deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-53281
Published: 2025-06-27
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in WPBean WPB Category Slider for WooCommerce wpb-woocommerce-category-slider allows PHP Local File Inclusion.This issue affects WPB Category Slider for WooCommerce: from n/a through <= 1.71.
CVSS Score: 7.5 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Plugin/wpb-woocommerce-category-slider/vulnerability/wordpress-wpb-category-slider-for-woocommerce-plugin-1-71-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-53282
Published: 2025-06-27
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in aviplugins.com Thumbnail Editor thumbnail-editor allows Stored XSS.This issue affects Thumbnail Editor: from n/a through <= 2.3.3.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/thumbnail-editor/vulnerability/wordpress-thumbnail-editor-plugin-2-3-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-53284
Published: 2025-06-27
Description: Missing Authorization vulnerability in pankaj.sakaria CMS Blocks cms-blocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CMS Blocks: from n/a through <= 1.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/cms-blocks/vulnerability/wordpress-cms-blocks-plugin-1-1-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-53285
Published: 2025-06-27
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in The Website Flip Add & Replace Affiliate Links for Amazon add-replace-affiliate-links-for-amazon allows Stored XSS.This issue affects Add & Replace Affiliate Links for Amazon: from n/a through <= 1.0.6.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/add-replace-affiliate-links-for-amazon/vulnerability/wordpress-add-replace-affiliate-links-for-amazon-plugin-1-0-6-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-53287
Published: 2025-06-27
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Robert Cummings Quick Favicon quick-favicon allows Stored XSS.This issue affects Quick Favicon: from n/a through <= 0.22.8.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/quick-favicon/vulnerability/wordpress-quick-favicon-plugin-0-22-8-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-53288
Published: 2025-06-27
Description: Missing Authorization vulnerability in Adrian Ladó PlatiOnline Payments plationline allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PlatiOnline Payments: from n/a through <= 7.0.0.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/plationline/vulnerability/wordpress-plationline-payments-plugin-6-3-2-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-53290
Published: 2025-06-27
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MS WP Visual Sitemap wp-visual-sitemap allows Stored XSS.This issue affects WP Visual Sitemap: from n/a through <= 1.0.2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wp-visual-sitemap/vulnerability/wordpress-wp-visual-sitemap-plugin-1-0-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-53292
Published: 2025-06-27
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in samsk WP DataTable wp-datatable allows DOM-Based XSS.This issue affects WP DataTable: from n/a through <= 0.2.7.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wp-datatable/vulnerability/wordpress-wp-datatable-plugin-0-2-7-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-53293
Published: 2025-06-27
Description: Missing Authorization vulnerability in Morten Dalgaard Johansen Dashboard Widget Sidebar dashboard-widget-sidebar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Dashboard Widget Sidebar: from n/a through <= 1.2.3.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/dashboard-widget-sidebar/vulnerability/wordpress-dashboard-widget-sidebar-plugin-1-2-3-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-53294
Published: 2025-06-27
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Smart Agenda Smart Agenda smart-agenda-prise-de-rendez-vous-en-ligne allows Stored XSS.This issue affects Smart Agenda: from n/a through <= 4.9.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/smart-agenda-prise-de-rendez-vous-en-ligne/vulnerability/wordpress-smart-agenda-plugin-4-9-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-53295
Published: 2025-06-27
Description: Missing Authorization vulnerability in iCount iCount Payment Gateway icount allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects iCount Payment Gateway: from n/a through <= 2.0.7.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/icount/vulnerability/wordpress-icount-payment-gateway-plugin-2-0-6-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-53296
Published: 2025-06-27
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ecoal95 EC Stars Rating ec-stars-rating allows Stored XSS.This issue affects EC Stars Rating: from n/a through <= 1.0.11.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/ec-stars-rating/vulnerability/wordpress-ec-stars-rating-plugin-1-0-11-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-53298
Published: 2025-06-27
Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in gioni Plugin Inspector plugin-inspector allows Path Traversal.This issue affects Plugin Inspector: from n/a through <= 1.5.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-22
References: https://patchstack.com/database/Wordpress/Plugin/plugin-inspector/vulnerability/wordpress-plugin-inspector-plugin-1-5-arbitrary-file-download-vulnerability?_s_id=cve
CVE: CVE-2025-53300
Published: 2025-06-27
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in douglaskarr Podcast Feed Player Widget and Shortcode podcast-feed-player-widget allows Stored XSS.This issue affects Podcast Feed Player Widget and Shortcode: from n/a through <= 2.2.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/podcast-feed-player-widget/vulnerability/wordpress-podcast-feed-player-widget-and-shortcode-plugin-2-2-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-53301
Published: 2025-06-27
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Theme Junkie Theme Junkie Team Content theme-junkie-team-content allows DOM-Based XSS.This issue affects Theme Junkie Team Content: from n/a through <= 0.1.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/theme-junkie-team-content/vulnerability/wordpress-theme-junkie-team-content-plugin-0-1-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-53304
Published: 2025-06-27
Description: Missing Authorization vulnerability in Rohil Contact Form – 7 : Hide Success Message contact-form-7-hide-success-message allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Contact Form – 7 : Hide Success Message: from n/a through <= 1.1.4.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/contact-form-7-hide-success-message/vulnerability/wordpress-contact-form-7-hide-success-message-plugin-1-1-4-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-53305
Published: 2025-06-27
Description: Cross-Site Request Forgery (CSRF) vulnerability in lucidcrew WP Forum  Server forum-server allows Stored XSS.This issue affects WP Forum  Server: from n/a through <= 1.8.2.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/forum-server/vulnerability/wordpress-wp-forum-server-plugin-1-8-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-53306
Published: 2025-06-27
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in lucidcrew WP Forum  Server forum-server allows SQL Injection.This issue affects WP Forum  Server: from n/a through <= 1.8.2.
CVSS Score: 7.6 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/forum-server/vulnerability/wordpress-wp-forum-server-plugin-1-8-2-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-53308
Published: 2025-06-27
Description: Cross-Site Request Forgery (CSRF) vulnerability in gopi_plus Image Slider With Description image-slider-with-description allows Stored XSS.This issue affects Image Slider With Description: from n/a through <= 9.2.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/image-slider-with-description/vulnerability/wordpress-image-slider-with-description-plugin-9-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-53309
Published: 2025-06-27
Description: Insertion of Sensitive Information Into Sent Data vulnerability in ZealousWeb Accept Stripe Payments Using Contact Form 7 accept-stripe-payments-using-contact-form-7 allows Retrieve Embedded Sensitive Data.This issue affects Accept Stripe Payments Using Contact Form 7: from n/a through <= 3.0.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-201
References: https://patchstack.com/database/Wordpress/Plugin/accept-stripe-payments-using-contact-form-7/vulnerability/wordpress-accept-stripe-payments-using-contact-form-7-plugin-3-0-sensitive-data-exposure-vulnerability?_s_id=cve
CVE: CVE-2025-53310
Published: 2025-06-27
Description: Cross-Site Request Forgery (CSRF) vulnerability in Funnnny HidePost hidepost allows Reflected XSS.This issue affects HidePost: from n/a through <= 2.3.8.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/hidepost/vulnerability/wordpress-hidepost-plugin-2-3-8-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-53311
Published: 2025-06-27
Description: Cross-Site Request Forgery (CSRF) vulnerability in Amol Nirmala Waman Navayan Subscribe navayan-subscribe allows Stored XSS.This issue affects Navayan Subscribe: from n/a through <= 1.13.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/navayan-subscribe/vulnerability/wordpress-navayan-subscribe-plugin-1-13-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-53312
Published: 2025-06-27
Description: Cross-Site Request Forgery (CSRF) vulnerability in Looks Awesome OnionBuzz onionbuzz-viral-quiz allows Stored XSS.This issue affects OnionBuzz: from n/a through <= 1.0.7.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/onionbuzz-viral-quiz/vulnerability/wordpress-onionbuzz-plugin-1-0-7-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-53313
Published: 2025-06-27
Description: Cross-Site Request Forgery (CSRF) vulnerability in plumwd Twitch TV Embed Suite twitch-tv-embed-suite allows Stored XSS.This issue affects Twitch TV Embed Suite: from n/a through <= 2.1.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/twitch-tv-embed-suite/vulnerability/wordpress-twitch-tv-embed-suite-plugin-2-1-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-53314
Published: 2025-06-27
Description: Cross-Site Request Forgery (CSRF) vulnerability in sh1zen WP Optimizer wp-optimizer allows SQL Injection.This issue affects WP Optimizer: from n/a through <= 2.5.0.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/wp-optimizer/vulnerability/wordpress-wp-optimizer-plugin-2-3-6-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-53315
Published: 2025-06-27
Description: Cross-Site Request Forgery (CSRF) vulnerability in alanft Relocate Upload relocate-upload allows Stored XSS.This issue affects Relocate Upload: from n/a through <= 0.24.1.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/relocate-upload/vulnerability/wordpress-relocate-upload-plugin-0-24-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-53317
Published: 2025-06-27
Description: Cross-Site Request Forgery (CSRF) vulnerability in AcmeeDesign WPShapere - WordPress admin theme wpshapere-lite allows Stored XSS.This issue affects WPShapere - WordPress admin theme: from n/a through <= 1.4.1.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/wpshapere-lite/vulnerability/wordpress-wpshapere-lite-plugin-1-4-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-53318
Published: 2025-06-27
Description: Missing Authorization vulnerability in WPManiax WP DB Booster wp-db-booster allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP DB Booster: from n/a through <= 1.0.1.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/wp-db-booster/vulnerability/wordpress-wp-db-booster-plugin-1-0-1-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-53320
Published: 2025-06-27
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Wp Enhanced Free Downloads EDD allows DOM-Based XSS. This issue affects Free Downloads EDD: from n/a through 1.0.4.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/wordpress/plugin/free-downloads-edd/vulnerability/wordpress-free-downloads-edd-plugin-1-0-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-53321
Published: 2025-06-27
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Raise The Money Raise The Money raise-the-money allows DOM-Based XSS.This issue affects Raise The Money: from n/a through <= 5.2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/raise-the-money/vulnerability/wordpress-raise-the-money-plugin-5-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-53322
Published: 2025-06-27
Description: Insertion of Sensitive Information Into Sent Data vulnerability in ZealousWeb Accept Authorize.NET Payments Using Contact Form 7 accept-authorize-net-payments-using-contact-form-7 allows Retrieve Embedded Sensitive Data.This issue affects Accept Authorize.NET Payments Using Contact Form 7: from n/a through <= 2.5.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-201
References: https://patchstack.com/database/Wordpress/Plugin/accept-authorize-net-payments-using-contact-form-7/vulnerability/wordpress-accept-authorize-net-payments-using-contact-form-7-plugin-2-5-sensitive-data-exposure-vulnerability?_s_id=cve
CVE: CVE-2025-53323
Published: 2025-06-27
Description: Missing Authorization vulnerability in danbriapps Pre-Publish Post Checklist pre-publish-post-checklist allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Pre-Publish Post Checklist: from n/a through <= 3.1.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/pre-publish-post-checklist/vulnerability/wordpress-pre-publish-post-checklist-plugin-3-1-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-53325
Published: 2025-06-27
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dilip kumar Beauty Contact Popup Form beauty-contact-popup-form allows Stored XSS.This issue affects Beauty Contact Popup Form: from n/a through <= 6.0.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/beauty-contact-popup-form/vulnerability/wordpress-beauty-contact-popup-form-plugin-6-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-53327
Published: 2025-06-27
Description: Cross-Site Request Forgery (CSRF) vulnerability in rui_mashita Aioseo Multibyte Descriptions aioseo-multibyte-descriptions allows Cross Site Request Forgery.This issue affects Aioseo Multibyte Descriptions: from n/a through <= 0.0.6.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/aioseo-multibyte-descriptions/vulnerability/wordpress-aioseo-multibyte-descriptions-plugin-0-0-6-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-53329
Published: 2025-06-27
Description: Cross-Site Request Forgery (CSRF) vulnerability in szajenw Społecznościowa 6 PL 2013 spolecznosciowa-6-pl-2013 allows Stored XSS.This issue affects Społecznościowa 6 PL 2013: from n/a through <= 2.0.6.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/spolecznosciowa-6-pl-2013/vulnerability/wordpress-spolecznosciowa-6-pl-2013-plugin-2-0-6-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-53331
Published: 2025-06-27
Description: Cross-Site Request Forgery (CSRF) vulnerability in samcharrington RSS Digest rss-digest allows Stored XSS.This issue affects RSS Digest: from n/a through <= 1.5.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/rss-digest/vulnerability/wordpress-rss-digest-plugin-1-5-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-53332
Published: 2025-06-27
Description: Cross-Site Request Forgery (CSRF) vulnerability in ethoseo Track Everything track-everything allows Stored XSS.This issue affects Track Everything: from n/a through <= 2.0.1.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/track-everything/vulnerability/wordpress-track-everything-plugin-2-0-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-53336
Published: 2025-06-27
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in abditsori My Resume Builder my-resume-builder allows Stored XSS.This issue affects My Resume Builder: from n/a through <= 1.0.3.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/my-resume-builder/vulnerability/wordpress-my-resume-builder-plugin-1-0-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-53338
Published: 2025-06-27
Description: Cross-Site Request Forgery (CSRF) vulnerability in dor re.place replace allows Stored XSS.This issue affects re.place: from n/a through <= 0.2.1.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/replace/vulnerability/wordpress-re-place-plugin-0-2-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-53339
Published: 2025-06-27
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in devnex Devnex Addons For Elementor devnex-addons-for-elementor allows PHP Local File Inclusion.This issue affects Devnex Addons For Elementor: from n/a through <= 1.0.9.
CVSS Score: 7.5 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Plugin/devnex-addons-for-elementor/vulnerability/wordpress-devnex-addons-for-elementor-plugin-1-0-9-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-6768
Published: 2025-06-27
Description: A vulnerability classified as critical has been found in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8. Affected is the function findAllHosByCondition of the file HospitalServiceImpl.java. The manipulation of the argument hospitalName leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://github.com/sfturing/hosp_order/issues/110; https://vuldb.com/?ctiid.314082; https://vuldb.com/?id.314082
CVE: CVE-2023-38007
Published: 2025-06-27
Description: IBM Cloud Pak System 2.3.5.0, 2.3.3.7, 2.3.3.7 iFix1 on Power and 2.3.3.6, 2.3.3.6 iFix1, 2.3.3.6 iFix2, 2.3.4.0, 2.3.4.1 on Intel operating systems is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-80, CWE-79
References: https://www.ibm.com/support/pages/node/7237162
CVE: CVE-2025-52553
Published: 2025-06-27
Description: authentik is an open-source identity provider. After authorizing access to a RAC endpoint, authentik creates a token which is used for a single connection and is sent to the client in the URL. This token is intended to only be valid for the session of the user who authorized the connection, however this check is missing in versions prior to 2025.6.3 and 2025.4.3. When, for example, using RAC during a screenshare, a malicious user could access the same session by copying the URL from the shown browser. authentik 2025.4.3 and 2025.6.3 fix this issue. As a workaround, it is recommended to decrease the duration a token is valid for (in the RAC Provider settings, set Connection expiry to `minutes=5` for example). The maintainers of authentik also recommend enabling the option Delete authorization on disconnect.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-287
References: https://github.com/goauthentik/authentik/commit/0e07414e9739b318cff9401a413a5fe849545325; https://github.com/goauthentik/authentik/commit/65373ab21711d58147b5cb9276c5b5876baaa5eb; https://github.com/goauthentik/authentik/commit/7100d3c6741853f1cfe3ea2073ba01823ab55caa
CVE: CVE-2025-53091
Published: 2025-06-27
Description: WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Time-Based Blind SQL Injection vulnerability was discovered in version 3.3.3 the almox parameter of the `/controle/getProdutosPorAlmox.php` endpoint. This issue allows any unauthenticated attacker to inject arbitrary SQL queries, potentially leading to unauthorized data access or further exploitation depending on database configuration. Version 3.4.0 fixes the issue.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-pmf9-2rc3-vvxx