deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-59954
Published: 2025-09-30
Description: Knowage is an open source analytics and business intelligence suite. Versions 8.1.26 and below are vulnerable to Remote Code Exection through using an unsafe org.apache.commons.jxpath.JXPathContext in MetaService.java service. This issue is fixed in version 8.1.27.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://github.com/KnowageLabs/Knowage-Server/commit/1bb60d42557724f7ed24c19df6c5017e169527ca; https://github.com/KnowageLabs/Knowage-Server/security/advisories/GHSA-96cv-75hg-xrgq; https://github.com/KnowageLabs/Knowage-Server/security/advisories/GHSA-96cv-75hg-xrgq
CVE: CVE-2025-59956
Published: 2025-09-30
Description: AgentAPI is an HTTP API for Claude Code, Goose, Aider, Gemini, Amp, and Codex. Versions 0.3.3 and below are susceptible to a client-side DNS rebinding attack when hosted over plain HTTP on localhost. An attacker can gain access to the /messages endpoint served by the Agent API. This allows for the unauthorized exfiltration of sensitive user data, specifically local message history, which can include secret keys, file system contents, and intellectual property the user was working on locally. This issue is fixed in version 0.4.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-350, CWE-290
References: https://github.blog/security/application-security/localhost-dangers-cors-and-dns-rebinding; https://github.com/coder/agentapi/commit/5c425c62447b8a9eac19e9fc5a2eae7f0803f149; https://github.com/coder/agentapi/pull/49
CVE: CVE-2025-61584
Published: 2025-09-30
Description: serverless-dns is a RethinkDNS resolver that deploys to Cloudflare Workers, Deno Deploy, Fastly, and Fly.io. Versions through abd including 0.1.30 have a vulnerability where the pr.yml GitHub Action interpolates in an unsafe manner untrusted input, specifically the github.event.pull_request.head.repo.clone_url and github.head_ref, to a command in the runner. Due to the action using the pull_request_target trigger it has permissive permissions by default. An unauthorized attacker can exploit this vulnerability to push arbitrary data to the repository. The subsequent impact on the end-user is executing the attackers' code when running serverless-dns. This is fixed in commit c5537dd, and expected to be released in 0.1.31.
CWE: CWE-77
References: https://github.com/serverless-dns/serverless-dns/commit/c5537dd7f203c59f2b86d1e295c2371f3533946a; https://github.com/serverless-dns/serverless-dns/security/advisories/GHSA-9g7x-737f-5xpc
CVE: CVE-2025-6815
Published: 2025-09-30
Description: The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘service[name]’ parameter in all versions up to, and including, 5.1.94 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3366851%40latepoint&new=3366851%40latepoint&sfp_email=&sfph_mail=; https://wordpress.org/plugins/latepoint/#developers; https://www.wordfence.com/threat-intel/vulnerabilities/id/28e9c77c-5c36-4449-ab90-86f2385ba1ae?source=cve
CVE: CVE-2025-6941
Published: 2025-09-30
Description: The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' parameter of the 'latepoint_resources' shortcode in all versions up to, and including, 5.1.94 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/latepoint/tags/5.1.93/lib/helpers/shortcodes_helper.php; https://plugins.trac.wordpress.org/changeset/3366851; https://wordpress.org/plugins/latepoint/#developers
CVE: CVE-2025-7038
Published: 2025-09-30
Description: The LatePoint plugin for WordPress is vulnerable to Authentication Bypass due to insufficient identity verification within the steps__load_step route of the latepoint_route_call AJAX endpoint in all versions up to, and including, 5.1.94. The endpoint reads the client-supplied customer email and related customer fields before invoking the internal login handler without verifying login status, capability checks, or a valid AJAX nonce. This makes it possible for unauthenticated attackers to log into any customer’s account.
CVSS Score: 8.2 (HIGH)
CWE: CWE-288
References: https://plugins.trac.wordpress.org/browser/latepoint/tags/5.1.93/latepoint.php; https://plugins.trac.wordpress.org/browser/latepoint/tags/5.1.93/lib/controllers/steps_controller.php; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3366851%40latepoint&new=3366851%40latepoint&sfp_email=&sfph_mail=
CVE: CVE-2025-7052
Published: 2025-09-30
Description: The LatePoint plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.1.94. This is due to missing nonce validation on the change_password() function of its customer_cabinet__change_password AJAX route. The plugin hooks this endpoint via wp_ajax and wp_ajax_nopriv but does not verify a nonce or user capability before resetting the user’s password. This makes it possible for unauthenticated attackers who trick a logged-in customer (or, with “WP users as customers” enabled, an administrator) into visiting a malicious link to take over their account.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://plugins.trac.wordpress.org/browser/latepoint/tags/5.1.93/latepoint.php; https://plugins.trac.wordpress.org/browser/latepoint/tags/5.1.93/lib/controllers/customer_cabinet_controller.php#L403; https://plugins.trac.wordpress.org/changeset/3366851/latepoint/tags/5.2.0/lib/controllers/customer_cabinet_controller.php
CVE: CVE-2025-7063
Published: 2025-09-30
Description: Due to client-controlled permission check parameter, PAD CMS's file upload functionality allows an unauthenticated remote attacker to upload files of any type and extension without restriction, which can then be executed leading to Remote Code Execution. This issue affects all 3 templates: www, bip and ww+bip.

This product is End-Of-Life and producent will not publish patches for this vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://cert.pl/posts/2025/09/CVE-2025-7063
CVE: CVE-2025-7065
Published: 2025-09-30
Description: Due to client-controlled permission check parameter, PAD CMS's photo upload functionality allows an unauthenticated remote attacker to upload files of any type and extension without restriction, which can then be executed leading to Remote Code Execution. This issue affects all 3 templates: www, bip and ww+bip.

This product is End-Of-Life and producent will not publish patches for this vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://cert.pl/posts/2025/09/CVE-2025-7063
CVE: CVE-2025-8116
Published: 2025-09-30
Description: PAD CMS is vulnerable to Reflected XSS in printing and save to PDF functionality. Malicious attacker can craft special URL, which will result in arbitrary JavaScript execution in victim's browser, when opened. This issue affects all 3 templates: www, bip and www+bip.

This product is End-Of-Life and producent will not publish patches for this vulnerability.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://cert.pl/posts/2025/09/CVE-2025-7063
CVE: CVE-2025-8117
Published: 2025-09-30
Description: PAD CMS improperly initializes parameter used for password recovery, which allows to change password for any user that did not use reset password functionality. This issue affects all 3 templates: www, bip and www+bip.

This product is End-Of-Life and producent will not publish patches for this vulnerability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-909
References: https://cert.pl/posts/2025/09/CVE-2025-7063
CVE: CVE-2025-8118
Published: 2025-09-30
Description: PAD CMS implements weak client-side brute-force protection by utilizing two cookies:  login_count and login_timeout. Information about attempt count or timeout is not stored on the server, which allows a malicious attacker to bypass this brute-force protection by resetting those cookies. This issue affects all 3 templates: www, bip and www+bip.

This product is End-Of-Life and producent will not publish patches for this vulnerability.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-307
References: https://cert.pl/posts/2025/09/CVE-2025-7063
CVE: CVE-2025-8119
Published: 2025-09-30
Description: PAD CMS is vulnerable to Cross-Site Request Forgery in reset password's functionality. Malicious attacker can craft special website, which when visited by the victim, will automatically send a POST request changing currently logged user's password to defined by the attacker value. This issue affects all 3 templates: www, bip and www+bip.

This product is End-Of-Life and producent will not publish patches for this vulnerability.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://cert.pl/posts/2025/09/CVE-2025-7063
CVE: CVE-2025-8120
Published: 2025-09-30
Description: Due to client-controlled permission check parameter, PAD CMS's upload photo functionality allows an unauthenticated remote attacker to upload files of any type and extension without restriction, which can then be executed leading to Remote Code Execution.This issue affects all 3 templates: www, bip and ww+bip.

This product is End-Of-Life and producent will not publish patches for this vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://cert.pl/posts/2025/09/CVE-2025-7063
CVE: CVE-2025-8121
Published: 2025-09-30
Description: Improper neutralization of input provided by an authorized user in article positioning functionality allows for Blind SQL Injection attacks. This issue affects all 3 templates: www, bip and ww+bip.

This product is End-Of-Life and producent will not publish patches for this vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://cert.pl/posts/2025/09/CVE-2025-7063
CVE: CVE-2025-8122
Published: 2025-09-30
Description: Improper neutralization of input provided by an authorized user in article positioning functionality allows for Blind SQL Injection attacks. This issue affects all 3 templates: www, bip and ww+bip.

This product is End-Of-Life and producent will not publish patches for this vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://cert.pl/posts/2025/09/CVE-2025-7063
CVE: CVE-2025-8214
Published: 2025-09-30
Description: The The Pack Elementor addon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Typing Letter widget in all versions up to, and including, 2.1.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3368757%40the-pack-addon&new=3368757%40the-pack-addon&sfp_email=&sfph_mail=; https://wordpress.org/plugins/the-pack-addon/#developers; https://www.wordfence.com/threat-intel/vulnerabilities/id/e120698f-c076-4d8f-934c-b4c46f2381ec?source=cve
CVE: CVE-2025-8559
Published: 2025-09-30
Description: The All in One Music Player plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.3.1 via the 'theme' parameter. This makes it possible for authenticated attackers, with Contributor-level access and above, to read the contents of files on the server, which can contain sensitive information.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://plugins.svn.wordpress.org/all-in-one-music-player/tags/1.3.1/src/Plugin.php; https://wordpress.org/plugins/all-in-one-music-player/#developers; https://www.wordfence.com/threat-intel/vulnerabilities/id/a35aa722-041f-4126-b742-bcf5219424ed?source=cve
CVE: CVE-2025-8560
Published: 2025-09-30
Description: The FancyTabs plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘title’ parameter in all versions up to, and including, 1.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.svn.wordpress.org/fancytabs/trunk/fancytabs.php; https://wordpress.org/plugins/fancytabs/#developers; https://www.wordfence.com/threat-intel/vulnerabilities/id/68cdbe3e-6169-4177-873d-1028912ecad6?source=cve
CVE: CVE-2025-8566
Published: 2025-09-30
Description: The GutenBee – Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via parameters in the CountUp and Google Maps Blocks in all versions up to, and including, 2.18.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3369525%40gutenbee%2Ftrunk&old=3281877%40gutenbee%2Ftrunk&sfp_email=&sfph_mail=; https://wordpress.org/plugins/gutenbee/; https://www.wordfence.com/threat-intel/vulnerabilities/id/0f99e32b-3985-4c50-817e-f54245e8b9c1?source=cve
CVE: CVE-2025-8608
Published: 2025-09-30
Description: The Mihdan: Elementor Yandex Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's block attributes in all versions up to, and including, 1.6.11 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/mihdan/mihdan-elementor-yandex-maps/commit/e1eabf80f5f29dd6b5a9eb8f01f74daab0256043; https://plugins.trac.wordpress.org/browser/mihdan-elementor-yandex-maps/trunk/includes/class-widget.php#L1437; https://www.wordfence.com/threat-intel/vulnerabilities/id/d09a53cc-1773-467d-a9c7-72f343ed02a4?source=cve
CVE: CVE-2025-8623
Published: 2025-09-30
Description: The WeedMaps Menu for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's weedmaps_menu shortcode in all versions up to, and including, 1.2.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.svn.wordpress.org/weedmaps-menu-embed/trunk/weedmaps-menu-wordpress.php; https://wordpress.org/plugins/weedmaps-menu-embed/#developers; https://www.wordfence.com/threat-intel/vulnerabilities/id/88bbdb6d-c824-4f31-9352-ebc0f8fd8247?source=cve
CVE: CVE-2025-8624
Published: 2025-09-30
Description: The Nexa Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Google Maps widget in all versions up to, and including, 1.1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3392899%40nexa-blocks&new=3392899%40nexa-blocks&sfp_email=&sfph_mail=; https://wordpress.org/plugins/nexa-blocks/#developers; https://www.wordfence.com/threat-intel/vulnerabilities/id/9efce080-9f7a-40a0-b084-513e07afe1c9?source=cve
CVE: CVE-2025-8625
Published: 2025-09-30
Description: The Copypress Rest API plugin for WordPress is vulnerable to Remote Code Execution via copyreap_handle_image() Function in versions 1.1 to 1.2. The plugin falls back to a hard-coded JWT signing key when no secret is defined and does not restrict which file types can be fetched and saved as attachments. As a result, unauthenticated attackers can forge a valid token to gain elevated privileges and upload an arbitrary file (e.g. a PHP script) through the image handler, leading to remote code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-321
References: https://wordpress.org/plugins/copypress-rest-api/#developers; https://www.wordfence.com/threat-intel/vulnerabilities/id/3045c9e5-4095-48e5-8d9d-16a091e69d54?source=cve
CVE: CVE-2025-8777
Published: 2025-09-30
Description: The planetcalc plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘language’ parameter in all versions up to, and including, 2.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.svn.wordpress.org/planetcalc/tags/2.2/planetcalc.php; https://wordpress.org/plugins/planetcalc/#developers; https://www.wordfence.com/threat-intel/vulnerabilities/id/fa8aac87-f9bd-4426-85da-e434805c66ec?source=cve
CVE: CVE-2025-8877
Published: 2025-09-30
Description: The AffiliateWP plugin for WordPress is vulnerable to SQL Injection via the ajax_get_affiliate_id_from_login function in all versions up to, and including, 2.28.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://affiliatewp.com; https://www.wordfence.com/threat-intel/vulnerabilities/id/5ae32a38-5be3-47d0-9c56-2fcda7662c71?source=cve
CVE: CVE-2025-9762
Published: 2025-09-30
Description: The Post By Email plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the save_attachments function in all versions up to, and including, 1.0.4b. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://plugins.trac.wordpress.org/browser/post-by-email/tags/1.0.4b/class-post-by-email.php#L702; https://www.wordfence.com/threat-intel/vulnerabilities/id/885eb923-8e69-416b-8494-a42a9465cfe0?source=cve
CVE: CVE-2025-9852
Published: 2025-09-30
Description: The Yoga Schedule Momoyoga plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'momoyoga-schedule' shortcode in all versions up to, and including, 2.9.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/momoyoga-integration/tags/2.9.0/momoyoga-schedule.php#L56; https://plugins.trac.wordpress.org/browser/momoyoga-integration/tags/2.9.1/momoyoga-schedule.php#L56; https://www.wordfence.com/threat-intel/vulnerabilities/id/745da770-dd78-4ffb-ae15-4b90682911e3?source=cve
CVE: CVE-2025-9946
Published: 2025-09-30
Description: The LockerPress – WordPress Security Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-352
References: https://plugins.trac.wordpress.org/browser/lockerpress-wordpress-security/trunk/core.php#L174; https://plugins.trac.wordpress.org/browser/lockerpress-wordpress-security/trunk/views/login_url.php#L20; https://www.wordfence.com/threat-intel/vulnerabilities/id/e9cf6b7f-d2b0-47f9-beec-8773f260c088?source=cve
CVE: CVE-2025-9948
Published: 2025-09-30
Description: The Chat by Chatwee plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1.3. This is due to missing or incorrect nonce validation on the admin settings page. This makes it possible for unauthenticated attackers to modify plugin settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://plugins.trac.wordpress.org/browser/chatwee/trunk/chatwee-admin.php#L10; https://plugins.trac.wordpress.org/browser/chatwee/trunk/chatwee-admin.php#L41; https://www.wordfence.com/threat-intel/vulnerabilities/id/b9a4e0c1-7bbb-4ab0-948c-3d172717e5fe?source=cve
CVE: CVE-2025-9991
Published: 2025-09-30
Description: The Tiny Bootstrap Elements Light plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.3.34 via the 'language' parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included.
CVSS Score: 8.1 (HIGH)
CWE: CWE-98
References: https://plugins.svn.wordpress.org/tiny-bootstrap-elements-light/trunk/assets/bootstrap-label.php; https://plugins.trac.wordpress.org/browser/tiny-bootstrap-elements-light/trunk/assets/bootstrap-label.php#L14; https://www.wordfence.com/threat-intel/vulnerabilities/id/c1010470-63d4-49c5-9811-0e86fbeb57d5?source=cve
CVE: CVE-2025-9993
Published: 2025-09-30
Description: The Bei Fen – WordPress Backup Plugin plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.4.2 via the 'task'. This makes it possible for authenticated attackers, with Subscriber-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. This only affects instances running PHP 7.1 or older.
CVSS Score: 8.1 (HIGH)
CWE: CWE-98
References: https://plugins.svn.wordpress.org/bei-fen/trunk/beifen.php; https://plugins.trac.wordpress.org/browser/bei-fen/trunk/beifen.php#L185; https://www.wordfence.com/threat-intel/vulnerabilities/id/839c3b99-189d-4a74-b295-d44eb39d86c8?source=cve
CVE: CVE-2025-10217
Published: 2025-09-30
Description: A vulnerability exists in Asset Suite for an authenticated user to manipulate the content of performance related log data or to inject crafted data in logfile for potentially carrying out further malicious attacks. Performance logging is typically enabled for troubleshooting purposes while resolving application performance related issues.
CWE: CWE-117
References: https://publisher.hitachienergy.com/preview?DocumentID=8DBD000226&LanguageCode=en&DocumentPartId=&Action=Launch