deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-22737
Published: 2025-01-15
Description: Missing Authorization vulnerability in magepeopleteam WpTravelly tour-booking-manager allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WpTravelly: from n/a through <= 1.8.5.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/tour-booking-manager/vulnerability/wordpress-wptravelly-plugin-1-8-5-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-22738
Published: 2025-01-15
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Alimir WP ULike wp-ulike allows Stored XSS.This issue affects WP ULike: from n/a through <= 4.7.6.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wp-ulike/vulnerability/wordpress-wp-ulike-plugin-4-7-6-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-22742
Published: 2025-01-15
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in falldeaf WP ViewSTL wp-viewstl allows DOM-Based XSS.This issue affects WP ViewSTL: from n/a through <= 1.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wp-viewstl/vulnerability/wordpress-wp-viewstl-plugin-1-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-22743
Published: 2025-01-15
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mohsin Rasool Twitter Bootstrap Collapse aka Accordian Shortcode twitter-bootstrap-collapse-aka-accordian-shortcode allows DOM-Based XSS.This issue affects Twitter Bootstrap Collapse aka Accordian Shortcode: from n/a through <= 1.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/twitter-bootstrap-collapse-aka-accordian-shortcode/vulnerability/wordpress-twitter-bootstrap-collapse-aka-accordian-shortcode-plugin-1-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-22744
Published: 2025-01-15
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Seodev S-DEV SEO s-dev-seo allows Stored XSS.This issue affects S-DEV SEO: from n/a through <= 1.88.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/s-dev-seo/vulnerability/wordpress-s-dev-seo-plugin-1-88-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-22745
Published: 2025-01-15
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bjoerne Navigation Du Lapin Blanc navigation-du-lapin-blanc allows DOM-Based XSS.This issue affects Navigation Du Lapin Blanc: from n/a through <= 1.1.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/navigation-du-lapin-blanc/vulnerability/wordpress-navigation-du-lapin-blanc-plugin-1-1-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-22746
Published: 2025-01-15
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in zartis HireHive Job Plugin zartis-job-plugin allows Stored XSS.This issue affects HireHive Job Plugin: from n/a through <= 2.9.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/zartis-job-plugin/vulnerability/wordpress-hirehive-job-plugin-plugin-2-9-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-22747
Published: 2025-01-15
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tormorten Foundation Columns foundation-columns allows Stored XSS.This issue affects Foundation Columns: from n/a through <= 0.8.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/foundation-columns/vulnerability/wordpress-foundation-columns-plugin-0-8-stored-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-22748
Published: 2025-01-15
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Setmore SetMore Theme – Custom Post Types service-provider-profile-cpt allows Stored XSS.This issue affects SetMore Theme – Custom Post Types: from n/a through <= 1.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/service-provider-profile-cpt/vulnerability/wordpress-setmore-theme-custom-post-types-plugin-1-1-stored-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-22749
Published: 2025-01-15
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemesCraft.co Social Media Engine social-media-engine allows Stored XSS.This issue affects Social Media Engine: from n/a through <= 1.0.2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/social-media-engine/vulnerability/wordpress-social-media-engine-plugin-1-0-2-stored-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-22750
Published: 2025-01-15
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Patel Post Carousel & Slider post-types-carousel-slider allows Reflected XSS.This issue affects Post Carousel & Slider: from n/a through <= 1.0.4.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/post-types-carousel-slider/vulnerability/wordpress-post-carousel-slider-plugin-1-0-4-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-22751
Published: 2025-01-15
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in farinspace Partners partners allows Reflected XSS.This issue affects Partners: from n/a through <= 0.2.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/partners/vulnerability/wordpress-partners-plugin-0-2-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-22752
Published: 2025-01-15
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WesternDeal GSheetConnector for Forminator Forms gsheetconnector-forminator allows Reflected XSS.This issue affects GSheetConnector for Forminator Forms: from n/a through <= 1.0.12.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/gsheetconnector-forminator/vulnerability/wordpress-gsheetconnector-for-forminator-forms-plugin-1-0-11-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-22753
Published: 2025-01-15
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in turboSMTP turboSMTP turbosmtp allows Reflected XSS.This issue affects turboSMTP: from n/a through <= 4.6.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/turbosmtp/vulnerability/wordpress-turbosmtp-plugin-4-6-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-22754
Published: 2025-01-15
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Berkman Klein Center Amber amberlink allows Reflected XSS.This issue affects Amber: from n/a through <= 1.4.4.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/amberlink/vulnerability/wordpress-amber-plugin-1-4-4-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-22755
Published: 2025-01-15
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bavington WP Headmaster wp-headmaster allows Reflected XSS.This issue affects WP Headmaster: from n/a through <= 0.3.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wp-headmaster/vulnerability/wordpress-wp-headmaster-plugin-0-3-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-22758
Published: 2025-01-15
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Harnani Elementor AI Addons ai-addons-for-elementor allows DOM-Based XSS.This issue affects Elementor AI Addons: from n/a through <= 2.2.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/ai-addons-for-elementor/vulnerability/wordpress-elementor-ai-addons-plugin-2-2-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-22759
Published: 2025-01-15
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BoldGrid Post and Page Builder by BoldGrid post-and-page-builder allows Stored XSS.This issue affects Post and Page Builder by BoldGrid: from n/a through <= 1.27.5.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/post-and-page-builder/vulnerability/wordpress-post-and-page-builder-by-boldgrid-visual-drag-and-drop-editor-plugin-1-27-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-22760
Published: 2025-01-15
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodeBard CodeBard Help Desk codebard-help-desk allows Reflected XSS.This issue affects CodeBard Help Desk: from n/a through <= 1.1.2.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/codebard-help-desk/vulnerability/wordpress-codebard-help-desk-plugin-1-1-2-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-22761
Published: 2025-01-15
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Olaf Lederer Ajax Contact Form fws-ajax-contact-form allows Stored XSS.This issue affects Ajax Contact Form: from n/a through <= 1.4.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/fws-ajax-contact-form/vulnerability/wordpress-ajax-contact-form-plugin-ajax-contact-form-1-2-5-1-stored-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-22762
Published: 2025-01-15
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Octrace WordPress HelpDesk & Support Ticket System Plugin – Octrace Support octrace-support allows Stored XSS.This issue affects WordPress HelpDesk & Support Ticket System Plugin – Octrace Support: from n/a through <= 1.2.7.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/octrace-support/vulnerability/wordpress-octrace-support-pro-plugin-1-2-7-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-22764
Published: 2025-01-15
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in vipul Jariwala WP Post Corrector wp-post-corrector allows Reflected XSS.This issue affects WP Post Corrector: from n/a through <= 1.0.2.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wp-post-corrector/vulnerability/wordpress-wp-post-corrector-plugin-1-0-2-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-22765
Published: 2025-01-15
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in weiluri WP Order By wp-order-by allows Reflected XSS.This issue affects WP Order By: from n/a through <= 1.4.2.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wp-order-by/vulnerability/wordpress-wp-order-by-plugin-1-4-2-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-22766
Published: 2025-01-15
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Masoud Amini Zarinpal Paid Download zarinpal-paid-downloads allows Reflected XSS.This issue affects Zarinpal Paid Download: from n/a through <= 2.3.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/zarinpal-paid-downloads/vulnerability/wordpress-zarinpal-paid-download-plugin-2-3-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-22769
Published: 2025-01-15
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Creative Brahma Multifox allows Stored XSS.This issue affects Multifox: from n/a through 1.3.7.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/wordpress/theme/multifox/vulnerability/wordpress-multifox-theme-1-3-7-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-22773
Published: 2025-01-15
Description: Insertion of Sensitive Information into Externally-Accessible File or Directory vulnerability in WP Chill Htaccess File Editor htaccess-file-editor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Htaccess File Editor: from n/a through <= 1.0.19.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-538
References: https://patchstack.com/database/Wordpress/Plugin/htaccess-file-editor/vulnerability/wordpress-htaccess-file-editor-1-0-19-broken-authentication-vulnerability?_s_id=cve
CVE: CVE-2025-22776
Published: 2025-01-15
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in codebycarter WP Bulletin Board wp-bulletin-board allows Reflected XSS.This issue affects WP Bulletin Board: from n/a through <= 1.1.4.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wp-bulletin-board/vulnerability/wordpress-wp-bulletin-board-plugin-1-1-4-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-22778
Published: 2025-01-15
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in damniel Lijit Search wp-lijit-wijit allows Reflected XSS.This issue affects Lijit Search: from n/a through <= 1.1.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wp-lijit-wijit/vulnerability/wordpress-lijit-search-plugin-1-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-22779
Published: 2025-01-15
Description: Missing Authorization vulnerability in codeaffairs WP News Sliders wp-news-sliders allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP News Sliders: from n/a through <= 1.0.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/wp-news-sliders/vulnerability/wordpress-wp-news-sliders-plugin-1-0-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-22780
Published: 2025-01-15
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Andrey wp-pano wp-pano allows Stored XSS.This issue affects wp-pano: from n/a through <= 1.17.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wp-pano/vulnerability/wordpress-wp-pano-plugin-1-17-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-22781
Published: 2025-01-15
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nativery Nativery nativery allows DOM-Based XSS.This issue affects Nativery: from n/a through <= 0.1.6.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/nativery/vulnerability/wordpress-nativery-plugin-plugin-0-1-6-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-22782
Published: 2025-01-15
Description: Unrestricted Upload of File with Dangerous Type vulnerability in Web Ready Now WR Price List Manager For Woocommerce wr-price-list-for-woocommerce allows Upload a Web Shell to a Web Server.This issue affects WR Price List Manager For Woocommerce: from n/a through <= 1.0.8.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-434
References: https://patchstack.com/database/Wordpress/Plugin/wr-price-list-for-woocommerce/vulnerability/wordpress-wr-price-list-manager-for-woocommerce-plugin-1-0-8-remote-code-execution-rce-vulnerability?_s_id=cve
CVE: CVE-2025-22784
Published: 2025-01-15
Description: Cross-Site Request Forgery (CSRF) vulnerability in swedish boy Background Control background-control allows Path Traversal.This issue affects Background Control: from n/a through <= 1.0.5.
CVSS Score: 8.6 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/background-control/vulnerability/wordpress-background-control-plugin-1-0-5-csrf-to-arbitrary-file-deletion-vulnerability?_s_id=cve
CVE: CVE-2025-22785
Published: 2025-01-15
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ComMotion Course Booking System course-booking-system allows SQL Injection.This issue affects Course Booking System: from n/a through <= 6.0.6.
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/course-booking-system/vulnerability/wordpress-course-booking-system-plugin-6-0-5-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-22786
Published: 2025-01-15
Description: Path Traversal: '.../...//' vulnerability in Element Invader ElementInvader Addons for Elementor elementinvader-addons-for-elementor allows PHP Local File Inclusion.This issue affects ElementInvader Addons for Elementor: from n/a through <= 1.2.6.
CVSS Score: 7.5 (HIGH)
CWE: CWE-35, CWE-22
References: https://patchstack.com/database/Wordpress/Plugin/elementinvader-addons-for-elementor/vulnerability/wordpress-elementinvader-addons-for-elementor-plugin-1-2-6-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-22787
Published: 2025-01-15
Description: Missing Authorization vulnerability in bPlugins Button Block button-block allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Button Block: from n/a through <= 1.1.5.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/button-block/vulnerability/wordpress-button-block-plugin-1-1-5-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-22788
Published: 2025-01-15
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Codexpert, Inc CoDesigner woolementor allows Stored XSS.This issue affects CoDesigner: from n/a through <= 4.29.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/woolementor/vulnerability/wordpress-codesigner-plugin-4-7-17-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-22793
Published: 2025-01-15
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bold Bold pagos en linea bold-pagos-en-linea allows DOM-Based XSS.This issue affects Bold pagos en linea: from n/a through <= 3.1.4.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/bold-pagos-en-linea/vulnerability/wordpress-bold-pagos-en-linea-plugin-3-1-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-22795
Published: 2025-01-15
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in digitaldonkey Multilang Contact Form multilang-contact-form allows Reflected XSS.This issue affects Multilang Contact Form: from n/a through <= 1.5.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/multilang-contact-form/vulnerability/wordpress-multilang-contact-form-plugin-1-5-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-22797
Published: 2025-01-15
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Oğulcan Özügenç Gallery and Lightbox gallery-and-lightbox allows Stored XSS.This issue affects Gallery and Lightbox: from n/a through <= 1.0.14.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/gallery-and-lightbox/vulnerability/wordpress-gallery-and-lightbox-plugin-1-0-14-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-22798
Published: 2025-01-15
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CHR Designer Responsive jQuery Slider responsive-jquery-slider allows Stored XSS.This issue affects Responsive jQuery Slider: from n/a through <= 1.1.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/responsive-jquery-slider/vulnerability/wordpress-responsive-jquery-slider-plugin-1-1-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-22799
Published: 2025-01-15
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in vertim Neon Product Designer neon-product-designer-for-woocommerce allows SQL Injection.This issue affects Neon Product Designer: from n/a through <= 2.2.0.
CVSS Score: 8.5 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/neon-product-designer-for-woocommerce/vulnerability/wordpress-neon-product-designer-plugin-2-1-1-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-22968
Published: 2025-01-15
Description: An issue in D-Link DWR-M972V 1.05SSG allows a remote attacker to execute arbitrary code via SSH using root account without restrictions
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://github.com/CRUNZEX/CVE-2025-22968; https://github.com/CRUNZEX/CVE-DLINK-LTE; https://www.dlink.com/en/security-bulletin/
CVE: CVE-2020-8094
Published: 2025-01-15
Description: An untrusted search path vulnerability in testinitsigs.exe as used in Bitdefender Antivirus Free 2020 allows a low-privilege attacker to execute code as SYSTEM via a specially crafted DLL file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-426
References: https://www.bitdefender.com/support/security-advisories/untrusted-search-path-vulnerability-bitdefender-antivirus-free-2020-va-8422/
CVE: CVE-2024-50953
Published: 2025-01-15
Description: An issue in XINJE XL5E-16T V3.7.2a allows attackers to cause a Denial of Service (DoS) via a crafted Modbus message.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://github.com/Curator-Kim/Vulnerability-mining/blob/master/XINJE%20XL5E-16T%20Modbus/XINJE%20XL5E-16T%20Modbus%20DoS.md
CVE: CVE-2024-50954
Published: 2025-01-15
Description: The XINJE XL5E-16T and XD5E-24R-E programmable logic controllers V3.5.3b-V3.7.2a have a vulnerability in handling Modbus messages. When a TCP connection is established with the above series of controllers within a local area network (LAN), sending a specific Modbus message to the controller can cause the PLC to crash, interrupting the normal operation of the programs running in the PLC. This results in the ERR indicator light turning on and the RUN indicator light turning off.
CVSS Score: 7.5 (HIGH)
CWE: CWE-703
References: https://github.com/Curator-Kim/Vulnerability-mining/blob/master/XINJE%20XL5E-16T%20XD5E-24R%20Modbus/XINJE%20XL5E-16T%20XD5E-24R%20Modbus.md
CVE: CVE-2024-52783
Published: 2025-01-15
Description: Insecure permissions in the XNetSocketClient component of XINJE XDPPro.exe v3.2.2 to v3.7.17c allows attackers to execute arbitrary code via modification of the configuration file.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-276
References: https://github.com/Curator-Kim/Vulnerability-mining/blob/master/XDP%20Pro.exe%20incorrect%20permission%20for%20configuration%20file/Incorrect%20permission%20for%20configuration%20file%20in%20XDP%20Pro.exe.md