Course Registration 3.1. It has been classified as critical. Affected is an unknown function of the file /edit-student-profile.php. The manipulation of the argument cgpa leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/FLYFISH567/CVE/issues/7; https://phpgurukul.com/; https://vuldb.com/?ctiid.309102
CVE: CVE-2025-4794
Published: 2025-05-16
Description: A vulnerability was found in PHPGurukul Online Course Registration 3.1. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /news.php. The manipulation of the argument newstitle leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/FLYFISH567/CVE/issues/8; https://phpgurukul.com/; https://vuldb.com/?ctiid.309103
CVE: CVE-2025-4795
Published: 2025-05-16
Description: A vulnerability classified as critical has been found in gongfuxiang schoolcms 2.3.1. This affects the function SaveInfo of the file /index.php?m=Admin&c=article&a=SaveInfo. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/adminnerr/cve/issues/1; https://github.com/adminnerr/cve/issues/1#issue[PII_REDACTED]; https://vuldb.com/?ctiid.309105
CVE: CVE-2025-4806
Published: 2025-05-16
Description: A vulnerability, which was classified as critical, has been found in SourceCodester/oretnom23 Stock Management System 1.0. Affected by this issue is some unknown functionality of the file /admin/?page=back_order/view_bo. The manipulation of the argument ID leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/th3w0lf-1337/Vulnerabilities/blob/main/SMS-PHP/SQLi/Back-Order/info.md; https://vuldb.com/?ctiid.309260; https://vuldb.com/?id.309260
CVE: CVE-2025-22233
Published: 2025-05-16
Description: CVE-2024-38820 ensured Locale-independent, lowercase conversion for both the configured disallowedFields patterns and for request parameter names. However, there are still cases where it is possible to bypass the disallowedFields checks.

Affected Spring Products and Versions

Spring Framework:
  *  6.2.0 - 6.2.6

  *  6.1.0 - 6.1.19

  *  6.0.0 - 6.0.27

  *  5.3.0 - 5.3.42
  *  Older, unsupported versions are also affected



Mitigation

Users of affected versions should upgrade to the corresponding fixed version.

Affected version(s)Fix Version Availability 6.2.x
 6.2.7
OSS6.1.x
 6.1.20
OSS6.0.x
 6.0.28
 Commercial https://enterprise.spring.io/ 5.3.x
 5.3.43
 Commercial https://enterprise.spring.io/ 
No further mitigation steps are necessary.


Generally, we recommend using a dedicated model object with properties only for data binding, or using constructor binding since constructor arguments explicitly declare what to bind together with turning off setter binding through the declarativeBinding flag. See the Model Design section in the reference documentation.

For setting binding, prefer the use of allowedFields (an explicit list) over disallowedFields.

Credit

This issue was responsibly reported by the TERASOLUNA Framework Development Team from NTT DATA Group Corporation.
CVSS Score: 3.1 (LOW)
CWE: CWE-20
References: https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N&version=3.1
CVE: CVE-2025-4802
Published: 2025-05-16
Description: Untrusted LD_LIBRARY_PATH environment variable vulnerability in the GNU C Library version 2.27 to 2.38 allows attacker controlled loading of dynamically shared library in statically compiled setuid binaries that call dlopen (including internal dlopen calls after setlocale or calls to NSS functions such as getaddrinfo).
CVSS Score: 7.8 (HIGH)
CWE: CWE-426
References: https://sourceware.org/bugzilla/show_bug.cgi?id=32976; https://sourceware.org/cgit/glibc/commit/?id=1e18586c5820e329f741d5c710275e165581380e; http://www.openwall.com/lists/oss-security/2025/05/16/7
CVE: CVE-2025-4807
Published: 2025-05-16
Description: A vulnerability, which was classified as problematic, was found in SourceCodester Online Student Clearance System 1.0. This affects an unknown part. The manipulation leads to exposure of information through directory listing. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-548, CWE-552, CWE-22
References: https://github.com/laifeng-boy/cve/issues/2; https://vuldb.com/?ctiid.309261; https://vuldb.com/?id.309261
CVE: CVE-2025-4808
Published: 2025-05-16
Description: A vulnerability was found in PHPGurukul Park Ticketing Management System 2.0 and classified as critical. This issue affects some unknown processing of the file /add-normal-ticket.php. The manipulation of the argument noadult/nochildren/aprice/cprice leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/f1rstb100d/myCVE/issues/11; https://phpgurukul.com/; https://vuldb.com/?ctiid.309263
CVE: CVE-2025-4809
Published: 2025-05-16
Description: A vulnerability was found in Tenda AC7 15.03.06.44. It has been classified as critical. Affected is the function fromSafeSetMacFilter of the file /goform/setMacFilterCfg. The manipulation of the argument deviceList leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-121, CWE-787
References: https://lavender-bicycle-a5a.notion.site/Tenda-AC7-fromSafeSetMacFilter-1ed53a41781f80cbbf13c8d4cc405ed1?pvs=4; https://vuldb.com/?ctiid.309264; https://vuldb.com/?id.309264
CVE: CVE-2022-4363
Published: 2025-05-16
Description: The Wholesale Market WordPress plugin before 2.2.2, Wholesale Market for WooCommerce WordPress plugin before 2.0.1 have a flawed CSRF check when updating their settings, which could allow attackers to make a logged in admin update them via a CSRF attack
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://wpscan.com/vulnerability/734dba0b-f550-4372-884a-d42f7b0c00c7/
CVE: CVE-2025-32407
Published: 2025-05-16
Description: Samsung Internet for Galaxy Watch version 5.0.9, available up until Samsung Galaxy Watch 3, does not properly validate TLS certificates, allowing for an attacker to impersonate any and all websites visited by the user. This is a critical misconfiguration in the way the browser validates the identity of the server. It negates the use of HTTPS as a secure channel, allowing for Man-in-the-Middle attacks, stealing sensitive information or modifying incoming and outgoing traffic. NOTE: This vulnerability is in an end-of-life product that is no longer maintained by the vendor.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-295
References: https://github.com/diegovargasj/CVE-2025-32407
CVE: CVE-2025-48188
Published: 2025-05-16
Description: libpspp-core.a in GNU PSPP through 2.0.1 has an incorrect call from fill_buffer (in data/encrypted-file.c) to the Gnulib rijndaelDecrypt function, leading to a heap-based buffer over-read.
CVSS Score: 2.9 (LOW)
CWE: CWE-125
References: https://savannah.gnu.org/bugs/?67079
CVE: CVE-2025-4804
Published: 2025-05-16
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS allows Stored XSS via the spamBlocker module. This vulnerability requires an authenticated administrator session to a locally managed Firebox.
This issue affects Fireware OS: from 12.0 through 12.11.1.
CWE: CWE-79
References: https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2025-00006