deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-27166
Published: 2025-03-11
Description: InDesign Desktop versions ID20.1, ID19.5.2 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://helpx.adobe.com/security/products/indesign/apsb25-19.html
CVE: CVE-2025-27167
Published: 2025-03-11
Description: Illustrator versions 29.2.1, 28.7.4 and earlier are affected by an Untrusted Search Path vulnerability that might allow attackers to execute their own programs, access unauthorized data files, or modify configuration in unexpected ways. If the application uses a search path to locate critical resources such as programs, then an attacker could modify that search path to point to a malicious program, which the targeted application would then execute. The problem extends to any type of critical resource that the application trusts.
CVSS Score: 7.8 (HIGH)
CWE: CWE-426
References: https://helpx.adobe.com/security/products/illustrator/apsb25-17.html
CVE: CVE-2025-27168
Published: 2025-03-11
Description: Illustrator versions 29.2.1, 28.7.4 and earlier are affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://helpx.adobe.com/security/products/illustrator/apsb25-17.html
CVE: CVE-2025-27169
Published: 2025-03-11
Description: Illustrator versions 29.2.1, 28.7.4 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://helpx.adobe.com/security/products/illustrator/apsb25-17.html
CVE: CVE-2025-27170
Published: 2025-03-11
Description: Illustrator versions 29.2.1, 28.7.4 and earlier are affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial of service condition. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://helpx.adobe.com/security/products/illustrator/apsb25-17.html
CVE: CVE-2025-27171
Published: 2025-03-11
Description: InDesign Desktop versions ID20.1, ID19.5.2 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122, CWE-787
References: https://helpx.adobe.com/security/products/indesign/apsb25-19.html
CVE: CVE-2025-27174
Published: 2025-03-11
Description: Acrobat Reader versions 24.001.30225, 20.005.30748, 25.001.20428 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://helpx.adobe.com/security/products/acrobat/apsb25-14.html
CVE: CVE-2025-27175
Published: 2025-03-11
Description: InDesign Desktop versions ID20.1, ID19.5.2 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://helpx.adobe.com/security/products/indesign/apsb25-19.html
CVE: CVE-2025-27176
Published: 2025-03-11
Description: InDesign Desktop versions ID20.1, ID19.5.2 and earlier are affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://helpx.adobe.com/security/products/indesign/apsb25-19.html
CVE: CVE-2025-27177
Published: 2025-03-11
Description: InDesign Desktop versions ID20.1, ID19.5.2 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122, CWE-787
References: https://helpx.adobe.com/security/products/indesign/apsb25-19.html
CVE: CVE-2025-27178
Published: 2025-03-11
Description: InDesign Desktop versions ID20.1, ID19.5.2 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://helpx.adobe.com/security/products/indesign/apsb25-19.html
CVE: CVE-2025-27179
Published: 2025-03-11
Description: InDesign Desktop versions ID20.1, ID19.5.2 and earlier are affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://helpx.adobe.com/security/products/indesign/apsb25-19.html
CVE: CVE-2025-27439
Published: 2025-03-11
Description: Buffer underflow in some Zoom Workplace Apps may allow an authenticated user to conduct an escalation of privilege via network access.
CVSS Score: 8.5 (HIGH)
CWE: CWE-124
References: https://www.zoom.com/en/trust/security-bulletin/zsb-25011/
CVE: CVE-2025-27440
Published: 2025-03-11
Description: Heap overflow in some Zoom Workplace Apps may allow an authenticated user to conduct an escalation of privilege via network access.
CVSS Score: 8.5 (HIGH)
CWE: CWE-124
References: https://www.zoom.com/en/trust/security-bulletin/zsb-25011/
CVE: CVE-2025-27591
Published: 2025-03-11
Description: A privilege escalation vulnerability existed in the Below service prior to v0.9.0 due to the creation of a world-writable directory at /var/log/below. This could have allowed local unprivileged users to escalate to root privileges through symlink attacks that manipulate files such as /etc/shadow.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-732
References: https://github.com/facebookincubator/below/commit/da9382e6e3e332fd2c3195e22f34977f83f0f1f3; https://www.facebook.com/security/advisories/cve-2025-27591; http://www.openwall.com/lists/oss-security/2025/03/12/1
CVE: CVE-2025-27773
Published: 2025-03-11
Description: The SimpleSAMLphp SAML2 library is a PHP library for SAML2 related functionality. Prior to versions 4.17.0 and 5.0.0-alpha.20, there is a signature confusion attack in the HTTPRedirect binding. An attacker with any signed SAMLResponse via the HTTP-Redirect binding can cause the application to accept an unsigned message. Versions 4.17.0 and 5.0.0-alpha.20 contain a fix for the issue.
CVSS Score: 8.6 (HIGH)
CWE: CWE-347
References: https://github.com/simplesamlphp/saml2/blob/9545abd0d9d48388f2fa00469c5c1e0294f0303e/src/SAML2/HTTPRedirect.php#L104-L113; https://github.com/simplesamlphp/saml2/blob/9545abd0d9d48388f2fa00469c5c1e0294f0303e/src/SAML2/HTTPRedirect.php#L178-L217; https://github.com/simplesamlphp/saml2/commit/7867d6099dc7f31bed1ea10e5bea159c5623d2a0
CVE: CVE-2025-23242
Published: 2025-03-11
Description: NVIDIA Riva contains a vulnerability where a user could cause an improper access control issue. A successful exploit of this vulnerability might lead to escalation of privileges, data tampering, denial of service, or information disclosure.
CVSS Score: 7.3 (HIGH)
CWE: CWE-284
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5625
CVE: CVE-2025-23243
Published: 2025-03-11
Description: NVIDIA Riva contains a vulnerability where a user could cause an improper access control issue. A successful exploit of this vulnerability might lead to data tampering or denial of service.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-284
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5625
CVE: CVE-2025-23360
Published: 2025-03-11
Description: NVIDIA Nemo Framework contains a vulnerability where a user could cause a relative path traversal issue by arbitrary file write. A successful exploit of this vulnerability may lead to code execution and data tampering.
CVSS Score: 7.1 (HIGH)
CWE: CWE-23
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5623
CVE: CVE-2025-25925
Published: 2025-03-11
Description: A stored cross-scripting (XSS) vulnerability in Openmrs v2.4.3 Build 0ff0ed allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the personName.middleName parameter at /openmrs/admin/patients/shortPatientForm.form.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: http://openmrs.com; https://github.com/johnchd/CVEs/blob/main/OpenMRS/CVE-2025-25925%20-%20P-XSS.md; https://github.com/johnchd/CVEs/blob/main/OpenMRS/CVE-2025-25925%20-%20P-XSS.md
CVE: CVE-2025-25927
Published: 2025-03-11
Description: A Cross-Site Request Forgery (CSRF) in Openmrs 2.4.3 Build 0ff0ed allows attackers to execute arbitrary operations via a crafted GET request.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: https://github.com/johnchd/CVEs/blob/main/OpenMRS/CVE-2025-25927%20-%20CSRF%20via%20GET.md; https://github.com/johnchd/CVEs/blob/main/OpenMRS/CVE-2025-25927%20-%20CSRF%20via%20GET.md
CVE: CVE-2025-25928
Published: 2025-03-11
Description: A Cross-Site Request Forgery (CSRF) in the component /admin/users/user.form of Openmrs 2.4.3 Build 0ff0ed allows attackers to execute arbitrary operations via a crafted request. In this case, an attacker could elevate a low-privileged account to an administrative role by leveraging the CSRF vulnerability at the /admin/users/user.form endpoint.
CVSS Score: 8.0 (HIGH)
CWE: CWE-352
References: https://github.com/johnchd/CVEs/blob/main/OpenMRS/CVE-2025-25928%20-%20CSRF%20PrivEsc.md; https://github.com/johnchd/CVEs/blob/main/OpenMRS/CVE-2025-25928%20-%20CSRF%20PrivEsc.md
CVE: CVE-2025-25929
Published: 2025-03-11
Description: A reflected cross-site scripting (XSS) vulnerability in the component /legacyui/quickReportServlet of Openmrs 2.4.3 Build 0ff0ed allows attackers to execute arbitrary JavaScript in the context of a user's browser via a crafted payload injected into the reportType parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/johnchd/CVEs/blob/main/OpenMRS/CVE-2025-25929%20-%20R-XSS.md; https://github.com/johnchd/CVEs/blob/main/OpenMRS/CVE-2025-25929%20-%20R-XSS.md
CVE: CVE-2025-27789
Published: 2025-03-11
Description: Babel is a compiler for writing next generation JavaScript. When using versions of Babel prior to 7.26.10 and 8.0.0-alpha.17 to compile regular expression named capturing groups, Babel will generate a polyfill for the `.replace` method that has quadratic complexity on some specific replacement pattern strings (i.e. the second argument passed to `.replace`). Generated code is vulnerable if all the following conditions are true: Using Babel to compile regular expression named capturing groups, using the `.replace` method on a regular expression that contains named capturing groups, and the code using untrusted strings as the second argument of `.replace`. This problem has been fixed in `@babel/helpers` and `@babel/runtime` 7.26.10 and 8.0.0-alpha.17. It's likely that individual users do not directly depend on `@babel/helpers`, and instead depend on `@babel/core` (which itself depends on `@babel/helpers`). Upgrading to `@babel/core` 7.26.10 is not required, but it guarantees use of a new enough `@babel/helpers` version. Note that just updating Babel dependencies is not enough; one will also need to re-compile the code. No known workarounds are available.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-1333
References: https://github.com/babel/babel/pull/17173; https://github.com/babel/babel/security/advisories/GHSA-968p-4wvh-cqc8
CVE: CVE-2025-2206
Published: 2025-03-11
Description: A vulnerability classified as problematic has been found in aitangbao springboot-manager 3.0. This affects an unknown part of the file /sys/permission. The manipulation of the argument name leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 2.4 (LOW)
CWE: CWE-79, CWE-94, CWE-79
References: https://github.com/uglory-gll/javasec/blob/main/spring-manage.md; https://vuldb.com/?ctiid.299277; https://vuldb.com/?id.299277
CVE: CVE-2025-2207
Published: 2025-03-11
Description: A vulnerability classified as problematic was found in aitangbao springboot-manager 3.0. This vulnerability affects unknown code of the file /sys/dept. The manipulation of the argument name leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 2.4 (LOW)
CWE: CWE-79, CWE-94, CWE-79
References: https://github.com/uglory-gll/javasec/blob/main/spring-manage.md; https://vuldb.com/?ctiid.299278; https://vuldb.com/?id.299278
CVE: CVE-2025-0900
Published: 2025-03-11
Description: PDF-XChange Editor PDF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of PDF files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-25368.
CVSS Score: 3.3 (LOW)
CWE: CWE-125
References: https://www.zerodayinitiative.com/advisories/ZDI-25-086/
CVE: CVE-2025-21170
Published: 2025-03-11
Description: Substance3D - Modeler versions 1.15.0 and earlier are affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://helpx.adobe.com/security/products/substance3d-modeler/apsb25-21.html
CVE: CVE-2025-27173
Published: 2025-03-11
Description: Substance3D - Modeler versions 1.15.0 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122
References: https://helpx.adobe.com/security/products/substance3d-modeler/apsb25-21.html
CVE: CVE-2025-27180
Published: 2025-03-11
Description: Substance3D - Modeler versions 1.15.0 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/substance3d-modeler/apsb25-21.html
CVE: CVE-2025-27181
Published: 2025-03-11
Description: Substance3D - Modeler versions 1.15.0 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://helpx.adobe.com/security/products/substance3d-modeler/apsb25-21.html
CVE: CVE-2025-28856
Published: 2025-03-11
Description: Cross-Site Request Forgery (CSRF) vulnerability in dangrossman W3Counter Free Real-Time Web Stats blog-stats-by-w3counter allows Cross Site Request Forgery.This issue affects W3Counter Free Real-Time Web Stats: from n/a through <= 4.1.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/blog-stats-by-w3counter/vulnerability/wordpress-w3counter-free-real-time-web-stats-plugin-4-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-28857
Published: 2025-03-11
Description: Cross-Site Request Forgery (CSRF) vulnerability in rankchecker Rankchecker.io Integration rankchecker-io-integration allows Stored XSS.This issue affects Rankchecker.io Integration: from n/a through <= 1.0.9.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/rankchecker-io-integration/vulnerability/wordpress-rankchecker-io-integration-plugin-1-0-9-csrf-to-stored-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-28859
Published: 2025-03-11
Description: Cross-Site Request Forgery (CSRF) vulnerability in CodeVibrant Maintenance Notice maintenance-notice allows Cross Site Request Forgery.This issue affects Maintenance Notice: from n/a through <= 1.0.6.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/maintenance-notice/vulnerability/wordpress-maintenance-notice-plugin-1-0-5-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-28860
Published: 2025-03-11
Description: Cross-Site Request Forgery (CSRF) vulnerability in PPDPurveyor Google News Editors Picks Feed Generator google-news-editors-picks-news-feeds allows Stored XSS.This issue affects Google News Editors Picks Feed Generator: from n/a through <= 2.1.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/google-news-editors-picks-news-feeds/vulnerability/wordpress-google-news-editors-picks-feed-generator-plugin-2-1-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE: CVE-2025-28861
Published: 2025-03-11
Description: Cross-Site Request Forgery (CSRF) vulnerability in bhzad WP jQuery Persian Datepicker wpjqp-datepicker allows Stored XSS.This issue affects WP jQuery Persian Datepicker: from n/a through <= 0.1.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/wpjqp-datepicker/vulnerability/wordpress-wp-jquery-persian-datepicker-plugin-0-1-0-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE: CVE-2025-28862
Published: 2025-03-11
Description: Cross-Site Request Forgery (CSRF) vulnerability in Venugopal Comment Date and Gravatar remover remove-date-and-gravatar-under-comment allows Cross Site Request Forgery.This issue affects Comment Date and Gravatar remover: from n/a through <= 1.0.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/remove-date-and-gravatar-under-comment/vulnerability/wordpress-comment-date-and-gravatar-remover-plugin-1-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-28863
Published: 2025-03-11
Description: Cross-Site Request Forgery (CSRF) vulnerability in Carlos Minatti Delete Original Image delete-original-image allows Cross Site Request Forgery.This issue affects Delete Original Image: from n/a through <= 0.4.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/delete-original-image/vulnerability/wordpress-delete-original-image-plugin-0-4-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-28864
Published: 2025-03-11
Description: Cross-Site Request Forgery (CSRF) vulnerability in planetstudio Builder for Contact Form 7 by Webconstruct cf7-builder allows Cross Site Request Forgery.This issue affects Builder for Contact Form 7 by Webconstruct: from n/a through <= 1.2.2.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/cf7-builder/vulnerability/wordpress-builder-for-contact-form-7-by-webconstruct-plugin-1-2-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-28866
Published: 2025-03-11
Description: Cross-Site Request Forgery (CSRF) vulnerability in smerriman Login Logger login-logger allows Cross Site Request Forgery.This issue affects Login Logger: from n/a through <= 1.2.1.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/login-logger/vulnerability/wordpress-login-logger-plugin-1-2-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-28867
Published: 2025-03-11
Description: Cross-Site Request Forgery (CSRF) vulnerability in stesvis Frontpage category filter frontpage-category-filter allows Cross Site Request Forgery.This issue affects Frontpage category filter: from n/a through <= 1.0.2.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/frontpage-category-filter/vulnerability/wordpress-frontpage-category-filter-plugin-1-0-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-28868
Published: 2025-03-11
Description: Cross-Site Request Forgery (CSRF) vulnerability in ZipList ZipList Recipe ziplist-recipe-plugin allows Cross Site Request Forgery.This issue affects ZipList Recipe: from n/a through <= 3.1.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/ziplist-recipe-plugin/vulnerability/wordpress-ziplist-recipe-plugin-3-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-28870
Published: 2025-03-11
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in amocrm amoCRM WebForm amocrm-webform allows DOM-Based XSS.This issue affects amoCRM WebForm: from n/a through <= 1.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/amocrm-webform/vulnerability/wordpress-amocrm-webform-plugin-1-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-28871
Published: 2025-03-11
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in jwpegram Block Spam By Math Reloaded block-spam-by-math-reloaded allows Stored XSS.This issue affects Block Spam By Math Reloaded: from n/a through <= 2.2.4.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/block-spam-by-math-reloaded/vulnerability/wordpress-block-spam-by-math-reloaded-plugin-2-2-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-28872
Published: 2025-03-11
Description: Missing Authorization vulnerability in jwpegram Block Spam By Math Reloaded block-spam-by-math-reloaded allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Block Spam By Math Reloaded: from n/a through <= 2.2.4.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/block-spam-by-math-reloaded/vulnerability/wordpress-block-spam-by-math-reloaded-plugin-2-2-4-broken-access-control-vulnerability?_s_id=cve