deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-13733
Published: 2025-02-04
Description: The SKT Blocks – Gutenberg based Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's skt-blocks/post-carousel block in all versions up to, and including, 1.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. CVE-2025-26771 is a duplicate of this issue.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/skt-blocks/trunk/src/blocks/post-carousel/index.php#L751; https://plugins.trac.wordpress.org/changeset/3233980/; https://wordpress.org/plugins/skt-blocks
CVE: CVE-2024-40890
Published: 2025-02-04
Description: **UNSUPPORTED WHEN ASSIGNED**
A post-authentication command injection vulnerability in the CGI program of the legacy DSL CPE Zyxel VMG4325-B10A firmware version 1.00(AAFR.4)C0_20170615 could allow an authenticated attacker to execute operating system (OS) commands on an affected device by sending a crafted HTTP POST request.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-command-injection-and-insecure-default-credentials-vulnerabilities-in-certain-legacy-dsl-cpe-02-04-2025; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-40890
CVE: CVE-2024-40891
Published: 2025-02-04
Description: **UNSUPPORTED WHEN ASSIGNED**
A post-authentication command injection vulnerability in the management commands of the legacy DSL CPE Zyxel VMG4325-B10A firmware version 1.00(AAFR.4)C0_20170615 could allow an authenticated attacker to execute operating system (OS) commands on an affected device via Telnet.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-command-injection-and-insecure-default-credentials-vulnerabilities-in-certain-legacy-dsl-cpe-02-04-2025; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-40891
CVE: CVE-2025-23015
Published: 2025-02-04
Description: Privilege Defined With Unsafe Actions vulnerability in Apache Cassandra. An user with MODIFY permission ON ALL KEYSPACES can escalate privileges to superuser within a targeted Cassandra cluster via unsafe actions to a system resource. Operators granting data MODIFY permission on all keyspaces on affected versions should review data access rules for potential breaches.

This issue affects Apache Cassandra through 3.0.30, 3.11.17, 4.0.15, 4.1.7, 5.0.2.

Users are recommended to upgrade to versions 3.0.31, 3.11.18, 4.0.16, 4.1.8, 5.0.3, which fixes the issue.
CVSS Score: 8.8 (HIGH)
CWE: CWE-267
References: https://lists.apache.org/thread/jmks4msbgkl65ssg69x728sv1m0hwz3s; http://www.openwall.com/lists/oss-security/2025/02/03/2; http://www.openwall.com/lists/oss-security/2025/02/11/1
CVE: CVE-2024-27137
Published: 2025-02-04
Description: In Apache Cassandra it is possible for a local attacker without access
 to the Apache Cassandra process or configuration files to manipulate 
the RMI registry to perform a man-in-the-middle attack and capture user 
names and passwords used to access the JMX interface. The attacker can 
then use these credentials to access the JMX interface and perform 
unauthorized operations.


This is same vulnerability that CVE-2020-13946 was issued for, but the Java option was changed in JDK10.


This issue affects Apache Cassandra from 4.0.2 through 5.0.2 running Java 11.


Operators are recommended to upgrade to a release equal to or later than 4.0.15, 4.1.8, or 5.0.3 which fixes the issue.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-287
References: https://lists.apache.org/thread/jsk87d9yv8r204mgqpz1qxtp5wcrpysm; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2025-0890
Published: 2025-02-04
Description: **UNSUPPORTED WHEN ASSIGNED**
Insecure default credentials for the Telnet function in the legacy DSL CPE Zyxel VMG4325-B10A firmware version 1.00(AAFR.4)C0_20170615 could allow an attacker to log in to the management interface if the administrators have the option to change the default credentials but fail to do so.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287, CWE-522
References: https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-command-injection-and-insecure-default-credentials-vulnerabilities-in-certain-legacy-dsl-cpe-02-04-2025
CVE: CVE-2025-24860
Published: 2025-02-04
Description: Incorrect Authorization vulnerability in Apache Cassandra allowing users to access a datacenter or IP/CIDR groups they should not be able to when using CassandraNetworkAuthorizer or CassandraCIDRAuthorizer.

Users with restricted data center access can update their own permissions via data control language (DCL) statements on affected versions.




This issue affects Apache Cassandra: from 4.0.0 through 4.0.15 and from 4.1.0 through 4.1.7 for CassandraNetworkAuthorizer, and from 5.0.0 through 5.0.2 for both CassandraNetworkAuthorizer and CassandraCIDRAuthorizer.




Operators using CassandraNetworkAuthorizer or CassandraCIDRAuthorizer on affected versions should review data access rules for potential breaches. Users are recommended to upgrade to versions 4.0.16, 4.1.8, 5.0.3, which fixes the issue.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-863
References: https://lists.apache.org/thread/yjo5on4tf7s1r9qklc4byrz30b8vkm2d; http://www.openwall.com/lists/oss-security/2025/02/03/3; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2024-13699
Published: 2025-02-04
Description: The Qi Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘cursor’ parameter in all versions up to, and including, 1.8.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vulnerability was partially patched in versions 1.8.5, 1.8.6, and 1.8.7.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/qi-addons-for-elementor/trunk/inc/shortcodes/typeout-text/class-qiaddonsforelementor-typeout-text-shortcode.php; https://plugins.trac.wordpress.org/changeset/3230342/; https://plugins.trac.wordpress.org/changeset/3231980/
CVE: CVE-2024-11623
Published: 2025-02-04
Description: Authentik project is vulnerable to Stored XSS attacks through uploading crafted SVG files that are used as application icons. 
This action could only be performed by an authenticated admin user.
The issue was fixed in 2024.10.4 release.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://cert.pl/en/posts/2025/02/CVE-2024-11623/; https://docs.goauthentik.io/docs/security/audits-and-certs/2024-11-cobalt#svg-images-for-icons-possible-xss-vulnerability; https://github.com/goauthentik/authentik/pull/12092
CVE: CVE-2025-0510
Published: 2025-02-04
Description: Thunderbird displayed an incorrect sender address if the From field of an email used the invalid group name syntax that is described in CVE-2024-49040. This vulnerability was fixed in Thunderbird 128.7 and Thunderbird 135.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-345
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1940570; https://www.mozilla.org/security/advisories/mfsa2025-10/; https://www.mozilla.org/security/advisories/mfsa2025-11/
CVE: CVE-2025-1009
Published: 2025-02-04
Description: An attacker could have caused a use-after-free via crafted XSLT data, leading to a potentially exploitable crash. This vulnerability was fixed in Firefox 135, Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 128.7, and Thunderbird 135.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-416, CWE-416
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1936613; https://www.mozilla.org/security/advisories/mfsa2025-07/; https://www.mozilla.org/security/advisories/mfsa2025-08/
CVE: CVE-2025-1010
Published: 2025-02-04
Description: An attacker could have caused a use-after-free via the Custom Highlight API, leading to a potentially exploitable crash. This vulnerability was fixed in Firefox 135, Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 128.7, and Thunderbird 135.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1936982; https://www.mozilla.org/security/advisories/mfsa2025-07/; https://www.mozilla.org/security/advisories/mfsa2025-08/
CVE: CVE-2025-1011
Published: 2025-02-04
Description: A bug in WebAssembly code generation could have lead to a crash. It may have been possible for an attacker to leverage this to achieve code execution. This vulnerability was fixed in Firefox 135, Firefox ESR 128.7, Thunderbird 128.7, and Thunderbird 135.
CVSS Score: 8.8 (HIGH)
CWE: CWE-94
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1936454; https://www.mozilla.org/security/advisories/mfsa2025-07/; https://www.mozilla.org/security/advisories/mfsa2025-09/
CVE: CVE-2025-1012
Published: 2025-02-04
Description: A race during concurrent delazification could have led to a use-after-free. This vulnerability was fixed in Firefox 135, Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 128.7, and Thunderbird 135.
CVSS Score: 7.5 (HIGH)
CWE: CWE-416, CWE-416
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1939710; https://www.mozilla.org/security/advisories/mfsa2025-07/; https://www.mozilla.org/security/advisories/mfsa2025-08/
CVE: CVE-2025-1013
Published: 2025-02-04
Description: A race condition could have led to private browsing tabs being opened in normal browsing windows. This could have resulted in a potential privacy leak. This vulnerability was fixed in Firefox 135, Firefox ESR 128.7, Thunderbird 128.7, and Thunderbird 135.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-362
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1932555; https://www.mozilla.org/security/advisories/mfsa2025-07/; https://www.mozilla.org/security/advisories/mfsa2025-09/
CVE: CVE-2025-1014
Published: 2025-02-04
Description: Certificate length was not properly checked when added to a certificate store. In practice only trusted data was processed. This vulnerability was fixed in Firefox 135, Firefox ESR 128.7, Thunderbird 128.7, and Thunderbird 135.
CVSS Score: 8.8 (HIGH)
CWE: CWE-295, CWE-295
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1940804; https://www.mozilla.org/security/advisories/mfsa2025-07/; https://www.mozilla.org/security/advisories/mfsa2025-09/
CVE: CVE-2025-1015
Published: 2025-02-04
Description: The Thunderbird Address Book URI fields contained unsanitized links. This could be used by an attacker to create and export an address book containing a malicious payload in a field. For example, in the “Other” field of the Instant Messaging section. If another user imported the address book, clicking on the link could result in opening a web page inside Thunderbird, and that page could execute (unprivileged) JavaScript. This vulnerability was fixed in Thunderbird 128.7 and Thunderbird 135.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1939458; https://www.mozilla.org/security/advisories/mfsa2025-10/; https://www.mozilla.org/security/advisories/mfsa2025-11/
CVE: CVE-2025-1016
Published: 2025-02-04
Description: Memory safety bugs present in Firefox 134, Thunderbird 134, Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19, and Thunderbird 128.6. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 135, Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 128.7, and Thunderbird 135.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://bugzilla.mozilla.org/buglist.cgi?bug_id=1936601%2C1936844%2C1937694%2C1938469%2C1939583%2C1940994; https://www.mozilla.org/security/advisories/mfsa2025-07/; https://www.mozilla.org/security/advisories/mfsa2025-08/
CVE: CVE-2025-1017
Published: 2025-02-04
Description: Memory safety bugs present in Firefox 134, Thunderbird 134, Firefox ESR 128.6, and Thunderbird 128.6. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 135, Firefox ESR 128.7, Thunderbird 128.7, and Thunderbird 135.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://bugzilla.mozilla.org/buglist.cgi?bug_id=1926256%2C1935984%2C1935471; https://www.mozilla.org/security/advisories/mfsa2025-07/; https://www.mozilla.org/security/advisories/mfsa2025-09/
CVE: CVE-2025-1018
Published: 2025-02-04
Description: The fullscreen notification is prematurely hidden when fullscreen is re-requested quickly by the user. This could have been leveraged to perform a potential spoofing attack. This vulnerability was fixed in Firefox 135 and Thunderbird 135.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-1021, CWE-1021
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1910818; https://www.mozilla.org/security/advisories/mfsa2025-07/; https://www.mozilla.org/security/advisories/mfsa2025-11/
CVE: CVE-2025-1019
Published: 2025-02-04
Description: The z-order of the browser windows could be manipulated to hide the fullscreen notification. This could potentially be leveraged to perform a spoofing attack. This vulnerability was fixed in Firefox 135 and Thunderbird 135.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-1021, CWE-1021
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1940162; https://www.mozilla.org/security/advisories/mfsa2025-07/; https://www.mozilla.org/security/advisories/mfsa2025-11/
CVE: CVE-2025-1020
Published: 2025-02-04
Description: Memory safety bugs present in Firefox 134 and Thunderbird 134. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 135 and Thunderbird 135.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://bugzilla.mozilla.org/buglist.cgi?bug_id=1939063%2C1942169; https://www.mozilla.org/security/advisories/mfsa2025-07/; https://www.mozilla.org/security/advisories/mfsa2025-11/
CVE: CVE-2024-23690
Published: 2025-02-04
Description: The end-of-life Netgear FVS336Gv2 and FVS336Gv3 are affected by a command injection vulnerability in the Telnet interface. An authenticated and remote attacker can execute arbitrary OS commands as root over Telnet by sending crafted "util backup_configuration" commands.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78
References: https://vulncheck.com/advisories/netgear-fvs336g-rce
CVE: CVE-2024-9643
Published: 2025-02-04
Description: The Four-Faith F3x36 router using firmware v2.0.0 is vulnerable to authentication bypass due to hard-coded credentials in the administrative web server. An attacker with knowledge of the credentials can gain administrative access via crafted HTTP requests. This issue appears similar to CVE-2023-32645.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-489, CWE-798, CWE-798
References: https://talosintelligence.com/vulnerability_reports/TALOS-2023-1752; https://vulncheck.com/advisories/four-faith-hard-coded-creds; https://talosintelligence.com/vulnerability_reports/TALOS-2023-1752
CVE: CVE-2024-9644
Published: 2025-02-04
Description: The Four-Faith F3x36 router using firmware v2.0.0 is vulnerable to an 
authentication bypass vulnerability in the administrative web server. Authentication is not enforced on some administrative functionality when using the "bapply.cgi" endpoint instead of the normal "apply.cgi" endpoint. A remote and unauthenticated can use this vulnerability to modify settings or chain with existing authenticated vulnerabilities.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306, CWE-489, CWE-306
References: https://vulncheck.com/advisories/four-faith-hidden-api
CVE: CVE-2025-0825
Published: 2025-02-04
Description: cpp-httplib version v0.17.3 through v0.18.3 fails to filter CRLF characters ("\r\n") when those are prefixed with a null byte. This enables attackers to exploit CRLF injection that could further lead to HTTP Response Splitting, XSS, and more.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-113
References: https://advisory.checkmarx.net/advisory/CVE-2025-0825/; https://github.com/yhirose/cpp-httplib/commit/9c36aae4b73e2b6e493f4133e4173103c9266289
CVE: CVE-2025-22206
Published: 2025-02-04
Description: A SQL injection vulnerability in the JS Jobs plugin versions 1.1.5-1.4.2 for Joomla allows authenticated attackers (administrator) to execute arbitrary SQL commands via the 'fieldfor' parameter in the GDPR Field feature.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://decrypt.locker/obtaining-my-first-cve/; https://joomsky.com/js-jobs-joomla/
CVE: CVE-2025-22641
Published: 2025-02-04
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Prem Tiwari FM Notification Bar fm-notification-bar allows Stored XSS.This issue affects FM Notification Bar: from n/a through <= 1.0.4.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/fm-notification-bar/vulnerability/wordpress-fm-notification-bar-plugin-1-0-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-22642
Published: 2025-02-04
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in rtowebsites Dynamic Conditions dynamicconditions allows Stored XSS.This issue affects Dynamic Conditions: from n/a through <= 1.7.4.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/dynamicconditions/vulnerability/wordpress-dynamic-conditions-plugin-1-7-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-22643
Published: 2025-02-04
Description: Missing Authorization vulnerability in famethemes OnePress onepress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects OnePress: from n/a through <= 2.3.11.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Theme/onepress/vulnerability/wordpress-onepress-theme-2-3-11-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-22653
Published: 2025-02-04
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tuyennv Music Press Pro music-press-pro allows Stored XSS.This issue affects Music Press Pro: from n/a through <= 1.4.6.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/music-press-pro/vulnerability/wordpress-music-press-pro-plugin-1-4-6-stored-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-22662
Published: 2025-02-04
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SendPulse SendPulse Email Marketing Newsletter sendpulse-email-marketing-newsletter allows Stored XSS.This issue affects SendPulse Email Marketing Newsletter: from n/a through <= 2.1.5.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/sendpulse-email-marketing-newsletter/vulnerability/wordpress-sendpulse-email-marketing-newsletter-plugin-2-1-5-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-22664
Published: 2025-02-04
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ays Pro Survey Maker survey-maker allows Stored XSS.This issue affects Survey Maker: from n/a through <= 5.1.3.5.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/survey-maker/vulnerability/wordpress-survey-maker-plugin-5-1-3-5-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-22674
Published: 2025-02-04
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Get Bowtied Product Blocks for WooCommerce product-blocks-for-woocommerce allows Stored XSS.This issue affects Product Blocks for WooCommerce: from n/a through <= 1.9.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/product-blocks-for-woocommerce/vulnerability/wordpress-product-blocks-for-woocommerce-plugin-1-9-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-22675
Published: 2025-02-04
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Alert Box Block – Display notice/alerts in the front end alert-box-block allows Stored XSS.This issue affects Alert Box Block – Display notice/alerts in the front end: from n/a through <= 1.1.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/alert-box-block/vulnerability/wordpress-alert-box-block-plugin-1-1-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-22696
Published: 2025-02-04
Description: Missing Authorization vulnerability in WPDeveloper Document Block – Upload & Embed Docs document.This issue affects Document Block – Upload & Embed Docs: from n/a through <= 1.1.0.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/document/vulnerability/wordpress-document-block-upload-embed-docs-pdf-ppt-xls-or-any-documents-plugin-1-1-0-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-22697
Published: 2025-02-04
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CyberChimps Responsive Blocks responsive-block-editor-addons allows Reflected XSS.This issue affects Responsive Blocks: from n/a through <= 1.9.9.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/responsive-block-editor-addons/vulnerability/wordpress-responsive-blocks-plugin-1-9-9-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-22699
Published: 2025-02-04
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in shinetheme Traveler Code traveler-code.This issue affects Traveler Code: from n/a through < 3.1.2.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/traveler-code/vulnerability/wordpress-traveler-code-plugin-3-1-0-unauthenticated-arbitrary-sql-execution-vulnerability?_s_id=cve
CVE: CVE-2025-22700
Published: 2025-02-04
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in shinetheme Traveler Code traveler-code.This issue affects Traveler Code: from n/a through < 3.1.3.
CVSS Score: 8.5 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/traveler-code/vulnerability/wordpress-traveler-code-plugin-3-1-0-subscriber-arbitrary-sql-execution-vulnerability?_s_id=cve
CVE: CVE-2025-22730
Published: 2025-02-04
Description: Missing Authorization vulnerability in ksher thailand Ksher ksher-payment allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ksher: from n/a through <= 1.1.2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/ksher-payment/vulnerability/wordpress-ksher-plugin-1-1-2-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-22794
Published: 2025-02-04
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ianhaycox World Cup Predictor world-cup-predictor allows Reflected XSS.This issue affects World Cup Predictor: from n/a through <= 1.9.8.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/world-cup-predictor/vulnerability/wordpress-world-cup-predictor-plugin-1-9-6-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve