deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-5947
Published: 2025-08-01
Description: The Service Finder Bookings plugin for WordPress is vulnerable to privilege escalation via authentication bypass in all versions up to, and including, 6.0. This is due to the plugin not properly validating a user's cookie value prior to logging them in through the service_finder_switch_back() function. This makes it possible for unauthenticated attackers to login as any user including admins.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-639
References: https://themeforest.net/item/service-finder-service-and-business-listing-wordpress-theme/15208793; https://www.wordfence.com/threat-intel/vulnerabilities/id/c1fe4f60-d93b-4071-90ae-ac863c17fe19?source=cve; https://www.vicarius.io/vsociety/posts/cve-2025-5947-detect-wordpress-vulnerability
CVE: CVE-2025-8433
Published: 2025-08-01
Description: A vulnerability was found in code-projects Document Management System 1.0 and classified as critical. This issue affects the function unlink of the file /dell.php. The manipulation of the argument ID leads to path traversal. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-22
References: https://code-projects.org/; https://github.com/i-Corner/cve/issues/14; https://vuldb.com/?ctiid.318461
CVE: CVE-2025-8434
Published: 2025-08-01
Description: A vulnerability was found in code-projects Online Movie Streaming 1.0. It has been classified as critical. Affected is an unknown function of the file /admin.php. The manipulation of the argument ID leads to missing authorization. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-862, CWE-863
References: https://code-projects.org/; https://github.com/i-Corner/cve/issues/15; https://vuldb.com/?ctiid.318462
CVE: CVE-2025-4523
Published: 2025-08-01
Description: The IDonate – Blood Donation, Request And Donor Management System plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the admin_donor_profile_view() function in versions 2.0.0 to 2.1.9. This makes it possible for authenticated attackers, with Subscriber-level access and above, to expose an administrator’s username, email address, and all donor fields.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: https://plugins.trac.wordpress.org/browser/idonate/tags/2.1.9/src/Admin/Admin.php#L76; https://plugins.trac.wordpress.org/browser/idonate/tags/2.1.9/src/Helpers/IDonateAjaxHandler.php#L48; https://plugins.trac.wordpress.org/changeset/3334424/
CVE: CVE-2025-7443
Published: 2025-08-01
Description: The BerqWP – Automated All-In-One Page Speed Optimization for Core Web Vitals, Cache, CDN, Images, CSS, and JavaScript plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation via the store_javascript_cache.php file in all versions up to, and including, 2.2.42. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
CVSS Score: 8.1 (HIGH)
CWE: CWE-434
References: https://plugins.trac.wordpress.org/browser/searchpro/trunk/api/store_javascript_cache.php#L14; https://plugins.trac.wordpress.org/changeset/3330075/searchpro/trunk/api/register_apis.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/5d7dc644-ab83-4f03-998a-ec8eda695161?source=cve
CVE: CVE-2025-7725
Published: 2025-08-01
Description: The Photos, Files, YouTube, Twitter, Instagram, TikTok, Ecommerce Contest Gallery – Upload, Vote, Sell via PayPal or Stripe, Social Share Buttons, OpenAI plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the comment feature in all versions up to, and including, 26.1.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 7.2 (HIGH)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3334370%40contest-gallery%2Ftrunk&old=3333852%40contest-gallery%2Ftrunk&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/18003103-3a14-4cbc-8bed-87a8ab050308?source=cve
CVE: CVE-2025-7845
Published: 2025-08-01
Description: The Stratum – Elementor Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Advanced Google Maps and Image Hotspot widgets in all versions up to, and including, 1.6.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/stratum/tags/1.6.0/includes/templates/image-hotspot.php; https://plugins.trac.wordpress.org/changeset/3335410; https://wordpress.org/plugins/stratum/#developers
CVE: CVE-2025-8435
Published: 2025-08-01
Description: A vulnerability was found in code-projects Online Movie Streaming 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /admin-control.php. The manipulation of the argument ID leads to missing authorization. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-862, CWE-863
References: https://code-projects.org/; https://github.com/i-Corner/cve/issues/15; https://vuldb.com/?ctiid.318463
CVE: CVE-2025-31716
Published: 2025-08-01
Description: In bootloader, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with no additional execution privileges needed.
CVSS Score: 5.1 (MEDIUM)
References: https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]62374401
CVE: CVE-2025-54939
Published: 2025-08-01
Description: LiteSpeed QUIC (LSQUIC) Library before 4.3.1 has an lsquic_engine_packet_in memory leak.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-770, CWE-401
References: https://blog.litespeedtech.com/2025/08/18/litespeed-security-update/; https://github.com/litespeedtech/lsquic/blob/[PII_REDACTED]4f85e97b08f510673e29f399bbae8f/CHANGELOG#L1-L3; https://github.com/litespeedtech/lsquic/commit/4cd9252e77fb4a36b572e2167a84067d603d3b23
CVE: CVE-2025-5921
Published: 2025-08-01
Description: The SureForms  WordPress plugin before 1.7.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against both authenticated and unauthenticated users.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/052fb6cf-274e-468b-a7e0-0e7a1751ec75/
CVE: CVE-2025-8436
Published: 2025-08-01
Description: A vulnerability was found in projectworlds Online Admission System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /viewdoc.php. The manipulation of the argument ID leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/Sunhaobin318/CVE/issues/2; https://vuldb.com/?ctiid.318464; https://vuldb.com/?id.318464
CVE: CVE-2025-8454
Published: 2025-08-01
Description: It was discovered that uscan, a tool to scan/watch upstream sources for new releases of software, included in devscripts (a collection of scripts to make the life of a Debian Package maintainer easier), skips OpenPGP verification if the upstream source is already downloaded from a previous run even if the verification failed back then.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-347
References: https://bugs.debian.org/1109251
CVE: CVE-2025-7646
Published: 2025-08-01
Description: The The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the custom script parameter in all versions up to, and including, 6.3.10 even when the user does not have the unfiltered_html capability. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/the-plus-addons-for-elementor-page-builder/tags/6.3.11/modules/widgets/tp_hovercard.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/58fcab5e-c82e-4072-9a86-94a7f18a6e56?source=cve
CVE: CVE-2025-8437
Published: 2025-08-01
Description: A vulnerability classified as critical has been found in code-projects Kitchen Treasure 1.0. This affects an unknown part of the file /userregistration.php. The manipulation of the argument email leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/wllovemy/cve/issues/16; https://vuldb.com/?ctiid.318465
CVE: CVE-2025-8438
Published: 2025-08-01
Description: A vulnerability classified as critical was found in code-projects Wazifa System 1.0. This vulnerability affects unknown code of the file /controllers/postpublish.php. The manipulation of the argument post leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/wllovemy/cve/issues/15; https://vuldb.com/?ctiid.318466
CVE: CVE-2025-8439
Published: 2025-08-01
Description: A vulnerability, which was classified as critical, has been found in code-projects Wazifa System 1.0. This issue affects some unknown processing of the file /controllers/updatesettings.php. The manipulation of the argument Password leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/wllovemy/cve/issues/14; https://vuldb.com/?ctiid.318467
CVE: CVE-2025-8441
Published: 2025-08-01
Description: A vulnerability, which was classified as critical, was found in code-projects Online Medicine Guide 1.0. Affected is an unknown function of the file /pharsignup.php. The manipulation of the argument phuname leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/justconter/cve/issues/2; https://vuldb.com/?ctiid.318468
CVE: CVE-2025-8442
Published: 2025-08-01
Description: A vulnerability has been found in code-projects Online Medicine Guide 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /cussignup.php. The manipulation of the argument uname leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/justconter/cve/issues/1; https://vuldb.com/?ctiid.318469
CVE: CVE-2025-6398
Published: 2025-08-01
Description: A null pointer dereference vulnerability exists in the IOMap64.sys driver of ASUS AI Suite 3. The vulnerability can be triggered by a specially crafted input, which may lead to a system crash (BSOD). Refer to the '

Security Update for for AI Suite 3

' section on the ASUS Security Advisory for more information.
CWE: CWE-476
References: https://www.asus.com/content/security-advisory/
CVE: CVE-2025-8443
Published: 2025-08-01
Description: A vulnerability was found in code-projects Online Medicine Guide 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /login.php. The manipulation of the argument uname leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/LI1551/vul/issues/1; https://vuldb.com/?ctiid.318470
CVE: CVE-2025-4684
Published: 2025-08-01
Description: The BlockSpare: Gutenberg Blocks & Patterns for Blogs, Magazines, Business Sites – Post Grids, Sliders, Carousels, Counters, Page Builder & Starter Site Imports, No Coding Needed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the HTML attributes of Image Carousel and Image Slider widgets in all versions up to, and including, 3.2.13.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/blockspare/trunk/dist/blocks.js; https://www.wordfence.com/threat-intel/vulnerabilities/id/0f4f8b84-3f65-430b-b749-6afae8d53153?source=cve
CVE: CVE-2025-6228
Published: 2025-08-01
Description: The Sina Extension for Elementor (Header Builder, Footer Builter, Theme Builder, Slider, Gallery, Form, Modal, Data Table Free Elementor Widgets & Elementor Templates) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `Sina Posts`, `Sina Blog Post` and `Sina Table` widgets in all versions up to, and including, 3.7.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/sina-extension-for-elementor/tags/3.7.0/widgets/advanced/sina-blogpost.php#L2066; https://plugins.trac.wordpress.org/browser/sina-extension-for-elementor/tags/3.7.0/widgets/basic/sina-table.php#L1659; https://plugins.trac.wordpress.org/browser/sina-extension-for-elementor/tags/3.7.0/widgets/theme_builder/sina-posts.php#L1879
CVE: CVE-2025-41370
Published: 2025-08-01
Description: A SQL injection vulnerability has been found in Gandia Integra Total of TESI from version 2.1.2217.3 to v4.4.2236.1. The vulnerability allows an authenticated attacker to retrieve, create, update and delete databases through the 'idestudio' parameter in /encuestas/integraweb/html/view/acceso.php.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-gandia-integra-total-tesi
CVE: CVE-2025-41371
Published: 2025-08-01
Description: A SQL injection vulnerability has been found in Gandia Integra Total of TESI from version 2.1.2217.3 to v4.4.2236.1. The vulnerability allows an authenticated attacker to retrieve, create, update and delete databases through the 'idestudio' parameter in /encuestas/integraweb_v4/integra/html/view/acceso.php
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-gandia-integra-total-tesi
CVE: CVE-2025-41372
Published: 2025-08-01
Description: A SQL injection vulnerability has been found in Gandia Integra Total of TESI from version 2.1.2217.3 to v4.4.2236.1. The vulnerability allows an authenticated attacker to retrieve, create, update and delete databases through the 'idestudio' parameter in /encuestas/integraweb[_v4]/integra/html/view/informe_campo_entrevistas.php.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-gandia-integra-total-tesi
CVE: CVE-2025-41373
Published: 2025-08-01
Description: A SQL injection vulnerability has been found in Gandia Integra Total of TESI from version 2.1.2217.3 to v4.4.2236.1. The vulnerability allows an authenticated attacker to retrieve, create, update and delete databases through the 'idestudio' parameter in /encuestas/integraweb[_v4]/integra/html/view/hislistadoacciones.php.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-gandia-integra-total-tesi
CVE: CVE-2025-41374
Published: 2025-08-01
Description: A SQL injection vulnerability has been found in Gandia Integra Total of TESI from version 2.1.2217.3 to v4.4.2236.1. The vulnerability allows an authenticated attacker to retrieve, create, update and delete databases through the 'idestudio' parameter in /encuestas/integraweb[_v4]/integra/html/view/hislistadoacciones.php.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-gandia-integra-total-tesi
CVE: CVE-2025-41375
Published: 2025-08-01
Description: SQL Injection vulnerability in Limesurvey v2.65.1+170522. This vulnerability allows an attacker to retrieve, create, update and delete database via 'token' parameter in '/index.php' endpoint.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-limesurvey
CVE: CVE-2025-41376
Published: 2025-08-01
Description: CRLF Injection vulnerability in Limesurvey v2.65.1+170522.  This vulnerability could allow a remote attacker to inject arbitrary HTTP headers and perform HTTP response splitting attacks via '/index.php/survey/index/sid/<SID>/token/fwyfw%0d%0aCookie:%20POC'.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-93
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-limesurvey
CVE: CVE-2023-44976
Published: 2025-08-01
Description: Hangzhou Shunwang Rentdrv2 before 2024-12-24 allows local users to terminate EDR processes and possibly have unspecified other impact via DeviceIoControl with control code 0x22E010, as exploited in the wild in October 2023.
CVSS Score: 3.2 (LOW)
CWE: CWE-782
References: https://github.com/keowu/BadRentdrv2; https://unit42.paloaltonetworks.com/agonizing-serpens-targets-israeli-tech-higher-ed-sectors/
CVE: CVE-2025-46018
Published: 2025-08-01
Description: CSC Pay Mobile App 2.19.4 (fixed in version 2.20.0) contains a vulnerability allowing users to bypass payment authorization by disabling Bluetooth at a specific point during a transaction. This could result in unauthorized use of laundry services and potential financial loss.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-290
References: https://github.com/niranjangaire1995/CVE-2025-46018-CSC-Pay-Mobile-App-Payment-Authentication-Bypass; https://www.cscsw.com/disclosure-process/
CVE: CVE-2025-45767
Published: 2025-08-01
Description: jose v6.0.10 was discovered to contain weak encryption. NOTE: this is disputed by a third party because the claim of "do not meet recommended security standards" does not reflect guidance in a final publication.
CVSS Score: 7.0 (HIGH)
CWE: CWE-327
References: https://gist.github.com/ZupeiNie/705a606fbb99f3bb8c9b51e5bc13c91d; https://gist.github.com/ZupeiNie/705a606fbb99f3bb8c9b51e5bc13c91d?permalink_comment_id=5711572#gistcomment-5711572; https://github.com/panva
CVE: CVE-2019-19144
Published: 2025-08-01
Description: XML External Entity Injection vulnerability in Quantum DXi6702 2.3.0.3 (11449-53631 Build304) devices via rest/Users?action=authenticate.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-776
References: https://github.com/atredispartners/advisories/blob/master/ATREDIS-2019-0004.md; https://www.quantum.com/products/disk-basedbackup/dxi6700/index.aspx; https://github.com/atredispartners/advisories/blob/master/ATREDIS-2019-0004.md
CVE: CVE-2025-44139
Published: 2025-08-01
Description: Emlog Pro V2.5.7 is vulnerable to Unrestricted Upload of File with Dangerous Type via /emlog/admin/plugin.php?action=upload_zip
CVSS Score: 7.2 (HIGH)
CWE: CWE-434
References: http://emlog.com; https://gist.github.com/babapihai/b56121e0b2694e2be22571057d05298e; https://gist.github.com/babapihai/b56121e0b2694e2be22571057d05298e
CVE: CVE-2025-50460
Published: 2025-08-01
Description: A remote code execution (RCE) vulnerability exists in the ms-swift project version 3.3.0 due to unsafe deserialization in tests/run.py using yaml.load() from the PyYAML library (versions = 5.3.1). If an attacker can control the content of the YAML configuration file passed to the --run_config parameter, arbitrary code can be executed during deserialization. This can lead to full system compromise. The vulnerability is triggered when a malicious YAML file is loaded, allowing the execution of arbitrary Python commands such as os.system(). It is recommended to upgrade PyYAML to version 5.4 or higher, and to use yaml.safe_load() to mitigate the issue.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://github.com/Anchor0221/CVE-2025-50460; https://github.com/advisories/GHSA-6757-jp84-gxfx; https://github.com/modelscope/ms-swift
CVE: CVE-2025-50472
Published: 2025-08-01
Description: The modelscope/ms-swift library thru 2.6.1 is vulnerable to arbitrary code execution through deserialization of untrusted data within the `load_model_meta()` function of the `ModelFileSystemCache()` class. Attackers can execute arbitrary code and commands by crafting a malicious serialized `.mdl` payload, exploiting the use of `pickle.load()` on data from potentially untrusted sources. This vulnerability allows for remote code execution (RCE) by deceiving victims into loading a seemingly harmless checkpoint during a normal training process, thereby enabling attackers to execute arbitrary code on the targeted machine. Note that the payload file is a hidden file, making it difficult for the victim to detect tampering. More importantly, during the model training process, after the `.mdl` file is loaded and executes arbitrary code, the normal training process remains unaffected'meaning the user remains unaware of the arbitrary code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://github.com/modelscope/ms-swift/blob/ab38bff0387a86fd9f068246c326ee7b0d5ed139/swift/hub/utils/caching.py#L141; https://github.com/xhjy2020/CVE-2025-50472
CVE: CVE-2025-52327
Published: 2025-08-01
Description: SQL Injection vulnerability in Restaurant Order System 1.0 allows a local attacker to obtain sensitive information via the payment.php file
CVSS Score: 7.8 (HIGH)
CWE: CWE-89
References: http://restaurant.com; https://code-projects.org/real-estate-property-management-system-php-source-code/; https://gist.github.com/babapihai/d604a43d884a9e20c234f33865584db4
CVE: CVE-2025-52361
Published: 2025-08-01
Description: Insecure permissions in the script /etc/init.d/lighttpd in AK-Nord USB-Server-LXL Firmware v0.0.16 Build 2023-03-13 allows a locally authenticated low-privilege user to execute arbitrary commands with root privilege via editing this script which is executed with root-privileges on any interaction and on every system boot.
CVSS Score: 7.8 (HIGH)
CWE: CWE-276
References: https://seclists.org/fulldisclosure/2025/Jul/20; https://www.ak-nord.de/usbserver-usb--usb-converter--usb-auf-ethernet--usb-to-ethernet--usb-auf-lan--usb-server--usb-konverter--print-server-80.html; http://seclists.org/fulldisclosure/2025/Jul/20
CVE: CVE-2025-52390
Published: 2025-08-01
Description: Saurus CMS Community Edition since commit d886e5b0 (2010-04-23) is vulnerable to a SQL Injection vulnerability in the `prepareSearchQuery()` method in `FulltextSearch.class.php`. The application directly concatenates user-supplied input (`$search_word`) into SQL queries without sanitization, allowing attackers to manipulate the SQL logic and potentially extract sensitive information or escalate their privileges.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-89
References: https://github.com/sauruscms/Saurus-CMS-Community-Edition/blob/d886e5b0c1e2b42cd74e2184e7c81c720cd9de6b/classes/FulltextSearch.class.php#L331; https://github.com/theharshkothari/vulnerability-research/blob/main/CVE-2025-52390.md