deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-0399
Published: 2025-01-12
Description: A vulnerability was found in StarSea99 starsea-mall 1.0. It has been declared as critical. This vulnerability affects the function UploadController of the file src/main/java/com/siro/mall/controller/common/uploadController.java. The manipulation of the argument file leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-284, CWE-434
References: https://github.com/StarSea99/starsea-mall/issues/3; https://github.com/StarSea99/starsea-mall/issues/3#issue[PII_REDACTED]; https://vuldb.com/?ctiid.291274
CVE: CVE-2025-0400
Published: 2025-01-12
Description: A vulnerability was found in StarSea99 starsea-mall 1.0. It has been rated as problematic. This issue affects some unknown processing of the file /admin/categories/update. The manipulation of the argument categoryName leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 2.4 (LOW)
CWE: CWE-79, CWE-94
References: https://github.com/StarSea99/starsea-mall/issues/5; https://github.com/StarSea99/starsea-mall/issues/5#issue[PII_REDACTED]; https://vuldb.com/?ctiid.291275
CVE: CVE-2025-0401
Published: 2025-01-13
Description: A vulnerability classified as critical has been found in[PII_REDACTED] reggie 1.0. Affected is the function download of the file src/main/java/com/itheima/reggie/controller/CommonController.java. The manipulation of the argument name leads to path traversal. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-22
References: https://github.com/[PII_REDACTED]/reggie/issues/1; https://github.com/[PII_REDACTED]/reggie/issues/1#issue[PII_REDACTED]; https://vuldb.com/?ctiid.291276
CVE: CVE-2025-0402
Published: 2025-01-13
Description: A vulnerability classified as critical was found in[PII_REDACTED] reggie 1.0. Affected by this vulnerability is the function upload of the file src/main/java/com/itheima/reggie/controller/CommonController.java. The manipulation of the argument file leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-284, CWE-434
References: https://github.com/[PII_REDACTED]/reggie/issues/2; https://github.com/[PII_REDACTED]/reggie/issues/2#issue[PII_REDACTED]; https://vuldb.com/?ctiid.291277
CVE: CVE-2025-0403
Published: 2025-01-13
Description: A vulnerability, which was classified as problematic, has been found in[PII_REDACTED] reggie 1.0. Affected by this issue is some unknown functionality of the file /user/sendMsg of the component Phone Number Validation Handler. The manipulation of the argument code leads to information disclosure. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200, CWE-284
References: https://github.com/[PII_REDACTED]/reggie/issues/3; https://github.com/[PII_REDACTED]/reggie/issues/3#issue[PII_REDACTED]; https://vuldb.com/?ctiid.291278
CVE: CVE-2025-0404
Published: 2025-01-13
Description: A vulnerability has been found in liujianview gymxmjpa 1.0 and classified as critical. This vulnerability affects the function CoachController of the file src/main/java/com/liujian/gymxmjpa/controller/CoachController.java. The manipulation of the argument coachName leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://github.com/liujianview/gymxmjpa/issues/2; https://github.com/liujianview/gymxmjpa/issues/2#issue[PII_REDACTED]; https://vuldb.com/?ctiid.291280
CVE: CVE-2025-0405
Published: 2025-01-13
Description: A vulnerability was found in liujianview gymxmjpa 1.0 and classified as critical. This issue affects the function GoodsDaoImpl of the file src/main/java/com/liujian/gymxmjpa/controller/GoodsController.java. The manipulation of the argument goodsName leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/liujianview/gymxmjpa/issues/3; https://github.com/liujianview/gymxmjpa/issues/3#issue[PII_REDACTED]; https://vuldb.com/?ctiid.291281
CVE: CVE-2025-0406
Published: 2025-01-13
Description: A vulnerability was found in liujianview gymxmjpa 1.0. It has been classified as critical. Affected is the function SubjectDaoImpl of the file src/main/java/com/liujian/gymxmjpa/controller/SubjectController.java. The manipulation of the argument subname leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/liujianview/gymxmjpa/issues/5; https://github.com/liujianview/gymxmjpa/issues/5#issue[PII_REDACTED]; https://vuldb.com/?ctiid.291282
CVE: CVE-2025-0407
Published: 2025-01-13
Description: A vulnerability was found in liujianview gymxmjpa 1.0. It has been declared as critical. Affected by this vulnerability is the function EquipmentDaoImpl of the file src/main/java/com/liujian/gymxmjpa/controller/EquipmentController.java. The manipulation of the argument hyname leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/liujianview/gymxmjpa/issues/7; https://github.com/liujianview/gymxmjpa/issues/7#issue[PII_REDACTED]; https://vuldb.com/?ctiid.291283
CVE: CVE-2025-0408
Published: 2025-01-13
Description: A vulnerability was found in liujianview gymxmjpa 1.0. It has been rated as critical. Affected by this issue is the function LoosDaoImpl of the file src/main/java/com/liujian/gymxmjpa/controller/LoosController.java. The manipulation of the argument loosName leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/liujianview/gymxmjpa/issues/8; https://github.com/liujianview/gymxmjpa/issues/8#issue[PII_REDACTED]; https://vuldb.com/?ctiid.291284
CVE: CVE-2025-0409
Published: 2025-01-13
Description: A vulnerability classified as critical has been found in liujianview gymxmjpa 1.0. This affects the function MembertypeDaoImpl of the file src/main/java/com/liujian/gymxmjpa/controller/MembertypeController.java. The manipulation of the argument typeName leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/liujianview/gymxmjpa/issues/9; https://github.com/liujianview/gymxmjpa/issues/9#issue[PII_REDACTED]; https://vuldb.com/?ctiid.291285
CVE: CVE-2025-0410
Published: 2025-01-13
Description: A vulnerability classified as critical was found in liujianview gymxmjpa 1.0. This vulnerability affects the function MenberDaoInpl of the file src/main/java/com/liujian/gymxmjpa/controller/MenberConntroller.java. The manipulation of the argument hyname leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/liujianview/gymxmjpa/issues/10; https://github.com/liujianview/gymxmjpa/issues/10#issue[PII_REDACTED]; https://vuldb.com/?ctiid.291286
CVE: CVE-2025-0412
Published: 2025-01-13
Description: Luxion KeyShot Viewer KSP File Parsing Memory Corruption Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Luxion KeyShot Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the processing of KSP files. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-22139.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://download.keyshot.com/cert/lsa-960930/lsa-960930.pdf?version=1.0; https://www.zerodayinitiative.com/advisories/ZDI-23-1716/
CVE: CVE-2024-11636
Published: 2025-01-13
Description: The Email Subscribers by Icegram Express  WordPress plugin before 5.7.45 does not sanitise and escape some of its Text Block options, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-20, CWE-79
References: https://wpscan.com/vulnerability/da616c20-3d74-4d3a-95f5-2d71d9ada094/
CVE: CVE-2024-12274
Published: 2025-01-13
Description: The Appointment Booking Calendar Plugin and Scheduling Plugin  WordPress plugin before 1.1.23 export settings functionality exports data to a public folder, with an easily guessable file name, allowing unauthenticated attackers to access the exported files (if they exist).
CVSS Score: 7.5 (HIGH)
References: https://wpscan.com/vulnerability/e3176c9a-63f3-4a28-a8a7-8abb2b4100ef/
CVE: CVE-2024-12566
Published: 2025-01-13
Description: The Email Subscribers by Icegram Express  WordPress plugin before 5.7.45 does not sanitise and escape some of form settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/9206064a-d54e-44ad-9670-65520ee166a6/
CVE: CVE-2024-12567
Published: 2025-01-13
Description: The Email Subscribers by Icegram Express  WordPress plugin before 5.7.45 does not sanitise and escape some of its form settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/82051ccc-c528-4ff3-900a-3b8e8ad34145/
CVE: CVE-2024-12568
Published: 2025-01-13
Description: The Email Subscribers by Icegram Express  WordPress plugin before 5.7.45 does not sanitise and escape some of its Workflow settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/0ce9075a-754b-474e-9620-17da8ee29b56/
CVE: CVE-2024-51728
Published: 2025-01-13
Description: Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2024. Notes: none.
CVE: CVE-2024-47894
Published: 2025-01-13
Description: Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmware to read data outside the Guest's virtualised GPU memory.
CVSS Score: 7.1 (HIGH)
CWE: CWE-823
References: https://www.imaginationtech.com/gpu-driver-vulnerabilities/
CVE: CVE-2024-47895
Published: 2025-01-13
Description: Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmware to read data outside the Guest's virtualised GPU memory.
CVSS Score: 7.1 (HIGH)
CWE: CWE-823
References: https://www.imaginationtech.com/gpu-driver-vulnerabilities/
CVE: CVE-2024-47897
Published: 2025-01-13
Description: Software installed and run as a non-privileged user may conduct improper GPU system calls resulting in platform instability and reboots.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://www.imaginationtech.com/gpu-driver-vulnerabilities/
CVE: CVE-2024-52935
Published: 2025-01-13
Description: Kernel software installed and running inside a Guest VM may exploit memory shared with the GPU Firmware to write data outside the Guest's virtualised GPU memory.
CVSS Score: 4.1 (MEDIUM)
CWE: CWE-823
References: https://www.imaginationtech.com/gpu-driver-vulnerabilities/
CVE: CVE-2024-52936
Published: 2025-01-13
Description: Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmware to write data outside the Guest's virtualised GPU memory.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-823
References: https://www.imaginationtech.com/gpu-driver-vulnerabilities/
CVE: CVE-2024-52937
Published: 2025-01-13
Description: Kernel software installed and running inside a Guest VM may exploit memory shared with the GPU Firmware to write data outside the Guest's virtualised GPU memory.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-823
References: https://www.imaginationtech.com/gpu-driver-vulnerabilities/
CVE: CVE-2024-52938
Published: 2025-01-13
Description: Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmware to subvert reconstruction activities to trigger a write of data outside the Guest's virtualised GPU memory.
CVSS Score: 7.8 (HIGH)
CWE: CWE-823
References: https://www.imaginationtech.com/gpu-driver-vulnerabilities/
CVE: CVE-2025-22828
Published: 2025-01-13
Description: CloudStack users can add and read comments (annotations) on resources they are authorised to access. 

Due to an access validation issue that affects Apache CloudStack versions from 4.16.0, users who have access, prior access or knowledge of resource UUIDs can list and add comments (annotations) to such resources. 

An attacker with a user-account and access or prior knowledge of resource UUIDs may exploit this issue to read contents of the comments (annotations) or add malicious comments (annotations) to such resources. 

This may cause potential loss of confidentiality of CloudStack environments and resources if the comments (annotations) contain any privileged information. However, guessing or brute-forcing resource UUIDs are generally hard to impossible and access to listing or adding comments isn't same as access to CloudStack resources, making this issue of very low severity and general low impact.


CloudStack admins may also disallow listAnnotations and addAnnotation API access to non-admin roles in their environment as an interim measure.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: https://lists.apache.org/thread/bbsm9fdwrgfyostzojh6ghpocgdmx8rs; http://www.openwall.com/lists/oss-security/2025/01/13/1
CVE: CVE-2024-56065
Published: 2025-01-13
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Saleswonder Team: Tobias WP2LEADS wp2leads allows Reflected XSS.This issue affects WP2LEADS: from n/a through <= 3.4.2.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wp2leads/vulnerability/wordpress-wp2leads-plugin-3-4-2-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-56301
Published: 2025-01-13
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in enituretechnology Distance Based Shipping Calculator distance-based-shipping-calculator allows Reflected XSS.This issue affects Distance Based Shipping Calculator: from n/a through <= 2.0.21.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/distance-based-shipping-calculator/vulnerability/wordpress-distance-based-shipping-calculator-plugin-2-0-21-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-22314
Published: 2025-01-13
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Scripts Food Store – Online Food Delivery & Pickup food-store allows Reflected XSS.This issue affects Food Store – Online Food Delivery & Pickup: from n/a through <= 1.5.4.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/food-store/vulnerability/wordpress-food-store-plugin-1-5-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-22337
Published: 2025-01-13
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in infosoftplugin Order Audit Log for WooCommerce order-audit-log-for-woocommerce allows Reflected XSS.This issue affects Order Audit Log for WooCommerce: from n/a through <= 2.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/order-audit-log-for-woocommerce/vulnerability/wordpress-order-audit-log-for-woocommerce-plugin-2-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-22344
Published: 2025-01-13
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in timmcdaniels Media Category Library media-category-library allows Reflected XSS.This issue affects Media Category Library: from n/a through <= 2.7.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/media-category-library/vulnerability/wordpress-media-category-library-plugin-2-7-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-22498
Published: 2025-01-13
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in N3wNormal LucidLMS lucidlms allows Reflected XSS.This issue affects LucidLMS: from n/a through <= 1.0.5.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/lucidlms/vulnerability/wordpress-lucidlms-plugin-1-0-5-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-22499
Published: 2025-01-13
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FAKTOR VIER F4 Post Tree f4-tree allows Reflected XSS.This issue affects F4 Post Tree: from n/a through <= 1.1.18.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/f4-tree/vulnerability/wordpress-f4-post-tree-plugin-1-1-18-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-22506
Published: 2025-01-13
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Smart Agenda Smart Agenda smart-agenda-prise-de-rendez-vous-en-ligne allows Stored XSS.This issue affects Smart Agenda: from n/a through <= 4.7.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/smart-agenda-prise-de-rendez-vous-en-ligne/vulnerability/wordpress-smart-agenda-plugin-4-7-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE: CVE-2025-22514
Published: 2025-01-13
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Yamna Khawaja KNR Author List Widget knr-author-list-widget allows Reflected XSS.This issue affects KNR Author List Widget: from n/a through <= 3.1.1.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/knr-author-list-widget/vulnerability/wordpress-axact-author-list-widget-plugin-3-1-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-22567
Published: 2025-01-13
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in trustist TRUSTist REVIEWer trustist-reviewer allows Reflected XSS.This issue affects TRUSTist REVIEWer: from n/a through <= 2.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/trustist-reviewer/vulnerability/wordpress-trustist-reviewer-plugin-2-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-22568
Published: 2025-01-13
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in arete-it Post And Page Reactions post-and-page-reactions allows Reflected XSS.This issue affects Post And Page Reactions: from n/a through <= 1.0.5.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/post-and-page-reactions/vulnerability/wordpress-post-and-page-reactions-plugin-1-0-5-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-22569
Published: 2025-01-13
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GrandSlambert Featured Page Widget featured-page-widget allows Reflected XSS.This issue affects Featured Page Widget: from n/a through <= 2.2.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/featured-page-widget/vulnerability/wordpress-featured-page-widget-plugin-2-2-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-22570
Published: 2025-01-13
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mdjekic Inline Tweets inline-tweets allows Stored XSS.This issue affects Inline Tweets: from n/a through <= 2.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/inline-tweets/vulnerability/wordpress-inline-tweets-plugin-2-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-22576
Published: 2025-01-13
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Marcus Downing Site PIN site-pin allows Reflected XSS.This issue affects Site PIN: from n/a through <= 1.3.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/site-pin/vulnerability/wordpress-site-pin-plugin-1-3-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-22583
Published: 2025-01-13
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in anshulsojatia Scan External Links scan-external-links allows Reflected XSS.This issue affects Scan External Links: from n/a through <= 1.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/scan-external-links/vulnerability/wordpress-scan-external-links-plugin-1-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-22586
Published: 2025-01-13
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dstoever WPEX Replace DB Urls wpex-replace allows Reflected XSS.This issue affects WPEX Replace DB Urls: from n/a through <= 0.4.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wpex-replace/vulnerability/wordpress-wpex-replace-db-urls-plugin-0-4-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-22588
Published: 2025-01-13
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in intelligence_lab Scanventory woocommerce-inventory-management allows Reflected XSS.This issue affects Scanventory: from n/a through <= 1.1.3.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/woocommerce-inventory-management/vulnerability/wordpress-scanventory-plugin-1-1-3-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-22777
Published: 2025-01-13
Description: Deserialization of Untrusted Data vulnerability in StellarWP GiveWP give allows Object Injection.This issue affects GiveWP: from n/a through <= 3.19.3.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502, CWE-502
References: https://patchstack.com/database/Wordpress/Plugin/give/vulnerability/wordpress-givewp-plugin-3-19-3-php-object-injection-vulnerability?_s_id=cve; https://securityonline.info/cve-2025-22777-cvss-9-8-critical-security-alert-for-givewp-plugin-with-100000-active-installations/