deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-36998
Published: 2025-01-22
Description: The NextEPC MME <= 1.0.1 (fixed in commit a8492c9c5bc0a66c6999cb5a263545b32a4109df) contains a stack-based buffer overflow vulnerability in the Emergency Number List decoding method. An attacker may send a NAS message containing an oversized Emergency Number List value to the MME to overwrite the stack with arbitrary bytes. An attacker with a cellphone connection to any base station managed by the MME may exploit this vulnerability without having to authenticate with the LTE core.
CVSS Score: 8.9 (HIGH)
CWE: CWE-121
References: http://nextepc.com; https://cellularsecurity.org/ransacked
CVE: CVE-2023-37002
Published: 2025-01-22
Description: Open5GS MME versions <= 2.6.4 contain an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. An attacker may send an `E-RAB Modification Indication` message missing a required `MME_UE_S1AP_ID` field to repeatedly crash the MME, resulting in denial of service.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-617
References: https://cellularsecurity.org/ransacked
CVE: CVE-2023-37003
Published: 2025-01-22
Description: Open5GS MME versions <= 2.6.4 contain an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. An attacker may send an `E-RAB Setup Response` message missing a required `MME_UE_S1AP_ID` field to repeatedly crash the MME, resulting in denial of service.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-617
References: https://cellularsecurity.org/ransacked
CVE: CVE-2023-37004
Published: 2025-01-22
Description: Open5GS MME versions <= 2.6.4 contain an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. An attacker may send an `Initial Context Setup Response` message missing a required `MME_UE_S1AP_ID` field to repeatedly crash the MME, resulting in denial of service.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-617
References: https://cellularsecurity.org/ransacked
CVE: CVE-2023-37005
Published: 2025-01-22
Description: Open5GS MME versions <= 2.6.4 contain an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. An attacker may send an `Initial Context Setup Failure` message missing a required `MME_UE_S1AP_ID` field to repeatedly crash the MME, resulting in denial of service.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-617
References: https://cellularsecurity.org/ransacked
CVE: CVE-2023-37006
Published: 2025-01-22
Description: Open5GS MME versions <= 2.6.4 contain an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. An attacker may send a `Handover Request Ack` message missing a required `MME_UE_S1AP_ID` field to repeatedly crash the MME, resulting in denial of service.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-617
References: https://cellularsecurity.org/ransacked
CVE: CVE-2023-37007
Published: 2025-01-22
Description: Open5GS MME versions <= 2.6.4 contain an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. An attacker may send a `Handover Cancel` message missing a required `MME_UE_S1AP_ID` field to repeatedly crash the MME, resulting in denial of service.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-617
References: https://cellularsecurity.org/ransacked
CVE: CVE-2023-37008
Published: 2025-01-22
Description: Open5GS MME versions <= 2.6.4 contain a buffer overflow in the ASN.1 deserialization function of the S1AP handler. This buffer overflow causes type confusion in decoded fields, leading to invalid parsing and freeing of memory. An attacker may use this to crash an MME or potentially execute code in certain circumstances.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-617
References: https://cellularsecurity.org/ransacked
CVE: CVE-2023-37009
Published: 2025-01-22
Description: Open5GS MME versions <= 2.6.4 contain an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. An attacker may send a `Handover Notification` message missing a required `MME_UE_S1AP_ID` field to repeatedly crash the MME, resulting in denial of service.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-617
References: https://cellularsecurity.org/ransacked
CVE: CVE-2023-37010
Published: 2025-01-22
Description: Open5GS MME versions <= 2.6.4 contain an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. An attacker may send an `eNB Status Transfer` message missing a required `MME_UE_S1AP_ID` field to repeatedly crash the MME, resulting in denial of service.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-617
References: https://cellularsecurity.org/ransacked
CVE: CVE-2023-37011
Published: 2025-01-22
Description: Open5GS MME versions <= 2.6.4 contain an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. An attacker may send a `Handover Required` message missing a required `MME_UE_S1AP_ID` field to repeatedly crash the MME, resulting in denial of service.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-617
References: https://cellularsecurity.org/ransacked
CVE: CVE-2023-37012
Published: 2025-01-22
Description: Open5GS MME versions <= 2.6.4 contain an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. An attacker may send an `Initial UE Message` message missing a required `PLMN Identity` field to repeatedly crash the MME, resulting in denial of service.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-617
References: https://cellularsecurity.org/ransacked
CVE: CVE-2023-37013
Published: 2025-01-22
Description: Open5GS MME versions <= 2.6.4 contains an assertion that can be remotely triggered via a sufficiently large ASN.1 packet over the S1AP interface. An attacker may repeatedly send such an oversized packet to cause the `ogs_sctp_recvmsg` routine to reach an unexpected network state and crash, leading to denial of service.
CVSS Score: 7.3 (HIGH)
CWE: CWE-617
References: https://cellularsecurity.org/ransacked
CVE: CVE-2023-37014
Published: 2025-01-22
Description: Open5GS MME versions <= 2.6.4 contains an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. An attacker may send a `UE Context Release Request` message missing a required `MME_UE_S1AP_ID` field to repeatedly crash the MME, resulting in denial of service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://cellularsecurity.org/ransacked
CVE: CVE-2023-37015
Published: 2025-01-22
Description: Open5GS MME versions <= 2.6.4 contains an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. An attacker may send a `Path Switch Request` message missing a required `MME_UE_S1AP_ID` field to repeatedly crash the MME, resulting in denial of service.
CVSS Score: 8.6 (HIGH)
CWE: CWE-617
References: https://cellularsecurity.org/ransacked
CVE: CVE-2023-37016
Published: 2025-01-22
Description: Open5GS MME versions <= 2.6.4 contain an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. An attacker may send a `UE Context Modification Response` message missing a required `MME_UE_S1AP_ID` field to repeatedly crash the MME, resulting in denial of service.
CVSS Score: 8.6 (HIGH)
CWE: CWE-617
References: https://cellularsecurity.org/ransacked
CVE: CVE-2023-37017
Published: 2025-01-22
Description: Open5GS MME versions <= 2.6.4 contain an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. An attacker may send an `S1Setup Request` message missing a required `Global eNB ID` field to repeatedly crash the MME, resulting in denial of service.
CVSS Score: 8.6 (HIGH)
CWE: CWE-617
References: https://cellularsecurity.org/ransacked
CVE: CVE-2023-37018
Published: 2025-01-22
Description: Open5GS MME versions <= 2.6.4 contains an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. An attacker may send a `UE Capability Info Indication` message missing a required `MME_UE_S1AP_ID` field to repeatedly crash the MME, resulting in denial of service.
CVSS Score: 8.6 (HIGH)
CWE: CWE-617
References: https://cellularsecurity.org/ransacked
CVE: CVE-2023-37019
Published: 2025-01-22
Description: Open5GS MME versions <= 2.6.4 contains an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. An attacker may send an `S1Setup Request` message missing a required `Supported TAs` field to repeatedly crash the MME, resulting in denial of service.
CVSS Score: 8.6 (HIGH)
CWE: CWE-617
References: https://cellularsecurity.org/ransacked
CVE: CVE-2023-37020
Published: 2025-01-22
Description: Open5GS MME versions <= 2.6.4 contain an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. An attacker may send a `UE Context Release Complete` message missing a required `MME_UE_S1AP_ID` field to repeatedly crash the MME, resulting in denial of service.
CVSS Score: 8.6 (HIGH)
CWE: CWE-617
References: https://cellularsecurity.org/ransacked
CVE: CVE-2023-37021
Published: 2025-01-22
Description: Open5GS MME version <= 2.6.4 contains an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. An attacker may send a `UE Context Modification Failure` message missing a required `MME_UE_S1AP_ID` field to repeatedly crash the MME, resulting in denial of service.
CVSS Score: 8.6 (HIGH)
CWE: CWE-617
References: https://cellularsecurity.org/ransacked
CVE: CVE-2023-37022
Published: 2025-01-22
Description: Open5GS MME versions <= 2.6.4 contain a reachable assertion in the `UE Context Release Request` packet handler. A packet containing an invalid `MME_UE_S1AP_ID` field causes Open5gs to crash; an attacker may repeatedly send such packets to cause denial of service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://cellularsecurity.org/ransacked
CVE: CVE-2023-37023
Published: 2025-01-22
Description: Open5GS MME versions <= 2.6.4 contain a reachable assertion in the `Uplink NAS Transport` packet handler. A packet missing its `MME_UE_S1AP_ID` field causes Open5gs to crash; an attacker may repeatedly send such packets to cause denial of service.
CVSS Score: 8.6 (HIGH)
CWE: CWE-617
References: https://cellularsecurity.org/ransacked
CVE: CVE-2024-24430
Published: 2025-01-22
Description: A reachable assertion in the mme_ue_find_by_imsi function of Open5GS <= 2.6.4 allows attackers to cause a Denial of Service (DoS) via a crafted NAS packet.
CVSS Score: 7.5 (HIGH)
CWE: CWE-617
References: https://cellularsecurity.org/ransacked; https://cellularsecurity.org/ransacked
CVE: CVE-2024-24432
Published: 2025-01-22
Description: A reachable assertion in the ogs_kdf_hash_mme function of Open5GS <= 2.6.4 allows attackers to cause a Denial of Service (DoS) via a crafted NAS packet.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-617
References: https://cellularsecurity.org/ransacked
CVE: CVE-2024-34235
Published: 2025-01-22
Description: Open5GS MME versions <= 2.6.4 contains an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. An attacker may send an `Initial UE Message` missing a required `NAS_PDU` field to repeatedly crash the MME, resulting in denial of service.
CVSS Score: 8.6 (HIGH)
CWE: CWE-617
References: https://cellularsecurity.org/ransacked
CVE: CVE-2025-0604
Published: 2025-01-22
Description: A flaw was found in Keycloak. When an Active Directory user resets their password, the system updates it without performing an LDAP bind to validate the new credentials against AD. This vulnerability allows users whose AD accounts are expired or disabled to regain access in Keycloak, bypassing AD restrictions. The issue enables authentication bypass and could allow unauthorized access under certain conditions.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-287
References: https://access.redhat.com/errata/RHSA-2025:2544; https://access.redhat.com/errata/RHSA-2025:2545; https://access.redhat.com/security/cve/CVE-2025-0604
CVE: CVE-2025-22772
Published: 2025-01-22
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in stephanemartinw Mapbox for WP Advanced mapbox-for-wp-advanced allows Reflected XSS.This issue affects Mapbox for WP Advanced: from n/a through <= 1.0.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/mapbox-for-wp-advanced/vulnerability/wordpress-mapbox-for-wp-advanced-plugin-1-0-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-22980
Published: 2025-01-22
Description: A SQL Injection vulnerability exists in Senayan Library Management System SLiMS 9 Bulian 9.6.1 via the tempLoanID parameter in the loan form on /admin/modules/circulation/loan.php.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-89
References: https://github.com/slims/slims9_bulian/issues/270; https://mebroccoli.blogspot.com/2025/01/sql-injection-vulnerability-in-senayan.html
CVE: CVE-2025-23449
Published: 2025-01-22
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in davidpuc Simple shortcode buttons simple-shortcode-buttons allows Reflected XSS.This issue affects Simple shortcode buttons: from n/a through <= 1.3.2.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/simple-shortcode-buttons/vulnerability/wordpress-simple-shortcode-buttons-plugin-1-3-2-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-23462
Published: 2025-01-22
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Anil Jailta FWD Slider fwd-slider allows Reflected XSS.This issue affects FWD Slider: from n/a through <= 1.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/fwd-slider/vulnerability/wordpress-fwd-slider-plugin-1-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-23475
Published: 2025-01-22
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in fireantology History timeline history-timeline allows Reflected XSS.This issue affects History timeline: from n/a through <= 0.7.2.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/history-timeline/vulnerability/wordpress-history-timeline-plugin-0-7-2-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-23486
Published: 2025-01-22
Description: Missing Authorization vulnerability in tamlyn Database Sync database-sync allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Database Sync: from n/a through <= 0.5.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/database-sync/vulnerability/wordpress-database-sync-plugin-0-5-1-sensitive-data-exposure-vulnerability?_s_id=cve
CVE: CVE-2025-23495
Published: 2025-01-22
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Chetan Khandla WooCommerce Order Search woocommerce-order-searching allows Reflected XSS.This issue affects WooCommerce Order Search: from n/a through <= 1.1.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/woocommerce-order-searching/vulnerability/wordpress-woocommerce-order-search-plugin-1-1-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-23498
Published: 2025-01-22
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ContentLocalized Translation.Pro translation-pro allows Reflected XSS.This issue affects Translation.Pro: from n/a through <= 1.0.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/translation-pro/vulnerability/wordpress-translation-pro-plugin-1-0-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-23500
Published: 2025-01-22
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in faaiq Simple Custom post type custom field simple-content-construction-kit allows Reflected XSS.This issue affects Simple Custom post type custom field: from n/a through <= 1.0.3.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/simple-content-construction-kit/vulnerability/wordpress-simple-custom-post-type-custom-field-plugin-1-0-3-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-23503
Published: 2025-01-22
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in osolwordpress Customizable Captcha and Contact Us customizable-captcha-and-contact-us-form allows Reflected XSS.This issue affects Customizable Captcha and Contact Us: from n/a through <= 1.0.2.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/customizable-captcha-and-contact-us-form/vulnerability/wordpress-customizable-captcha-and-contact-us-plugin-1-0-2-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-23506
Published: 2025-01-22
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in imsoftware WP IMAP Auth wp-imap-authentication allows Reflected XSS.This issue affects WP IMAP Auth: from n/a through <= 4.0.1.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wp-imap-authentication/vulnerability/wordpress-wp-imap-auth-plugin-4-0-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-23507
Published: 2025-01-22
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Blrt Blrt WP Embed blrt-wp-embed allows Reflected XSS.This issue affects Blrt WP Embed: from n/a through <= 1.6.9.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/blrt-wp-embed/vulnerability/wordpress-blrt-wp-embed-plugin-1-6-9-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-23509
Published: 2025-01-22
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in siteheart HyperComments comments-with-hypercommentscom allows Reflected XSS.This issue affects HyperComments: from n/a through <= 0.9.6.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/comments-with-hypercommentscom/vulnerability/wordpress-hypercomments-plugin-0-9-6-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-23512
Published: 2025-01-22
Description: Missing Authorization vulnerability in 118group Team 118GROUP Agent team-118group-agent allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Team 118GROUP Agent: from n/a through <= 1.6.0.
CVSS Score: 7.5 (HIGH)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/team-118group-agent/vulnerability/wordpress-team-118group-agent-plugin-1-6-0-arbitrary-content-deletion-vulnerability?_s_id=cve
CVE: CVE-2025-23535
Published: 2025-01-22
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in martin_ziegert REAL WordPress Sidebar drag-and-drop-custom-sidebar allows Stored XSS.This issue affects REAL WordPress Sidebar: from n/a through <= 0.1.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/drag-and-drop-custom-sidebar/vulnerability/wordpress-real-wordpress-sidebar-plugin-0-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-23548
Published: 2025-01-22
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bilal TAS Responsivity responsivity allows Reflected XSS.This issue affects Responsivity: from n/a through <= 0.0.6.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/responsivity/vulnerability/wordpress-responsivity-plugin-0-0-6-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-23562
Published: 2025-01-22
Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in pitinca XLSXviewer xlsx-viewer allows Path Traversal.This issue affects XLSXviewer: from n/a through <= 2.1.1.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-22
References: https://patchstack.com/database/Wordpress/Plugin/xlsx-viewer/vulnerability/wordpress-xlsxviewer-plugin-2-1-1-arbitrary-file-deletion-vulnerability?_s_id=cve
CVE: CVE-2025-23578
Published: 2025-01-22
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bastien Ho Custom CSS Addons css-addons allows Reflected XSS.This issue affects Custom CSS Addons: from n/a through <= 1.9.1.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/css-addons/vulnerability/wordpress-custom-css-addons-plugin-1-9-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-23583
Published: 2025-01-22
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Explara Explara Membership explara-membership allows Reflected XSS.This issue affects Explara Membership: from n/a through <= 0.0.7.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/explara-membership/vulnerability/wordpress-explara-membership-plugin-0-0-7-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-23589
Published: 2025-01-22
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in markugwuanyi ContentOptin Lite contentoptin allows Reflected XSS.This issue affects ContentOptin Lite: from n/a through <= 1.1.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/contentoptin/vulnerability/wordpress-contentoptin-lite-plugin-1-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-23592
Published: 2025-01-22
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in animexxx dForms dforms allows Reflected XSS.This issue affects dForms: from n/a through <= 1.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/dforms/vulnerability/wordpress-dforms-plugin-1-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-23597
Published: 2025-01-22
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sabareesha Rio Photo Gallery rio-photo-gallery allows Reflected XSS.This issue affects Rio Photo Gallery: from n/a through <= 0.1.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/rio-photo-gallery/vulnerability/wordpress-rio-photo-gallery-plugin-0-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-23601
Published: 2025-01-22
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in patrice Tab My Content tab-my-content allows Reflected XSS.This issue affects Tab My Content: from n/a through <= 1.0.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/tab-my-content/vulnerability/wordpress-tab-my-content-plugin-1-0-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-23602
Published: 2025-01-22
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Europe Ecologie Les Verts EELV Newsletter eelv-newsletter allows Reflected XSS.This issue affects EELV Newsletter: from n/a through <= 4.8.2.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/eelv-newsletter/vulnerability/wordpress-eelv-newsletter-plugin-4-8-2-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve