deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-32261
Published: 2025-04-04
Description: Cross-Site Request Forgery (CSRF) vulnerability in Kuppuraj Advanced All in One Admin Search by WP Spotlight wp-spotlight-search allows Cross Site Request Forgery.This issue affects Advanced All in One Admin Search by WP Spotlight: from n/a through <= 1.1.1.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/wp-spotlight-search/vulnerability/wordpress-advanced-all-in-one-admin-search-by-wp-spotlight-1-1-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-32262
Published: 2025-04-04
Description: Cross-Site Request Forgery (CSRF) vulnerability in Robert D Payne RDP Wiki Embed rdp-wiki-embed allows Cross Site Request Forgery.This issue affects RDP Wiki Embed: from n/a through <= 1.2.20.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/rdp-wiki-embed/vulnerability/wordpress-rdp-wiki-embed-plugin-1-2-20-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-32263
Published: 2025-04-04
Description: Cross-Site Request Forgery (CSRF) vulnerability in BeRocket Sequential Order Numbers for WooCommerce sequential-order-numbers-for-woocommerce allows Cross Site Request Forgery.This issue affects Sequential Order Numbers for WooCommerce: from n/a through <= 3.6.2.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/sequential-order-numbers-for-woocommerce/vulnerability/wordpress-sequential-order-numbers-for-woocommerce-plugin-3-6-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-32264
Published: 2025-04-04
Description: Cross-Site Request Forgery (CSRF) vulnerability in Saiful Islam UltraAddons Elementor Lite ultraaddons-elementor-lite allows Cross Site Request Forgery.This issue affects UltraAddons Elementor Lite: from n/a through <= 2.0.2.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/ultraaddons-elementor-lite/vulnerability/wordpress-ultraaddons-elementor-addons-plugin-2-0-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-32265
Published: 2025-04-04
Description: Cross-Site Request Forgery (CSRF) vulnerability in Hossni Mubarak JobWP jobwp allows Cross Site Request Forgery.This issue affects JobWP: from n/a through <= 2.3.9.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/jobwp/vulnerability/wordpress-jobwp-plugin-2-3-9-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-32266
Published: 2025-04-04
Description: Cross-Site Request Forgery (CSRF) vulnerability in wp-buy 404 Image Redirection (Replace Broken Images) broken-images-redirection allows Cross Site Request Forgery.This issue affects 404 Image Redirection (Replace Broken Images): from n/a through <= 1.4.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/broken-images-redirection/vulnerability/wordpress-404-image-redirection-replace-broken-images-plugin-1-4-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-32267
Published: 2025-04-04
Description: Cross-Site Request Forgery (CSRF) vulnerability in wpzinc Post to Social Media – WordPress to Hootsuite wp-to-hootsuite allows Cross Site Request Forgery.This issue affects Post to Social Media – WordPress to Hootsuite: from n/a through <= 1.5.8.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/wp-to-hootsuite/vulnerability/wordpress-wp-to-hootsuite-plugin-1-5-8-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-32268
Published: 2025-04-04
Description: Cross-Site Request Forgery (CSRF) vulnerability in www.15.to QR Code Tag for WC qr-code-tag-for-wc-from-goaskle-com allows Cross Site Request Forgery.This issue affects QR Code Tag for WC: from n/a through <= 1.9.42.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/qr-code-tag-for-wc-from-goaskle-com/vulnerability/wordpress-qr-code-tag-for-wc-plugin-1-9-35-cross-site-request-forgery-csrf-to-settings-change-vulnerability?_s_id=cve
CVE: CVE-2025-32269
Published: 2025-04-04
Description: Cross-Site Request Forgery (CSRF) vulnerability in CRM Perks WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms cf7-zendesk allows Cross Site Request Forgery.This issue affects WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms: from n/a through <= 1.1.3.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/cf7-zendesk/vulnerability/wordpress-wp-zendesk-for-contact-form-7-wpforms-elementor-formidable-and-ninja-forms-plugin-1-1-3-cross-site-request-forgery-csrf-to-settings-change-vulnerability?_s_id=cve
CVE: CVE-2025-32270
Published: 2025-04-04
Description: Cross-Site Request Forgery (CSRF) vulnerability in Broadstreet Broadstreet Ads broadstreet allows Cross Site Request Forgery.This issue affects Broadstreet Ads: from n/a through <= 1.52.1.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/broadstreet/vulnerability/wordpress-broadstreet-plugin-1-51-1-cross-site-request-forgery-csrf-to-settings-change-vulnerability?_s_id=cve
CVE: CVE-2025-32271
Published: 2025-04-04
Description: Cross-Site Request Forgery (CSRF) vulnerability in ablancodev Woocommerce Role Pricing woocommerce-role-pricing allows Cross Site Request Forgery.This issue affects Woocommerce Role Pricing: from n/a through <= 3.5.6.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/woocommerce-role-pricing/vulnerability/wordpress-woocommerce-role-pricing-plugin-3-5-4-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-32272
Published: 2025-04-04
Description: Cross-Site Request Forgery (CSRF) vulnerability in PickPlugins Wishlist wishlist allows Cross Site Request Forgery.This issue affects Wishlist: from n/a through <= 1.0.46.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/wishlist/vulnerability/wordpress-wishlist-plugin-1-0-41-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-32273
Published: 2025-04-04
Description: Cross-Site Request Forgery (CSRF) vulnerability in freetobook Freetobook Responsive Widget freetobook-responsive-widget allows Cross Site Request Forgery.This issue affects Freetobook Responsive Widget: from n/a through <= 1.1.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/freetobook-responsive-widget/vulnerability/wordpress-freetobook-responsive-widget-plugin-1-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-32274
Published: 2025-04-04
Description: Cross-Site Request Forgery (CSRF) vulnerability in axew3 WP w3all phpBB wp-w3all-phpbb-integration allows Cross Site Request Forgery.This issue affects WP w3all phpBB: from n/a through <= 2.9.8.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/wp-w3all-phpbb-integration/vulnerability/wordpress-w3all-phpbb-integration-plugin-2-9-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-32276
Published: 2025-04-04
Description: Cross-Site Request Forgery (CSRF) vulnerability in Quý Lê 91 Administrator Z administrator-z allows Cross Site Request Forgery.This issue affects Administrator Z: from n/a through <= 2026.03.02.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/administrator-z/vulnerability/wordpress-administrator-z-plugin-2025-03-04-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-32277
Published: 2025-04-04
Description: Missing Authorization vulnerability in Ateeq Rafeeq RepairBuddy computer-repair-shop allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects RepairBuddy: from n/a through <= 3.8213.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/computer-repair-shop/vulnerability/wordpress-repairbuddy-plugin-3-8211-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-32278
Published: 2025-04-04
Description: Cross-Site Request Forgery (CSRF) vulnerability in wprio Table Block by RioVizual riovizual allows Cross Site Request Forgery.This issue affects Table Block by RioVizual: from n/a through <= 2.3.1.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/riovizual/vulnerability/wordpress-table-block-by-riovizual-plugin-2-1-7-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-32280
Published: 2025-04-04
Description: Cross-Site Request Forgery (CSRF) vulnerability in weDevs WP Project Manager wedevs-project-manager allows Cross Site Request Forgery.This issue affects WP Project Manager: from n/a through < 2.6.25.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/wedevs-project-manager/vulnerability/wordpress-wp-project-manager-plugin-2-6-22-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-3252
Published: 2025-04-04
Description: A vulnerability has been found in xujiangfei admintwo 1.0 and classified as problematic. This vulnerability affects unknown code of the file /resource/add. The manipulation of the argument Name leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94, CWE-79
References: https://github.com/caigo8/CVE-md/blob/main/admintwo/XSS2.md; https://vuldb.com/?ctiid.303322; https://vuldb.com/?id.303322
CVE: CVE-2025-3253
Published: 2025-04-04
Description: A vulnerability was found in xujiangfei admintwo 1.0 and classified as problematic. This issue affects some unknown processing of the file /ztree/insertTree. The manipulation of the argument Name leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94, CWE-79
References: https://github.com/caigo8/CVE-md/blob/main/admintwo/XSS3.md; https://vuldb.com/?ctiid.303323; https://vuldb.com/?id.303323
CVE: CVE-2025-3254
Published: 2025-04-04
Description: A vulnerability was found in xujiangfei admintwo 1.0. It has been classified as critical. Affected is an unknown function of the file /resource/add. The manipulation of the argument description leads to server-side request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-918
References: https://github.com/caigo8/CVE-md/blob/main/admintwo/SSRF.md; https://vuldb.com/?ctiid.303324; https://vuldb.com/?id.303324
CVE: CVE-2025-3255
Published: 2025-04-04
Description: A vulnerability was found in xujiangfei admintwo 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /user/home. The manipulation of the argument ID leads to improper access controls. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-266, CWE-284
References: https://github.com/caigo8/CVE-md/blob/main/admintwo/%E6%9C%AA%E6%8E%88%E6%9D%83%E7%94%A8%E6%88%B7%E4%BF%A1%E6%81%AF%E9%81%8D%E5%8E%86.md; https://vuldb.com/?ctiid.303325; https://vuldb.com/?id.303325
CVE: CVE-2025-3256
Published: 2025-04-04
Description: A vulnerability was found in xujiangfei admintwo 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /user/updateSet. The manipulation of the argument email leads to improper access controls. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-266, CWE-284
References: https://github.com/caigo8/CVE-md/blob/main/admintwo/%E6%B0%B4%E5%B9%B3%E8%B6%8A%E6%9D%83.md; https://vuldb.com/?ctiid.303326; https://vuldb.com/?id.303326
CVE: CVE-2025-3257
Published: 2025-04-04
Description: A vulnerability classified as problematic has been found in xujiangfei admintwo 1.0. This affects an unknown part of the file /user/updateSet. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352, CWE-862, CWE-352
References: https://github.com/caigo8/CVE-md/blob/main/admintwo/CSRF.md; https://vuldb.com/?ctiid.303327; https://vuldb.com/?id.303327
CVE: CVE-2025-3258
Published: 2025-04-04
Description: A vulnerability classified as critical was found in PHPGurukul Old Age Home Management System 1.0. This vulnerability affects unknown code of the file /search.php. The manipulation of the argument searchdata leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/404heihei/CVE/issues/2; https://phpgurukul.com/; https://vuldb.com/?ctiid.303328
CVE: CVE-2024-11235
Published: 2025-04-04
Description: In PHP versions 8.3.* before 8.3.19 and 8.4.* before 8.4.5, a code sequence involving __set handler or ??=  operator and exceptions can lead to a use-after-free vulnerability. If the third party can control the memory layout leading to this, for example by supplying specially crafted inputs to the script, it could lead to remote code execution.
CVSS Score: 8.1 (HIGH)
CWE: CWE-416, CWE-416
References: https://github.com/php/php-src/security/advisories/GHSA-rwp7-7vc6-8477; https://github.com/php/php-src/security/advisories/GHSA-rwp7-7vc6-8477
CVE: CVE-2025-29476
Published: 2025-04-04
Description: Buffer Overflow vulnerability in compress_chunk_fuzzer with oss-fuzz on commit 16450518afddcb3139de627157208e49bfef6987 in c-blosc2 v.2.17.0 and before.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-120
References: https://github.com/Blosc/c-blosc2/issues/656; https://github.com/lmarch2/poc/blob/main/c-blosk2/c-blosk2.md
CVE: CVE-2025-29477
Published: 2025-04-04
Description: An issue in fluent-bit v.3.7.2 allows a local attacker to cause a denial of service via the function consume_event.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-400
References: https://github.com/lmarch2/poc/blob/main/fluent-bit/fluent-bit.md
CVE: CVE-2025-3259
Published: 2025-04-04
Description: A vulnerability, which was classified as critical, has been found in Tenda RX3 16.03.13.11. This issue affects the function formSetDeviceName of the file /goform/SetOnlineDevName. The manipulation of the argument devName leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-121, CWE-787
References: https://sixth-action-50e.notion.site/Tenda-RX3-Buffer-Overflow-1c9f[PII_REDACTED]a2977cd6c3a81f453c?pvs=4; https://vuldb.com/?ctiid.303329; https://vuldb.com/?id.303329
CVE: CVE-2025-3265
Published: 2025-04-04
Description: A vulnerability classified as critical was found in PHPGurukul e-Diary Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /add-category.php. The manipulation of the argument Category leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/yasuoz99/CVE-/issues/2; https://phpgurukul.com/; https://vuldb.com/?ctiid.303337
CVE: CVE-2025-3266
Published: 2025-04-04
Description: A vulnerability, which was classified as critical, has been found in qinguoyi TinyWebServer up to 1.0. Affected by this issue is some unknown functionality of the file /http/http_conn.cpp. The manipulation of the argument name/password leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-119, CWE-121, CWE-787
References: https://magnificent-dill-351.notion.site/Stack-Overflow-in-TinyWebServer-1-0-1c9c693918ed80229bbce911b3513054; https://vuldb.com/?ctiid.303338; https://vuldb.com/?id.303338
CVE: CVE-2025-3267
Published: 2025-04-04
Description: A vulnerability, which was classified as critical, was found in qinguoyi TinyWebServer up to 1.0. This affects an unknown part of the file /http/http_conn.cpp. The manipulation of the argument name/password leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://magnificent-dill-351.notion.site/SQL-Injection-in-TinyWebServer-1-0-1c9c693918ed800ba172f[PII_REDACTED]5; https://vuldb.com/?ctiid.303339; https://vuldb.com/?id.303339
CVE: CVE-2025-3268
Published: 2025-04-04
Description: A vulnerability has been found in qinguoyi TinyWebServer up to 1.0 and classified as critical. This vulnerability affects unknown code of the file http/http_conn.cpp. The manipulation of the argument m_url_real leads to improper authentication. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-287
References: https://magnificent-dill-351.notion.site/Improper-Authentication-in-TinyWebServer-1-0-1c9c693918ed80cfa0f5db1a1d03c5e7; https://vuldb.com/?ctiid.303340; https://vuldb.com/?id.303340
CVE: CVE-2025-2889
Published: 2025-04-05
Description: The Link Library plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Link Additional Parameters in all versions up to, and including, 7.7.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/link-library/tags/7.7.3/link-library-admin.php#L7610; https://www.wordfence.com/threat-intel/vulnerabilities/id/0881efbe-9b47-4b56-be2d-12258460b429?source=cve
CVE: CVE-2025-1500
Published: 2025-04-05
Description: IBM Maximo Application Suite 9.0 could allow an authenticated user to upload a file with dangerous types that could be executed by another user if opened.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-434
References: https://www.ibm.com/support/pages/node/7230140
CVE: CVE-2024-13604
Published: 2025-04-05
Description: The KB Support – Customer Support Ticket & Helpdesk Plugin, Knowledge Base Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.7.4 via the 'kbs' directory. This makes it possible for unauthenticated attackers to extract sensitive data stored insecurely in the /wp-content/uploads/kbs directory which can contain file attachments included in support tickets. The vulnerability was partially patched in version 1.7.3.2.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://plugins.trac.wordpress.org/browser/kb-support/trunk/includes/files.php; https://plugins.trac.wordpress.org/changeset/3231596/; https://www.wordfence.com/threat-intel/vulnerabilities/id/b3a058d6-ca9e-4241-b6dd-307efa7689ab?source=cve
CVE: CVE-2025-0810
Published: 2025-04-05
Description: The Read More & Accordion plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.4.7. This is due to missing or incorrect nonce validation on the addNewButtons() function. This makes it possible for unauthenticated attackers to include and execute arbitrary PHP files via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 7.5 (HIGH)
CWE: CWE-352
References: https://plugins.trac.wordpress.org/browser/expand-maker/trunk/classes/ReadMoreInit.php#L122; https://plugins.trac.wordpress.org/browser/expand-maker/trunk/classes/ReadMorePages.php#L59; https://plugins.trac.wordpress.org/browser/expand-maker/trunk/classes/ReadMorePages.php#L82
CVE: CVE-2025-2544
Published: 2025-04-05
Description: The AI Content Pipelines plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/ai-content-pipelines/tags/1.6/includes/generate-scheduled-content.php#L42; https://plugins.trac.wordpress.org/browser/ai-content-pipelines/tags/1.6/includes/generate-scheduled-content.php#L44; https://plugins.trac.wordpress.org/browser/ai-content-pipelines/tags/1.6/includes/generate-scheduled-content.php#L47
CVE: CVE-2025-2933
Published: 2025-04-05
Description: The Email Notifications for Updates plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the awun_import_settings() function in all versions up to, and including, 1.1.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site. CVE-2025-26741 is likely a duplicate of this issue.
CVSS Score: 8.8 (HIGH)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3265589%40wp-update-mail-notification&new=3265589%40wp-update-mail-notification; https://www.wordfence.com/threat-intel/vulnerabilities/id/d52e644b-a58f-4e09-9e53-e9cbef75e34f?source=cve
CVE: CVE-2021-47667
Published: 2025-04-05
Description: An OS command injection vulnerability in lib/NSSDropoff.php in ZendTo 5.24-3 through 6.x before 6.10-7 allows unauthenticated remote attackers to execute arbitrary commands via shell metacharacters in the tmp_name parameter when dropping off a file via a POST /dropoff request.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-78
References: https://projectblack.io/blog/zendto-nday-vulnerabilities/; https://projectblack.io/blog/zendto-nday-vulnerabilities/
CVE: CVE-2025-32352
Published: 2025-04-05
Description: A type confusion vulnerability in lib/NSSAuthenticator.php in ZendTo before v5.04-7 allows remote attackers to bypass authentication for users with passwords stored as MD5 hashes that can be interpreted as numbers. A solution requires moving from MD5 to bcrypt.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-843
References: https://projectblack.io/blog/zendto-nday-vulnerabilities/; https://projectblack.io/blog/zendto-nday-vulnerabilities/
CVE: CVE-2024-13776
Published: 2025-04-05
Description: The ZoomSounds - WordPress Wave Audio Player with Playlist plugin for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to a missing capability check on the 'dzsap_delete_notice' AJAX action in all versions up to, and including, 6.91. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update option values to 'seen' on the WordPress site. This can be leveraged to update an option that would create an error on the site and deny service to legitimate users or be used to set some values to true such as registration. There are several other functions also vulnerable to missing authorization.
CVSS Score: 8.1 (HIGH)
CWE: CWE-862
References: https://codecanyon.net/item/zoomsounds-wordpress-wave-audio-player-with-playlist/6181433; https://www.wordfence.com/threat-intel/vulnerabilities/id/0c8e538b-7157-42d3-abee-8259c6715cd5?source=cve