deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-23655
Published: 2025-02-14
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in crystalwebpro Contact Form 7 – Paystack Add-on cf7-paystack-add-on allows Reflected XSS.This issue affects Contact Form 7 – Paystack Add-on: from n/a through <= 1.2.3.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/cf7-paystack-add-on/vulnerability/wordpress-contact-form-7-paystack-add-on-plugin-1-2-3-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-23657
Published: 2025-02-14
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RusAlex WordPress-to-candidate for Salesforce CRM salesforce-wordpress-to-candidate allows Reflected XSS.This issue affects WordPress-to-candidate for Salesforce CRM: from n/a through <= 1.0.1.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/salesforce-wordpress-to-candidate/vulnerability/wordpress-wordpress-to-candidate-for-salesforce-crm-plugin-1-0-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-23658
Published: 2025-02-14
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tauhidul Alam Advanced Angular Contact Form advanced-angular-contact-form allows Reflected XSS.This issue affects Advanced Angular Contact Form: from n/a through <= 1.1.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/advanced-angular-contact-form/vulnerability/wordpress-advanced-angular-contact-form-plugin-1-1-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-23742
Published: 2025-02-14
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Podamibe Nepal Podamibe Twilio Private Call podamibe-twilio-private-call allows Reflected XSS.This issue affects Podamibe Twilio Private Call: from n/a through <= 1.0.1.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/podamibe-twilio-private-call/vulnerability/wordpress-podamibe-twilio-private-call-plugin-1-0-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-23748
Published: 2025-02-14
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Singsys Singsys -Awesome Gallery awesome-gallery-singsys allows Reflected XSS.This issue affects Singsys -Awesome Gallery: from n/a through <= 1.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/awesome-gallery-singsys/vulnerability/wordpress-singsys-awesome-gallery-plugin-1-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-23750
Published: 2025-02-14
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in devbunchuk Custom Widget Creator custom-widget-creator allows Reflected XSS.This issue affects Custom Widget Creator: from n/a through <= 1.0.5.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/custom-widget-creator/vulnerability/wordpress-custom-widget-creator-plugin-1-0-5-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-23751
Published: 2025-02-14
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Think201 Data Dash data-dash allows Reflected XSS.This issue affects Data Dash: from n/a through <= 1.2.3.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/data-dash/vulnerability/wordpress-data-dash-plugin-1-2-3-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-23766
Published: 2025-02-14
Description: Missing Authorization vulnerability in ashamil OPSI Israel Domestic Shipments woo-ups-pickup allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects OPSI Israel Domestic Shipments: from n/a through <= 2.8.2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/woo-ups-pickup/vulnerability/wordpress-opsi-israel-domestic-shipments-plugin-2-6-3-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-23771
Published: 2025-02-14
Description: Missing Authorization vulnerability in Murali Push Notification for Post and BuddyPress push-notification-for-post-and-buddypress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Push Notification for Post and BuddyPress: from n/a through <= 2.11.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/push-notification-for-post-and-buddypress/vulnerability/wordpress-push-notification-for-post-and-buddypress-plugin-2-10-settings-change-vulnerability?_s_id=cve
CVE: CVE-2025-23786
Published: 2025-02-14
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DuoGeek Email to Download email-to-download allows Reflected XSS.This issue affects Email to Download: from n/a through <= 3.1.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/email-to-download/vulnerability/wordpress-email-to-download-plugin-3-1-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-23787
Published: 2025-02-14
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Foxskav Easy Bet easy-bet allows Reflected XSS.This issue affects Easy Bet: from n/a through <= 1.0.7.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/easy-bet/vulnerability/wordpress-easy-bet-plugin-1-0-7-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-23788
Published: 2025-02-14
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Roni Saha Easy Filter easy-filter allows Reflected XSS.This issue affects Easy Filter: from n/a through <= 1.10.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/easy-filter/vulnerability/wordpress-easy-filter-plugin-1-10-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-23789
Published: 2025-02-14
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tahminajannat URL Shortener | Conversion Tracking  | AB Testing  | WooCommerce easy-broken-link-checker allows Reflected XSS.This issue affects URL Shortener | Conversion Tracking  | AB Testing  | WooCommerce: from n/a through <= 9.0.2.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/easy-broken-link-checker/vulnerability/wordpress-url-shortener-woocommerce-plugin-9-0-2-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-23790
Published: 2025-02-14
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wassereimer Easy Code Placement allows Reflected XSS. This issue affects Easy Code Placement: from n/a through 18.11.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/wordpress/plugin/easy-code-placement/vulnerability/wordpress-easy-code-placement-plugin-18-11-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-23851
Published: 2025-02-14
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Khushwant Singh Coronavirus (COVID-19) Outbreak Data Widgets coronavirus-data-widgets allows Reflected XSS.This issue affects Coronavirus (COVID-19) Outbreak Data Widgets: from n/a through <= 1.1.1.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/coronavirus-data-widgets/vulnerability/wordpress-coronavirus-covid-19-outbreak-data-widgets-plugin-1-1-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-23853
Published: 2025-02-14
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in michelem NoFollow Free nofollow-free allows Reflected XSS.This issue affects NoFollow Free: from n/a through <= 1.6.3.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/nofollow-free/vulnerability/wordpress-nofollow-free-plugin-1-6-3-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-23857
Published: 2025-02-14
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SmartDataSoft Essential WP Real Estate essential-wp-real-estate allows Reflected XSS.This issue affects Essential WP Real Estate: from n/a through <= 1.1.3.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/essential-wp-real-estate/vulnerability/wordpress-essential-wp-real-estate-plugin-1-1-3-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-23905
Published: 2025-02-14
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Johannes van Poelgeest Admin Options Pages admin-options-pages allows Reflected XSS.This issue affects Admin Options Pages: from n/a through <= 0.9.7.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/admin-options-pages/vulnerability/wordpress-admin-options-pages-plugin-0-9-7-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-24554
Published: 2025-02-14
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in awcode AWcode Toolkit awcode-toolkit allows Reflected XSS.This issue affects AWcode Toolkit: from n/a through <= 1.0.14.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/awcode-toolkit/vulnerability/wordpress-awcode-toolkit-plugin-1-0-14-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-24558
Published: 2025-02-14
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CRM Perks CRM Perks support-x allows Reflected XSS.This issue affects CRM Perks: from n/a through <= 1.1.5.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/support-x/vulnerability/wordpress-crm-perks-plugin-1-1-5-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-24564
Published: 2025-02-14
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in aviplugins.com Contact Form With Shortcode contact-form-with-shortcode allows Reflected XSS.This issue affects Contact Form With Shortcode: from n/a through <= 4.2.5.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/contact-form-with-shortcode/vulnerability/wordpress-contact-form-with-shortcode-plugin-4-2-5-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-24565
Published: 2025-02-14
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Saleswonder Team: Tobias WP2LEADS wp2leads allows Reflected XSS.This issue affects WP2LEADS: from n/a through <= 3.3.3.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wp2leads/vulnerability/wordpress-wp2leads-plugin-3-3-3-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-24566
Published: 2025-02-14
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tomáš Groulík Intro Tour Tutorial DeepPresentation dp-intro-tours allows Reflected XSS.This issue affects Intro Tour Tutorial DeepPresentation: from n/a through <= 6.5.2.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/dp-intro-tours/vulnerability/wordpress-intro-tour-tutorial-deeppresentation-plugin-6-5-2-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-24567
Published: 2025-02-14
Description: Insertion of Sensitive Information Into Sent Data vulnerability in brandtoss WP Mailster wp-mailster allows Retrieve Embedded Sensitive Data.This issue affects WP Mailster: from n/a through <= 1.8.16.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-201
References: https://patchstack.com/database/Wordpress/Plugin/wp-mailster/vulnerability/wordpress-wp-mailster-plugin-1-8-16-0-sensitive-data-exposure-vulnerability-2?_s_id=cve
CVE: CVE-2025-24592
Published: 2025-02-14
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SysBasics Customize My Account for WooCommerce customize-my-account-for-woocommerce allows Reflected XSS.This issue affects Customize My Account for WooCommerce: from n/a through <= 2.8.22.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/customize-my-account-for-woocommerce/vulnerability/wordpress-sysbasics-customize-my-account-for-woocommerce-plugin-2-8-22-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-24607
Published: 2025-02-14
Description: Missing Authorization vulnerability in Northern Beaches Websites IdeaPush ideapush allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects IdeaPush: from n/a through <= 8.71.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/ideapush/vulnerability/wordpress-ideapush-plugin-8-71-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-24614
Published: 2025-02-14
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Agile Logix Post Timeline post-timeline allows Reflected XSS.This issue affects Post Timeline: from n/a through <= 2.3.9.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/post-timeline/vulnerability/wordpress-post-timeline-plugin-2-3-9-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-24615
Published: 2025-02-14
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in fatcatapps Analytics Cat analytics-cat allows Reflected XSS.This issue affects Analytics Cat: from n/a through <= 1.1.2.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/analytics-cat/vulnerability/wordpress-analytics-cat-plugin-1-1-2-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-24616
Published: 2025-02-14
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in UIUX Lab Uix Page Builder uix-page-builder allows Reflected XSS.This issue affects Uix Page Builder: from n/a through <= 1.7.3.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/uix-page-builder/vulnerability/wordpress-uix-page-builder-plugin-1-7-3-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-24617
Published: 2025-02-14
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AcyMailing Newsletter Team AcyMailing SMTP Newsletter acymailing allows Reflected XSS.This issue affects AcyMailing SMTP Newsletter: from n/a through < 9.11.1.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/acymailing/vulnerability/wordpress-acymailing-plugin-9-11-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-24641
Published: 2025-02-14
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in rickonline_nl Better WishList API better-wlm-api allows Stored XSS.This issue affects Better WishList API: from n/a through <= 1.1.3.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/better-wlm-api/vulnerability/wordpress-better-wishlist-api-plugin-1-1-3-stored-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-24688
Published: 2025-02-14
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in brandtoss WP Mailster wp-mailster allows Reflected XSS.This issue affects WP Mailster: from n/a through <= 1.8.20.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wp-mailster/vulnerability/wordpress-wp-mailster-plugin-1-8-20-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-24692
Published: 2025-02-14
Description: Missing Authorization vulnerability in M.Code Bulk Menu Edit bulk-menu-edit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Bulk Menu Edit: from n/a through <= 1.3.
CVSS Score: 7.1 (HIGH)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/bulk-menu-edit/vulnerability/wordpress-bulk-menu-edit-plugin-1-3-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-24699
Published: 2025-02-14
Description: Cross-Site Request Forgery (CSRF) vulnerability in Wow-Company WP Coder wp-coder allows Cross-Site Scripting (XSS).This issue affects WP Coder: from n/a through <= 3.6.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/wp-coder/vulnerability/wordpress-wp-coder-plugin-3-6-csrf-to-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-24700
Published: 2025-02-14
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Xylus Themes WP Event Aggregator wp-event-aggregator allows Reflected XSS.This issue affects WP Event Aggregator: from n/a through <= 1.8.2.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wp-event-aggregator/vulnerability/wordpress-wp-event-aggregator-plugin-1-8-2-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-12651
Published: 2025-02-14
Description: Exposed Dangerous Method or Function vulnerability in PTT Inc. HGS Mobile App allows Manipulating User-Controlled Variables.This issue affects HGS Mobile App: before 6.5.0.
CVSS Score: 8.5 (HIGH)
CWE: CWE-749
References: https://www.usom.gov.tr/bildirim/tr-25-0034
CVE: CVE-2024-56180
Published: 2025-02-14
Description: CWE-502 Deserialization of Untrusted Data at the eventmesh-meta-raft plugin module in Apache EventMesh master branch without release version on windows\linux\mac os e.g. platforms allows attackers to send controlled message and remote code execute via hessian deserialization rpc protocol. Users can use the code under the master branch in project repo or version 1.11.0 to fix this issue.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://lists.apache.org/thread/k9fw0t5r7t1vbx53gs8d1r8c54rhx0wd; http://www.openwall.com/lists/oss-security/2025/02/14/7
CVE: CVE-2025-0178
Published: 2025-02-14
Description: Improper Input Validation vulnerability in WatchGuard Fireware OS allows an attacker to manipulate the value of the HTTP Host header in requests sent to the Web UI. An attacker could exploit this vulnerability to redirect users to malicious websites, poison the web cache, or inject malicious JavaScript into responses sent by the Web UI.
This issue affects Fireware OS: from 12.0 up to and including 12.11.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-20
References: https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2025-00003
CVE: CVE-2025-1071
Published: 2025-02-14
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS allows Stored XSS via the spamBlocker module. This vulnerability requires an authenticated administrator session to a locally managed Firebox.This issue affects Fireware OS: from 12.0 through 12.5.12+701324, from 12.6 through 12.11.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2025-00001
CVE: CVE-2025-1239
Published: 2025-02-14
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS allows Stored XSS via the Blocked Sites list. This vulnerability requires an authenticated administrator session to a locally managed Firebox.This issue affects Fireware OS: from 12.0 through 12.5.12+701324, from 12.6 through 12.11.
CWE: CWE-79
References: https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2025-00002
CVE: CVE-2024-52895
Published: 2025-02-14
Description: IBM i 7.4 and 7.5 is vulnerable to a database access denial of service caused by a bypass of a database capabilities restriction check. A privileged bad actor can remove or otherwise impact database infrastructure files resulting in incorrect behavior of software products that rely upon the database.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-754
References: https://www.ibm.com/support/pages/node/7183052
CVE: CVE-2024-56477
Published: 2025-02-14
Description: IBM Power Hardware Management Console V10.3.1050.0 could allow an authenticated user to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://www.ibm.com/support/pages/node/7183224
CVE: CVE-2025-25740
Published: 2025-02-14
Description: D-Link DIR-853 A1 FW1.20B07 was discovered to contain a stack-based buffer overflow vulnerability via the PSK parameter in the SetQuickVPNSettings module.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-121
References: https://dear-sunshine-ba5.notion.site/D-Link-DIR-853-2-1812386a66448036a1cce259beb30b04
CVE: CVE-2024-56973
Published: 2025-02-14
Description: Insecure Permissions vulnerability in Alvaria, Inc Unified IP Unified Director before v.7.2SP2 allows a remote attacker to execute arbitrary code via the source and filename parameters to the ProcessUploadFromURL.jsp component.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-281
References: https://gist.github.com/VAMorales/1092a29ac7d0b4b80d5c853b9a22a65d; https://gist.github.com/VAMorales/1092a29ac7d0b4b80d5c853b9a22a65d
CVE: CVE-2024-57725
Published: 2025-02-14
Description: An issue in the Arcadyan Livebox Fibra PRV3399B_B_LT allows a remote or local attacker to modify the GPON link value without authentication, causing an internet service disruption via the /firstconnection.cgi endpoint.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-306
References: https://github.com/pointedsec/CVE-2024-57725
CVE: CVE-2024-57778
Published: 2025-02-14
Description: An issue in Orbe ONetView Roeador Onet-1200 Orbe[PII_REDACTED] allows a remote attacker to escalate privileges via the servers response from status code 500 to status code 200.
CVSS Score: 8.8 (HIGH)
CWE: CWE-269
References: https://github.com/KUK3N4N/CVE-2024-57778
CVE: CVE-2025-25745
Published: 2025-02-14
Description: D-Link DIR-853 A1 FW1.20B07 was discovered to contain a stack-based buffer overflow vulnerability via the Password parameter in the SetQuickVPNSettings module.
CVSS Score: 8.8 (HIGH)
CWE: CWE-121
References: https://dear-sunshine-ba5.notion.site/D-Link-DIR-853-2-1812386a664480ea82a7f8321d967187