deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-32700
Published: 2025-04-10
Description: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation AbuseFilter. This vulnerability is associated with program files includes/Api/QueryAbuseLog.Php, includes/Pager/AbuseLogPager.Php, includes/Special/SpecialAbuseLog.Php, includes/View/AbuseFilterViewExamine.Php.

This issue affects AbuseFilter: from >= 1.43.0 before 1.43.1.
CWE: CWE-200
References: https://phabricator.wikimedia.org/T389235
CVE: CVE-2025-3469
Published: 2025-04-10
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/htmlform/fields/HTMLMultiSelectField.Php.

This issue affects MediaWiki: before 1.39.12, 1.42.6, 1.43.1.
CWE: CWE-79
References: https://phabricator.wikimedia.org/T358689; https://lists.debian.org/debian-lts-announce/2025/07/msg00012.html
CVE: CVE-2025-29915
Published: 2025-04-10
Description: Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. The AF_PACKET defrag option is enabled by default and allows AF_PACKET to re-assemble fragmented packets before reaching Suricata. However the default packet size in Suricata is based on the network interface MTU which leads to Suricata seeing truncated packets. Upgrade to Suricata 7.0.9, which uses better defaults and adds warnings for user configurations that may lead to issues.
CVSS Score: 7.5 (HIGH)
CWE: CWE-347
References: https://github.com/OISF/suricata/commit/d78f2c9a4e2b59f44daeddff[PII_REDACTED]93d08d; https://github.com/OISF/suricata/security/advisories/GHSA-7m5c-cqx4-x8mp; https://redmine.openinfosecfoundation.org/issues/5373
CVE: CVE-2025-29916
Published: 2025-04-10
Description: Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Datasets declared in rules have an option to specify the `hashsize` to use. This size setting isn't properly limited, so the hash table allocation can be large. Untrusted rules can lead to large memory allocations, potentially leading to denial of service due to resource starvation. This vulnerability is fixed in 7.0.9.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-770
References: https://github.com/OISF/suricata/commit/a7713db709b8a0be5fc5e5809ab58e9b14a16e85; https://github.com/OISF/suricata/security/advisories/GHSA-27g3-pmvp-j9cv; https://redmine.openinfosecfoundation.org/issues/7615
CVE: CVE-2025-29917
Published: 2025-04-10
Description: Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. The bytes setting in the decode_base64 keyword is not properly limited. Due to this, signatures using the keyword and setting can cause large memory allocations of up to 4 GiB per thread. This vulnerability is fixed in 7.0.9.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-770
References: https://github.com/OISF/suricata/commit/32d0bd2bbb4d486623dec85a94952fde2515f2f0; https://github.com/OISF/suricata/security/advisories/GHSA-x8c9-8553-j9px; https://redmine.openinfosecfoundation.org/issues/7613
CVE: CVE-2025-29918
Published: 2025-04-10
Description: Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. A PCRE rule can be written that leads to an infinite loop when negated PCRE is used. Packet processing thread becomes stuck in infinite loop limiting visibility and availability in inline mode. This vulnerability is fixed in 7.0.9.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-835
References: https://github.com/OISF/suricata/commit/b14c67cbdf25fa6c7ffe0d04ddf3ebe67b12b50b; https://github.com/OISF/suricata/security/advisories/GHSA-924c-vvm5-9mqx; https://redmine.openinfosecfoundation.org/issues/7526
CVE: CVE-2025-32807
Published: 2025-04-11
Description: A path traversal vulnerability in FusionDirectory before 1.5 allows remote attackers to read arbitrary files on the host that end with .png (and .svg or .xpm for some configurations) via the icon parameter of a GET request to geticon.php.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-24
References: https://gitlab.fusiondirectory.org/fusiondirectory/fd/-/blob/e9304844fb5c8ce4a9af9e26858af5e22e15b9bd/Changelog.md?plain=1#L112; https://gitlab.fusiondirectory.org/fusiondirectory/fd/-/blob/e9304844fb5c8ce4a9af9e26858af5e22e15b9bd/include/class_IconTheme.inc#L233-237; https://gitlab.fusiondirectory.org/fusiondirectory/fd/-/commit/9edefd0b367450d665a141c5e94db8a06d208556
CVE: CVE-2025-32808
Published: 2025-04-11
Description: W. W. Norton InQuizitive through 2025-04-08 allows students to insert arbitrary records of their quiz performance into the backend, because only client-side access control exists.
CVSS Score: 7.7 (HIGH)
CWE: CWE-602
References: https://medium.com/@JIT_Shellcode/inquizitive-client-side-injection-lms-trust-bypass-and-stored-xss-0ea4da8d22fa; https://medium.com/@JIT_Shellcode/inquizitive-client-side-injection-lms-trust-bypass-and-stored-xss-0ea4da8d22fa
CVE: CVE-2025-32809
Published: 2025-04-11
Description: W. W. Norton InQuizitive through 2025-04-08 allows students to conduct stored XSS attacks against educators via a bonus description, feedback.choice_fb[], or question_id.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://medium.com/@JIT_Shellcode/inquizitive-client-side-injection-lms-trust-bypass-and-stored-xss-0ea4da8d22fa; https://medium.com/@JIT_Shellcode/inquizitive-client-side-injection-lms-trust-bypass-and-stored-xss-0ea4da8d22fa
CVE: CVE-2024-51461
Published: 2025-04-11
Description: IBM QRadar WinCollect Agent 10.0 through 10.1.13 could allow a remote attacker to cause a denial of service by interrupting an HTTP request that could consume memory resources.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-770
References: https://www.ibm.com/support/pages/node/7230614
CVE: CVE-2025-0120
Published: 2025-04-11
Description: A vulnerability with a privilege management mechanism in the Palo Alto Networks GlobalProtect™ app on Windows devices allows a locally authenticated non-administrative Windows user to escalate their privileges to NT AUTHORITY\SYSTEM. However, execution requires that the local user can also successfully exploit a race condition, which makes this vulnerability difficult to exploit.
CVSS Score: 7.0 (HIGH)
CWE: CWE-250
References: https://security.paloaltonetworks.com/CVE-2025-0120
CVE: CVE-2025-0121
Published: 2025-04-11
Description: A null pointer dereference vulnerability in the Palo Alto Networks Cortex® XDR agent on Windows devices allows a low-privileged local Windows user to crash the agent. Additionally, malware can use this vulnerability to perform malicious activity without Cortex XDR being able to detect it.
CWE: CWE-476
References: https://security.paloaltonetworks.com/CVE-2025-0121
CVE: CVE-2025-0122
Published: 2025-04-11
Description: A denial-of-service (DoS) vulnerability in Palo Alto Networks Prisma® SD-WAN ION devices enables an unauthenticated attacker in a network adjacent to a Prisma SD-WAN ION device to disrupt the packet processing capabilities of the device by sending a burst of crafted packets to that device.
CWE: CWE-770
References: https://security.paloaltonetworks.com/CVE-2025-0122
CVE: CVE-2025-0124
Published: 2025-04-11
Description: An authenticated file deletion vulnerability in the Palo Alto Networks PAN-OS® software enables an authenticated attacker with network access to the management web interface to delete certain files as the “nobody” user; this includes limited logs and configuration files but does not include system files.

The attacker must have network access to the management web interface to exploit this issue. You greatly reduce the risk of this issue by restricting access to the management web interface to only trusted internal IP addresses according to our recommended  critical deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 .

This issue affects Cloud NGFW. However, this issue does not affect Prisma® Access software.
CVSS Score: 3.8 (LOW)
CWE: CWE-73
References: https://security.paloaltonetworks.com/CVE-2025-0124
CVE: CVE-2025-0125
Published: 2025-04-11
Description: An improper input neutralization vulnerability in the management web interface of the Palo Alto Networks PAN-OS® software enables a malicious authenticated read-write administrator to impersonate another legitimate authenticated PAN-OS administrator.


The attacker must have network access to the management web interface to exploit this issue. You greatly reduce the risk of this issue by restricting access to the management web interface to only trusted internal IP addresses according to our recommended  critical deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 .

This issue does not affect Cloud NGFW and all Prisma® Access instances.
CWE: CWE-83
References: https://security.paloaltonetworks.com/CVE-2025-0125
CVE: CVE-2025-0126
Published: 2025-04-11
Description: When configured using SAML, a session fixation vulnerability in the GlobalProtect™ login enables an attacker to impersonate a legitimate authorized user and perform actions as that GlobalProtect user. This requires the legitimate user to first click on a malicious link provided by the attacker.

The SAML login for the PAN-OS® management interface is not affected. Additionally, this issue does not affect Cloud NGFW and all Prisma® Access instances are proactively patched.
CWE: CWE-384
References: https://security.paloaltonetworks.com/CVE-2025-0126
CVE: CVE-2025-0127
Published: 2025-04-11
Description: A command injection vulnerability in Palo Alto Networks PAN-OS® software enables an authenticated administrator to bypass system restrictions and run arbitrary commands as a root user. This issue is only applicable to PAN-OS VM-Series. This issue does not affect firewalls that are already deployed.

Cloud NGFW and Prisma® Access are not affected by this vulnerability.
CWE: CWE-78
References: https://security.paloaltonetworks.com/CVE-2025-0127
CVE: CVE-2025-0128
Published: 2025-04-11
Description: A denial-of-service (DoS) vulnerability in the Simple Certificate Enrollment Protocol (SCEP) authentication feature of Palo Alto Networks PAN-OS® software enables an unauthenticated attacker to initiate system reboots using a maliciously crafted packet. Repeated attempts to initiate a reboot causes the firewall to enter maintenance mode.

Cloud NGFW is not affected by this vulnerability. Prisma® Access software is proactively patched and protected from this issue.
CWE: CWE-754
References: https://security.paloaltonetworks.com/CVE-2025-0128
CVE: CVE-2025-26335
Published: 2025-04-11
Description: Dell PowerProtect Cyber Recovery, versions prior to 19.18.0.2, contains an Insertion of Sensitive Information Into Sent Data vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Information exposure.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-201
References: https://www.dell.com/support/kbdoc/en-us/000306005/dsa-2025-113-security-update-for-dell-powerprotect-cyber-recovery
CVE: CVE-2025-32816
Published: 2025-04-11
Description: CodeLit CourseLit before 0.57.5 allows Parameter Tampering via a payment plan associated with the wrong entity.
CVSS Score: 3.1 (LOW)
CWE: CWE-472
References: https://github.com/codelitdev/courselit/pull/574/commits/5e11094df938e08485d0ab8aec2722c237ba0496; https://github.com/codelitdev/courselit/releases/tag/v0.57.5
CVE: CVE-2025-1386
Published: 2025-04-11
Description: When using the ch-go library, under a specific condition when the query includes a large, uncompressed malicious external data, it is possible for an attacker in control of such data to smuggle another query packet into the connection stream.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-444
References: https://github.com/ClickHouse/ch-go/security/advisories/GHSA-m454-3xv7-qj85
CVE: CVE-2025-2636
Published: 2025-04-11
Description: The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 0.1.0.85 via the 'instawp-database-manager' parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where php file types can be uploaded and included, or are already present on the filesystem locally. There are currently no known vulnerabilities in this plugin that make file upload possible, meaning this won't be exploitable to achieve remote code execution on most instances with just this plugin alone. Another vulnerability would need to be present on the site allowing arbitrary file upload in order to leverage this to achieve remote code execution.
CVSS Score: 8.1 (HIGH)
CWE: CWE-22
References: https://plugins.trac.wordpress.org/browser/instawp-connect/trunk/includes/database-manager/loader.php#L77; https://plugins.trac.wordpress.org/changeset/3269681/; https://www.wordfence.com/threat-intel/vulnerabilities/id/4c8f2c6f-c231-477c-895b-df892569ef95?source=cve
CVE: CVE-2025-3512
Published: 2025-04-11
Description: There is a Heap-based Buffer Overflow vulnerability in QTextMarkdownImporter. This requires an incorrectly formatted markdown file to be passed to QTextMarkdownImporter to trigger the overflow.This issue affects Qt from 6.8.0 to 6.8.4. Versions up to 6.6.0 are known to be unaffected, and the fix is in 6.8.4 and later.
CWE: CWE-122
References: https://codereview.qt-project.org/c/qt/qtbase/+/635546; http://www.openwall.com/lists/oss-security/2025/04/24/4; http://www.openwall.com/lists/oss-security/2025/04/24/5
CVE: CVE-2025-31014
Published: 2025-04-11
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Hossein Material Dashboard material-dashboard allows PHP Local File Inclusion.This issue affects Material Dashboard: from n/a through <= 1.4.5.
CVSS Score: 7.5 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Plugin/material-dashboard/vulnerability/wordpress-material-dashboard-1-4-5-local-file-inclusion-vulnerability-2?_s_id=cve
CVE: CVE-2025-31015
Published: 2025-04-11
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Adrian Tobey WordPress SMTP Service, Email Delivery Solved! — MailHawk mailhawk allows PHP Local File Inclusion.This issue affects WordPress SMTP Service, Email Delivery Solved! — MailHawk: from n/a through <= 1.3.1.
CVSS Score: 7.5 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Plugin/mailhawk/vulnerability/wordpress-wordpress-smtp-service-email-delivery-solved-mailhawk-1-3-1-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-31021
Published: 2025-04-11
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dolby_uk Mobile Smart mobile-smart allows Reflected XSS.This issue affects Mobile Smart: from n/a through <= v1.3.16.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/mobile-smart/vulnerability/wordpress-mobile-smart-plugin-v1-3-16-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-31028
Published: 2025-04-11
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Huseyin Berberoglu WP Hide Categories wp-hide-categories allows Reflected XSS.This issue affects WP Hide Categories: from n/a through <= 1.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wp-hide-categories/vulnerability/wordpress-wp-hide-categories-1-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-31040
Published: 2025-04-11
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Exthemes WP Food ordering and Restaurant Menu wp-food allows PHP Local File Inclusion.This issue affects WP Food ordering and Restaurant Menu: from n/a through <= 2.7.
CVSS Score: 8.1 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Plugin/wp-food/vulnerability/wordpress-wp-food-ordering-and-restaurant-menu-1-1-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-31041
Published: 2025-04-11
Description: Missing Authorization vulnerability in AnyTrack AnyTrack Affiliate Link Manager anytrack-affiliate-link-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AnyTrack Affiliate Link Manager: from n/a through <= 1.0.4.
CVSS Score: 7.5 (HIGH)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/anytrack-affiliate-link-manager/vulnerability/wordpress-anytrack-affiliate-link-manager-1-0-4-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-31378
Published: 2025-04-11
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in danbwb Oppso Unit Converter oppso-unit-converter allows Reflected XSS.This issue affects Oppso Unit Converter: from n/a through <= 1.1.1.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/oppso-unit-converter/vulnerability/wordpress-oppso-unit-converter-plugin-1-1-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-31379
Published: 2025-04-11
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in programphases Insert HTML Here insert-html-here allows Reflected XSS.This issue affects Insert HTML Here: from n/a through <= 1.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/insert-html-here/vulnerability/wordpress-insert-html-here-plugin-1-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-31565
Published: 2025-04-11
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Lisandro Martinez WPSmartContracts wp-smart-contracts allows Blind SQL Injection.This issue affects WPSmartContracts: from n/a through <= 2.0.12.
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/wp-smart-contracts/vulnerability/wordpress-wpsmartcontracts-plugin-2-0-10-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-31599
Published: 2025-04-11
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in N-Media Bulk Product Sync sync-wc-google allows SQL Injection.This issue affects Bulk Product Sync: from n/a through <= 8.6.
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/sync-wc-google/vulnerability/wordpress-bulk-product-sync-plugin-8-6-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-32107
Published: 2025-04-11
Description: OS command injection vulnerability exists in Deco BE65 Pro firmware versions prior to "Deco BE65 Pro(JP)_V1_1.1.2 Build 20250123". If this vulnerability is exploited, an arbitrary OS command may be executed by the user who can log in to the device.
CVSS Score: 8.0 (HIGH)
CWE: CWE-78
References: https://jvn.jp/en/vu/JVNVU94912671/; https://www.tp-link.com/jp/support/download/deco-be65-pro/#Firmware
CVE: CVE-2025-32143
Published: 2025-04-11
Description: Deserialization of Untrusted Data vulnerability in PickPlugins Accordion accordions allows Object Injection.This issue affects Accordion: from n/a through <= 2.3.11.
CVSS Score: 8.8 (HIGH)
CWE: CWE-502
References: https://patchstack.com/database/Wordpress/Plugin/accordions/vulnerability/wordpress-accordion-plugin-2-3-10-php-object-injection-vulnerability?_s_id=cve
CVE: CVE-2025-32144
Published: 2025-04-11
Description: Deserialization of Untrusted Data vulnerability in PickPlugins Job Board Manager job-board-manager allows Object Injection.This issue affects Job Board Manager: from n/a through <= 2.1.61.
CVSS Score: 8.8 (HIGH)
CWE: CWE-502
References: https://patchstack.com/database/Wordpress/Plugin/job-board-manager/vulnerability/wordpress-job-board-manager-plugin-2-1-60-php-object-injection-vulnerability?_s_id=cve
CVE: CVE-2025-32491
Published: 2025-04-11
Description: Incorrect Privilege Assignment vulnerability in Rankology Rankology SEO – On-site SEO rankology-seo-all-in-one-seo-analytics allows Privilege Escalation.This issue affects Rankology SEO – On-site SEO: from n/a through <= 2.2.4.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-266
References: https://patchstack.com/database/Wordpress/Plugin/rankology-seo-all-in-one-seo-analytics/vulnerability/wordpress-rankology-seo-on-site-seo-2-2-3-privilege-escalation-vulnerability?_s_id=cve
CVE: CVE-2025-32509
Published: 2025-04-11
Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WPMinds Simple WP Events simple-wp-events allows Path Traversal.This issue affects Simple WP Events: from n/a through <= 1.8.17.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://patchstack.com/database/Wordpress/Plugin/simple-wp-events/vulnerability/wordpress-simple-wp-events-plugin-1-8-17-arbitrary-file-deletion-vulnerability?_s_id=cve
CVE: CVE-2025-32517
Published: 2025-04-11
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SCAND MultiMailer scand-multi-mailer allows Reflected XSS.This issue affects MultiMailer: from n/a through <= 1.0.3.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/scand-multi-mailer/vulnerability/wordpress-multimailer-plugin-1-0-3-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-32519
Published: 2025-04-11
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Foysal Imran IDonate idonate allows PHP Local File Inclusion.This issue affects IDonate: from n/a through <= 2.1.18.
CVSS Score: 8.1 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Plugin/idonate/vulnerability/wordpress-idonate-plugin-2-1-8-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-32523
Published: 2025-04-11
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in payphone WooCommerce – Payphone Gateway wc-payphone-gateway allows Reflected XSS.This issue affects WooCommerce – Payphone Gateway: from n/a through <= 3.2.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wc-payphone-gateway/vulnerability/wordpress-woocommerce-payphone-gateway-plugin-3-2-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-32524
Published: 2025-04-11
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MyWorks MyWorks WooCommerce Sync for QuickBooks Online myworks-woo-sync-for-quickbooks-online allows Reflected XSS.This issue affects MyWorks WooCommerce Sync for QuickBooks Online: from n/a through <= 2.9.1.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/myworks-woo-sync-for-quickbooks-online/vulnerability/wordpress-myworks-woocommerce-sync-for-quickbooks-online-plugin-2-9-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-32525
Published: 2025-04-11
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MapGeo Interactive Geo Maps interactive-geo-maps allows Reflected XSS.This issue affects Interactive Geo Maps: from n/a through <= 1.6.24.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/interactive-geo-maps/vulnerability/wordpress-interactive-geo-maps-plugin-1-6-24-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve