deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-22003
Published: 2025-04-03
Description: In the Linux kernel, the following vulnerability has been resolved:

can: ucan: fix out of bound read in strscpy() source

Commit 7fdaf8966aae ("can: ucan: use strscpy() to instead of strncpy()")
unintentionally introduced a one byte out of bound read on strscpy()'s
source argument (which is kind of ironic knowing that strscpy() is meant
to be a more secure alternative :)).

Let's consider below buffers:

  dest[len + 1]; /* will be NUL terminated */
  src[len]; /* may not be NUL terminated */

When doing:

  strncpy(dest, src, len);
  dest[len] = '\0';

strncpy() will read up to len bytes from src.

On the other hand:

  strscpy(dest, src, len + 1);

will read up to len + 1 bytes from src, that is to say, an out of bound
read of one byte will occur on src if it is not NUL terminated. Note
that the src[len] byte is never copied, but strscpy() still needs to
read it to check whether a truncation occurred or not.

This exact pattern happened in ucan.

The root cause is that the source is not NUL terminated. Instead of
doing a copy in a local buffer, directly NUL terminate it as soon as
usb_control_msg() returns. With this, the local firmware_str[] variable
can be removed.

On top of this do a couple refactors:

  - ucan_ctl_payload->raw is only used for the firmware string, so
    rename it to ucan_ctl_payload->fw_str and change its type from u8 to
    char.

  - ucan_device_request_in() is only used to retrieve the firmware
    string, so rename it to ucan_get_fw_str() and refactor it to make it
    directly handle all the string termination logic.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://git.kernel.org/stable/c/1d22a122ffb116c3cf78053e812b8b21f8852ee9; https://git.kernel.org/stable/c/8cec9e314d3360fc1d8346297c41a6ee45cb45a9; https://git.kernel.org/stable/c/a4994161a61bc8fd71d105c579d847cefee99262
CVE: CVE-2025-22004
Published: 2025-04-03
Description: In the Linux kernel, the following vulnerability has been resolved:

net: atm: fix use after free in lec_send()

The ->send() operation frees skb so save the length before calling
->send() to avoid a use after free.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://git.kernel.org/stable/c/326223182e4703cde99fdbd36d07d0b3de9980fb; https://git.kernel.org/stable/c/50e288097c2c6e5f374ae079394436fc29d1e88e; https://git.kernel.org/stable/c/51e8be9578a2e74f9983d8fd8de8cafed191f30c
CVE: CVE-2025-22005
Published: 2025-04-03
Description: In the Linux kernel, the following vulnerability has been resolved:

ipv6: Fix memleak of nhc_pcpu_rth_output in fib_check_nh_v6_gw().

fib_check_nh_v6_gw() expects that fib6_nh_init() cleans up everything
when it fails.

Commit 7dd73168e273 ("ipv6: Always allocate pcpu memory in a fib6_nh")
moved fib_nh_common_init() before alloc_percpu_gfp() within fib6_nh_init()
but forgot to add cleanup for fib6_nh->nh_common.nhc_pcpu_rth_output in
case it fails to allocate fib6_nh->rt6i_pcpu, resulting in memleak.

Let's call fib_nh_common_release() and clear nhc_pcpu_rth_output in the
error path.

Note that we can remove the fib6_nh_release() call in nh_create_ipv6()
later in net-next.git.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401, CWE-401
References: https://git.kernel.org/stable/c/119dcafe36795a15ae53351cbbd6177aaf94ffef; https://git.kernel.org/stable/c/16267a5036173d[PII_REDACTED]b4b6021b081d0933; https://git.kernel.org/stable/c/1bd12dfc058e1e68759d313d7727d68dbc1b8964
CVE: CVE-2025-22006
Published: 2025-04-03
Description: In the Linux kernel, the following vulnerability has been resolved:

net: ethernet: ti: am65-cpsw: Fix NAPI registration sequence

Registering the interrupts for TX or RX DMA Channels prior to registering
their respective NAPI callbacks can result in a NULL pointer dereference.
This is seen in practice as a random occurrence since it depends on the
randomness associated with the generation of traffic by Linux and the
reception of traffic from the wire.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://git.kernel.org/stable/c/5f079290e5913a0060e059500b7d440990ac1066; https://git.kernel.org/stable/c/942557abed7f38b77a47d77b92d448802eefe185; https://git.kernel.org/stable/c/d4bf956547c38c04fad8d72a961ac4dc00bad000
CVE: CVE-2025-22007
Published: 2025-04-03
Description: In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: Fix error code in chan_alloc_skb_cb()

The chan_alloc_skb_cb() function is supposed to return error pointers on
error.  Returning NULL will lead to a NULL dereference.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://git.kernel.org/stable/c/1bd68db7beb426ab5a45d81516ed9611284affc8; https://git.kernel.org/stable/c/72d061ee630d0dbb45c2920d8d19b3861c413e54; https://git.kernel.org/stable/c/761b7c36addd22c7e6ceb05caaadc3b062d99faa
CVE: CVE-2025-2874
Published: 2025-04-03
Description: The User Submitted Posts – Enable Users to Submit Posts from the Front End plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 20240319 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3263067%40user-submitted-posts&new=3263067%40user-submitted-posts&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/8b212a1a-0e2b-4327-93b5-398bd7a36b5c?source=cve
CVE: CVE-2025-3149
Published: 2025-04-03
Description: A vulnerability was found in itning Student Homework Management System up to 1.2.7. It has been classified as problematic. Affected is an unknown function of the file /shw_war/fileupload of the component Edit Job Page. The manipulation of the argument Course leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
CVSS Score: 2.4 (LOW)
CWE: CWE-79, CWE-94, CWE-79
References: https://gitee.com/nwtmd5/cve/issues/IBVLXL; https://vuldb.com/?ctiid.303054; https://vuldb.com/?id.303054
CVE: CVE-2025-3150
Published: 2025-04-03
Description: A vulnerability was found in itning Student Homework Management System up to 1.2.7. It has been declared as problematic. Affected by this vulnerability is an unknown functionality. The manipulation leads to cross-site request forgery. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Multiple endpoints might be affected.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352, CWE-862
References: https://gitee.com/nwtmd5/cve/issues/IBVLYH; https://vuldb.com/?ctiid.303055; https://vuldb.com/?id.303055
CVE: CVE-2025-3151
Published: 2025-04-03
Description: A vulnerability was found in SourceCodester Gym Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /signup.php. The manipulation of the argument user_name leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/MiniSweetBeen/src/issues/5; https://vuldb.com/?ctiid.303056; https://vuldb.com/?id.303056
CVE: CVE-2025-3152
Published: 2025-04-03
Description: A vulnerability classified as problematic has been found in caipeichao ThinkOX 1.0. This affects an unknown part of the file /ThinkOX-master/index.php?s=/Weibo/Index/search.html of the component Search. The manipulation of the argument keywords leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94
References: https://github.com/dtwin88/cve-md/blob/main/ThinkOX1.0/ThinkOX1.0.md; https://vuldb.com/?ctiid.303057; https://vuldb.com/?id.303057
CVE: CVE-2024-53868
Published: 2025-04-03
Description: Apache Traffic Server allows request smuggling if chunked messages are malformed. 





This issue affects Apache Traffic Server: from 9.2.0 through 9.2.9, from 10.0.0 through 10.0.4.

Users are recommended to upgrade to version 9.2.10 or 10.0.5, which fixes the issue.
CVSS Score: 7.5 (HIGH)
CWE: CWE-444
References: https://lists.apache.org/thread/rwyx91rsrnmpjbm04footfjjf6m9d1c9; http://www.openwall.com/lists/oss-security/2025/04/02/4
CVE: CVE-2025-2299
Published: 2025-04-03
Description: The LuckyWP Table of Contents plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1.10. This is due to missing or incorrect nonce validation on the 'ajaxEdit' function. This makes it possible for unauthenticated attackers to inject arbitrary web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-352
References: https://plugins.trac.wordpress.org/browser/luckywp-table-of-contents/trunk/admin/controllers/EditorBlockController.php#L30; https://plugins.trac.wordpress.org/browser/luckywp-table-of-contents/trunk/admin/widgets/customizeSuccess/views/widget.php#L12; https://plugins.trac.wordpress.org/changeset/3265169/
CVE: CVE-2024-9416
Published: 2025-04-03
Description: The Modula Image Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's bundled FancyBox JavaScript library (versions <= 5.0.36) due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset/3160235/modula-best-grid-gallery; https://www.wordfence.com/threat-intel/vulnerabilities/id/1954040c-2188-48b7-9f21-9a0c851c9165?source=cve
CVE: CVE-2025-22927
Published: 2025-04-03
Description: An issue in OS4ED openSIS v8.0 through v9.1 allows attackers to execute a directory traversal by sending a crafted POST request to /Modules.php?modname=messaging/Inbox.php&modfunc=save&filename.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-22
References: https://github.com/OS4ED/openSIS-Classic; https://github.com/esusalla/vulnerability-research/tree/main/CVE-2025-22927
CVE: CVE-2025-22928
Published: 2025-04-03
Description: OS4ED openSIS v7.0 to v9.1 was discovered to contain a SQL injection vulnerability via the cp_id parameter at /modules/messages/Inbox.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/OS4ED/openSIS-Classic; https://github.com/esusalla/vulnerability-research/tree/main/CVE-2025-22928
CVE: CVE-2025-2945
Published: 2025-04-03
Description: Remote Code Execution security vulnerability in pgAdmin 4  (Query Tool and Cloud Deployment modules).

The vulnerability is associated with the 2 POST endpoints; /sqleditor/query_tool/download, where the query_commited parameter and /cloud/deploy endpoint, where the high_availability parameter is unsafely passed to the Python eval() function, allowing arbitrary code execution.


This issue affects pgAdmin 4: before 9.2.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-94
References: https://github.com/pgadmin-org/pgadmin4/issues/8603
CVE: CVE-2025-2946
Published: 2025-04-03
Description: pgAdmin <= 9.1 is affected by a security vulnerability with Cross-Site Scripting(XSS). If attackers execute any arbitrary HTML/JavaScript in a user's browser through query result rendering, then HTML/JavaScript runs on the browser.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-79
References: https://github.com/pgadmin-org/pgadmin4/issues/8602
CVE: CVE-2025-22926
Published: 2025-04-03
Description: An issue in OS4ED openSIS v8.0 through v9.1 allows attackers to execute a directory traversal by sending a crafted POST request to /Modules.php?modname=messaging/Inbox.php&modfunc=save&filename.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22
References: https://github.com/OS4ED/openSIS-Classic; https://github.com/esusalla/vulnerability-research/tree/main/CVE-2025-22926
CVE: CVE-2025-22929
Published: 2025-04-03
Description: OS4ED openSIS v7.0 to v9.1 was discovered to contain a SQL injection vulnerability via the filter_id parameter at /students/StudentFilters.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/OS4ED/openSIS-Classic; https://github.com/esusalla/vulnerability-research/tree/main/CVE-2025-22929
CVE: CVE-2025-22930
Published: 2025-04-03
Description: OS4ED openSIS v7.0 to v9.1 was discovered to contain a SQL injection vulnerability via the groupid parameter at /messaging/Group.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/OS4ED/openSIS-Classic; https://github.com/esusalla/vulnerability-research/tree/main/CVE-2025-22930
CVE: CVE-2025-22931
Published: 2025-04-03
Description: An insecure direct object reference (IDOR) in the component /assets/stafffiles of OS4ED openSIS v7.0 to v9.1 allows unauthenticated attackers to access files uploaded by staff members.
CVSS Score: 7.5 (HIGH)
CWE: CWE-639
References: https://github.com/OS4ED/openSIS-Classic; https://github.com/esusalla/vulnerability-research/tree/main/CVE-2025-22931
CVE: CVE-2025-29369
Published: 2025-04-03
Description: Code-Projects Matrimonial Site V1.0 is vulnerable to SQL Injection in /view_profile.php?id=1.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://code-projects.org/matrimonial-site-in-php-with-source-code/; https://github.com/sqs404/tesc
CVE: CVE-2025-30596
Published: 2025-04-03
Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in tstafford include-file include-file allows Path Traversal.This issue affects include-file: from n/a through <= 1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://patchstack.com/database/Wordpress/Plugin/include-file/vulnerability/wordpress-include-file-1-arbitrary-file-download-vulnerability?_s_id=cve
CVE: CVE-2025-30611
Published: 2025-04-03
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wptobe Wptobe-signinup wptobe-signinup allows Reflected XSS.This issue affects Wptobe-signinup: from n/a through <= 1.1.2.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wptobe-signinup/vulnerability/wordpress-wptobe-signinup-plugin-1-1-2-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-30616
Published: 2025-04-03
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Wood Latest Custom Post Type Updates latest-custom-post-type-updates allows Reflected XSS.This issue affects Latest Custom Post Type Updates: from n/a through <= 1.3.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/latest-custom-post-type-updates/vulnerability/wordpress-latest-custom-post-type-updates-plugin-1-3-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-30858
Published: 2025-04-03
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tribulant Software Snow Storm snow-storm allows Reflected XSS.This issue affects Snow Storm: from n/a through <= 1.4.6.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/snow-storm/vulnerability/wordpress-snow-storm-plugin-1-4-6-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-30889
Published: 2025-04-03
Description: Deserialization of Untrusted Data vulnerability in PickPlugins Testimonial Slider testimonial allows Object Injection.This issue affects Testimonial Slider: from n/a through <= 2.0.13.
CVSS Score: 8.8 (HIGH)
CWE: CWE-502
References: https://patchstack.com/database/Wordpress/Plugin/testimonial/vulnerability/wordpress-testimonial-slider-plugin-2-0-13-php-object-injection-vulnerability?_s_id=cve
CVE: CVE-2025-30908
Published: 2025-04-03
Description: Cross-Site Request Forgery (CSRF) vulnerability in Shamalli Web Directory Free web-directory-free allows Stored XSS.This issue affects Web Directory Free: from n/a through <= 1.7.6.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/web-directory-free/vulnerability/wordpress-web-directory-free-plugin-1-7-6-csrf-to-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-30915
Published: 2025-04-03
Description: Missing Authorization vulnerability in enituretechnology Small Package Quotes – Worldwide Express Edition small-package-quotes-wwe-edition allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Small Package Quotes – Worldwide Express Edition: from n/a through <= 5.2.19.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/small-package-quotes-wwe-edition/vulnerability/wordpress-small-package-quotes-worldwide-express-edition-plugin-5-2-19-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-30916
Published: 2025-04-03
Description: Missing Authorization vulnerability in enituretechnology Residential Address Detection residential-address-detection allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Residential Address Detection: from n/a through <= 2.5.4.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/residential-address-detection/vulnerability/wordpress-residential-address-detection-plugin-2-5-4-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-31091
Published: 2025-04-03
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CreativeMindsSolutions CM Header and Footer cm-header-footer-script-loader allows Stored XSS.This issue affects CM Header and Footer: from n/a through <= 1.2.4.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/cm-header-footer-script-loader/vulnerability/wordpress-cm-header-and-footer-1-2-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-31098
Published: 2025-04-03
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in debounce DeBounce Email Validator debounce-io-email-validator allows PHP Local File Inclusion.This issue affects DeBounce Email Validator: from n/a through <= 5.7.
CVSS Score: 7.5 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Plugin/debounce-io-email-validator/vulnerability/wordpress-debounce-email-validator-5-7-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-31436
Published: 2025-04-03
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Angelo Mandato Blubrry PowerPress Podcasting plugin MultiSite add-on powerpress-multisite allows Reflected XSS.This issue affects Blubrry PowerPress Podcasting plugin MultiSite add-on: from n/a through <= 0.1.1.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/powerpress-multisite/vulnerability/wordpress-blubrry-powerpress-podcasting-plugin-multisite-add-on-plugin-0-1-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-31442
Published: 2025-04-03
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e1tekoap42 Search engine keywords highlighter keywords-highlight-tool allows Reflected XSS.This issue affects Search engine keywords highlighter: from n/a through <= 0.1.3.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/keywords-highlight-tool/vulnerability/wordpress-search-engine-keywords-highlighter-plugin-0-1-3-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-31467
Published: 2025-04-03
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in miro.mannino Flickr Photostream flickr-photostream allows Reflected XSS.This issue affects Flickr Photostream: from n/a through <= 3.1.8.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/flickr-photostream/vulnerability/wordpress-flickr-photostream-plugin-3-1-8-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-31468
Published: 2025-04-03
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in scottsm WP_Identicon wp-identicon allows Reflected XSS.This issue affects WP_Identicon: from n/a through <= 2.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wp-identicon/vulnerability/wordpress-wp-identicon-plugin-2-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-31536
Published: 2025-04-03
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in moshensky CF7 Spreadsheets cf7-spreadsheets allows Reflected XSS.This issue affects CF7 Spreadsheets: from n/a through <= 2.3.2.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/cf7-spreadsheets/vulnerability/wordpress-cf7-spreadsheets-plugin-2-3-2-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-31541
Published: 2025-04-03
Description: Missing Authorization vulnerability in TuriTop TuriTop Booking System turitop-booking-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects TuriTop Booking System: from n/a through <= 1.0.10.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/turitop-booking-system/vulnerability/wordpress-turitop-booking-system-plugin-1-0-10-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-31554
Published: 2025-04-03
Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in docxpresso Docxpresso docxpresso allows Absolute Path Traversal.This issue affects Docxpresso: from n/a through <= 2.6.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-22
References: https://patchstack.com/database/Wordpress/Plugin/docxpresso/vulnerability/wordpress-docxpresso-plugin-2-6-arbitrary-file-download-vulnerability?_s_id=cve
CVE: CVE-2025-31558
Published: 2025-04-03
Description: Insertion of Sensitive Information into Externally-Accessible File or Directory vulnerability in Greg TailPress tailpress allows Retrieve Embedded Sensitive Data.This issue affects TailPress: from n/a through <= 0.4.4.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-538
References: https://patchstack.com/database/Wordpress/Plugin/tailpress/vulnerability/wordpress-tailpress-plugin-0-4-4-sensitive-data-exposure-vulnerability?_s_id=cve
CVE: CVE-2025-31573
Published: 2025-04-03
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pepro Dev. Group PeproDev CF7 Database pepro-cf7-database allows Stored XSS.This issue affects PeproDev CF7 Database: from n/a through <= 2.0.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/pepro-cf7-database/vulnerability/wordpress-peprodev-cf7-database-plugin-2-0-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-31581
Published: 2025-04-03
Description: Missing Authorization vulnerability in Sandeep Kumar WP Video Playlist wp-video-playlist allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Video Playlist: from n/a through <= 1.1.2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/wp-video-playlist/vulnerability/wordpress-wp-video-playlist-plugin-1-1-2-settings-change-vulnerability?_s_id=cve