deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-6055
Published: 2025-06-14
Description: The Zen Sticky Social plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.3. This is due to missing or incorrect nonce validation on the 'zen-social-sticky/zen-sticky-social.php' page. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-352
References: https://plugins.trac.wordpress.org/browser/zen-social-sticky/trunk/zen-sticky-social.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/33cfebae-bbf3-4b0b-9afc-3ef2548045e7?source=cve
CVE: CVE-2025-6061
Published: 2025-06-14
Description: The kk Youtube Video plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'kkytv' shortcode in all versions up to, and including, 0.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/kk-youtube-video/trunk/kk-youtube-video.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/bd581604-e2f6-42c4-81ef[PII_REDACTED]6b?source=cve
CVE: CVE-2025-6062
Published: 2025-06-14
Description: The Yougler Blogger Profile Page plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, v1.01. This is due to missing or incorrect nonce validation on the 'yougler-plugin.php' page. This makes it possible for unauthenticated attackers to update the plugin's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://plugins.trac.wordpress.org/browser/yougler-blogger-profile-page/trunk/yougler-plugin.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/7102fb97-96a4-4fd9-824d-6fa6d483f37a?source=cve
CVE: CVE-2025-6063
Published: 2025-06-14
Description: The XiSearch bar plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.6. This is due to missing or incorrect nonce validation on the 'xisearch-key-config' page. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-352
References: https://plugins.trac.wordpress.org/browser/xisearch-bar/trunk/xisearch.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/cd828557-94f6-4278-98ef-bcf4d1d86440?source=cve
CVE: CVE-2025-6064
Published: 2025-06-14
Description: The WP URL Shortener plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2. This is due to missing or incorrect nonce validation on the 'url_shortener_settings' page. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-352
References: https://plugins.trac.wordpress.org/browser/wp-url-shortener/trunk/index.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/154b3a1a-7246-42de-a555-2c655778d59e?source=cve
CVE: CVE-2025-6065
Published: 2025-06-14
Description: The Image Resizer On The Fly plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'delete' task in all versions up to, and including, 1.1. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-22
References: https://plugins.trac.wordpress.org/browser/image-resizer-on-the-fly/trunk/image-resizer-on-the-fly.php#L25; https://wordpress.org/plugins/image-resizer-on-the-fly/; https://www.wordfence.com/threat-intel/vulnerabilities/id/14877ff6-e393-41a3-91c1-fe7f477297cc?source=cve
CVE: CVE-2025-6070
Published: 2025-06-14
Description: The Restrict File Access plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.1.2 via the output() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://plugins.trac.wordpress.org/browser/restrict-file-access/trunk/url_rewrite/url_rewrite.php#L77; https://www.wordfence.com/threat-intel/vulnerabilities/id/6e9eec61-bf51-4cf7-b567-58ee2ccd91c5?source=cve
CVE: CVE-2025-4667
Published: 2025-06-14
Description: The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ssa_admin_upcoming_appointments, ssa_admin_upcoming_appointments, and ssa_past_appointments shortcodes in all versions up to, and including, 1.6.8.30 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/simply-schedule-appointments/tags/1.6.8.24/includes/class-shortcodes.php#L718; https://plugins.trac.wordpress.org/browser/simply-schedule-appointments/tags/1.6.8.24/includes/class-shortcodes.php#L754; https://plugins.trac.wordpress.org/browser/simply-schedule-appointments/tags/1.6.8.24/includes/class-shortcodes.php#L784
CVE: CVE-2025-5238
Published: 2025-06-14
Description: The YITH WooCommerce Wishlist plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ parameter in all versions up to, and including, 4.5.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://docs.yithemes.com/yith-woocommerce-wishlist/changelog/changelog-free-version/; https://plugins.svn.wordpress.org/yith-woocommerce-wishlist/tags/4.5.0/assets/js/unminified/jquery.yith-wcwl.js; https://plugins.trac.wordpress.org/changeset/3310555/
CVE: CVE-2025-5337
Published: 2025-06-14
Description: The Slider, Gallery, and Carousel by MetaSlider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘aria-label’ parameter in all versions up to, and including, 3.98.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/ml-slider/tags/3.98.0/assets/metaslider/script.js#L11; https://plugins.trac.wordpress.org/changeset/3309932/ml-slider/tags/3.99.0/assets/metaslider/script.js; https://wordpress.org/plugins/ml-slider/#developers
CVE: CVE-2025-1411
Published: 2025-06-15
Description: IBM Security Verify Directory Container 10.0.0.0 through 10.0.3.1 could allow a local user to execute commands as root due to execution with unnecessary privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-250
References: https://www.ibm.com/support/pages/node/7236658
CVE: CVE-2025-36041
Published: 2025-06-15
Description: IBM MQ Operator LTS 2.0.0 through 2.0.29, MQ Operator CD 3.0.0, 3.0.1, 3.1.0 through 3.1.3, 3.3.0, 3.4.0, 3.4.1, 3.5.0, 3.5.1 through 3.5.3, and MQ Operator SC2 3.2.0 through 3.2.12 Native HA CRR could be configured with a private key and chain other than the intended key which could disclose sensitive information or allow the attacker to perform unauthorized actions.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-295
References: https://www.ibm.com/support/pages/node/7236608
CVE: CVE-2025-6089
Published: 2025-06-15
Description: A vulnerability has been found in Astun Technology iShare Maps 5.4.0 and classified as problematic. This vulnerability affects unknown code of the file atCheckJS.aspx. The manipulation of the argument ref leads to open redirect. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-601
References: https://vuldb.com/?ctiid.312556; https://vuldb.com/?id.312556; https://vuldb.com/?submit.587876
CVE: CVE-2025-21085
Published: 2025-06-15
Description: PingFederate OAuth2 grant duplication in PostgreSQL persistent storage allows OAuth2 requests to use excessive memory utilization.
CWE: CWE-462
References: https://support.pingidentity.com/s/article/PingFederate-grant-attribute-duplication-with-PostgreSQL; https://www.pingidentity.com/en/resources/downloads/pingfederate.html
CVE: CVE-2025-22854
Published: 2025-06-15
Description: Improper handling of non-200 http responses in the PingFederate Google Adapter leads to thread exhaustion under normal usage conditions.
CWE: CWE-394
References: https://docs.pingidentity.com/integrations/google/google_login_integration_kit/pf_google_cic_changelog.html; https://www.pingidentity.com/en/resources/downloads/pingfederate.html
CVE: CVE-2025-6090
Published: 2025-06-15
Description: A vulnerability was found in H3C GR-5400AX V100R009L50 and classified as critical. This issue affects the function UpdateWanparamsMulti/UpdateIpv6params of the file /routing/goform/aspForm. The manipulation of the argument param leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor confirms the existence of this issue. Because they assess the risk as low, they do not have immediate plans for remediation.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-120
References: https://github.com/CH13hh/cve/blob/main/new/5.md; https://vuldb.com/?ctiid.312557; https://vuldb.com/?id.312557
CVE: CVE-2024-25573
Published: 2025-06-15
Description: Unsanitized user-supplied data saved in the PingFederate Administrative Console could trigger the execution of JavaScript code in subsequent user processing.
CWE: CWE-79
References: https://docs.pingidentity.com/pingfederate/12.1/release_notes/pf_release_notes.html; https://www.pingidentity.com/en/resources/downloads/pingfederate.html
CVE: CVE-2025-6091
Published: 2025-06-15
Description: A vulnerability was found in H3C GR-3000AX V100R007L50. It has been classified as critical. Affected is the function UpdateWanParamsMulti/UpdateIpv6Params of the file /routing/goform/aspForm. The manipulation of the argument param leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor confirms the existence of this issue. Because they assess the risk as low, they do not have immediate plans for remediation.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-120
References: https://github.com/CH13hh/cve/blob/main/new/6.md; https://vuldb.com/?ctiid.312558; https://vuldb.com/?id.312558
CVE: CVE-2025-5990
Published: 2025-06-15
Description: An input neutralization vulnerability in the Server Name form and API Key form components of Crafty Controller allows a remote, authenticated attacker to perform stored XSS via malicious form input.
CVSS Score: 7.6 (HIGH)
CWE: CWE-79
References: https://gitlab.com/crafty-controller/crafty-4/-/issues/567
CVE: CVE-2025-6092
Published: 2025-06-15
Description: A vulnerability was found in comfyanonymous comfyui up to 0.3.39. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /upload/image of the component Incomplete Fix CVE-2024-10099. The manipulation of the argument image leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79, CWE-94
References: https://gist.github.com/superboy-zjc/96f0d56da584d840ba18355cbea96ac4; https://vuldb.com/?ctiid.312559; https://vuldb.com/?id.312559
CVE: CVE-2025-5964
Published: 2025-06-15
Description: A path traversal issue in the API endpoint in M-Files Server before version 25.6.14925.0 allows an authenticated user to read files in the server.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://empower.m-files.com/security-advisories/CVE-2025-5964; https://product.m-files.com/security-advisories/cve-2025-5964
CVE: CVE-2025-6093
Published: 2025-06-15
Description: A vulnerability classified as critical was found in uYanki board-stm32f103rc-berial up to 84daed541609cb7b46854cc6672a275d1007e295. This vulnerability affects the function heartrate1_i2c_hal_write of the file 7.Example/hal/i2c/max30100/Manual/demo2/2/heartrate1_hal.c. The manipulation of the argument num leads to stack-based buffer overflow. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-119, CWE-121
References: https://github.com/uYanki/board-stm32f103rc-berial/issues/3; https://vuldb.com/?ctiid.312562; https://vuldb.com/?id.312562
CVE: CVE-2025-6094
Published: 2025-06-15
Description: A vulnerability, which was classified as critical, has been found in qianfox FoxCMS up to 1.2.5. This issue affects the function batchCope of the file app/admin/controller/Download.php. The manipulation of the argument ids leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://github.com/FSRM1/CVE/blob/main/foxcms_%E5%90%8E%E5%8F%B0sql%E6%B3%A8%E5%85%A5.md; https://vuldb.com/?ctiid.312563; https://vuldb.com/?id.312563
CVE: CVE-2025-6095
Published: 2025-06-15
Description: A vulnerability, which was classified as critical, was found in codesiddhant Jasmin Ransomware 1.0.1. Affected is an unknown function of the file /checklogin.php. The manipulation of the argument username/password leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/YZS17/CVE/blob/main/Jasmin-Ransomware/sqli_password.md; https://github.com/YZS17/CVE/blob/main/Jasmin-Ransomware/sqli_username.md; https://vuldb.com/?ctiid.312564
CVE: CVE-2025-6096
Published: 2025-06-16
Description: A vulnerability has been found in codesiddhant Jasmin Ransomware up to 1.0.1 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /dashboard.php. The manipulation of the argument Search leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://github.com/YZS17/CVE/blob/main/Jasmin-Ransomware/sqli_search.md; https://vuldb.com/?ctiid.312565; https://vuldb.com/?id.312565
CVE: CVE-2025-6097
Published: 2025-06-16
Description: A vulnerability was found in UTT 进取 750W up to 5.0 and classified as critical. Affected by this issue is the function formDefineManagement of the file /goform/setSysAdm of the component Administrator Password Handler. The manipulation of the argument passwd1 leads to unverified password change. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-620, CWE-640
References: https://github.com/pfwqdxwdd/cve/blob/main/6.md; https://github.com/pfwqdxwdd/cve/blob/main/6.md#poc; https://vuldb.com/?ctiid.312566
CVE: CVE-2025-6098
Published: 2025-06-16
Description: A vulnerability was found in UTT 进取 750W up to 5.0. It has been classified as critical. This affects the function strcpy of the file /goform/setSysAdm of the component API. The manipulation of the argument passwd1 leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119, CWE-120, CWE-120
References: https://github.com/newym/cve/blob/main/utt1.md; https://github.com/newym/cve/blob/main/utt1.md#poc; https://vuldb.com/?ctiid.312567
CVE: CVE-2025-6099
Published: 2025-06-16
Description: A vulnerability was found in szluyu99 gin-vue-blog up to 61dd11ccd296e8642a318ada3ef7b3f7776d2410. It has been declared as critical. This vulnerability affects unknown code of the file gin-blog-server/internal/manager.go of the component PATCH Request Handler. The manipulation leads to improper authorization. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-266, CWE-285
References: https://github.com/szluyu99/gin-vue-blog/issues/28; https://vuldb.com/?ctiid.312568; https://vuldb.com/?id.312568
CVE: CVE-2025-6100
Published: 2025-06-16
Description: A vulnerability was found in realguoshuai open-video-cms 1.0. It has been rated as critical. This issue affects some unknown processing of the file /v1/video/list. The manipulation of the argument sort leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://github.com/Bemcliu/cve/blob/main/README.md; https://github.com/Bemcliu/cve/blob/main/README.md#poc; https://vuldb.com/?ctiid.312569
CVE: CVE-2025-6101
Published: 2025-06-16
Description: A vulnerability classified as critical has been found in letta-ai letta up to 0.4.1. Affected is the function function_message of the file letta/letta/interface.py. The manipulation of the argument function_name/function_args leads to improper neutralization of directives in dynamically evaluated code. The exploit has been disclosed to the public and may be used.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-94, CWE-95
References: https://github.com/letta-ai/letta/issues/2613; https://vuldb.com/?ctiid.312570; https://vuldb.com/?id.312570
CVE: CVE-2025-6102
Published: 2025-06-16
Description: A vulnerability classified as critical was found in Wifi-soft UniBox Controller up to 20250506. Affected by this vulnerability is an unknown functionality of the file /authentication/logout.php. The manipulation of the argument mac_address leads to os command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 8.8 (HIGH)
CWE: CWE-77, CWE-78
References: https://github.com/h0e4a0r1t/h0e4a0r1t.github.io/blob/master/2025/1/Command%20Injection%20Vulnerability%20in%20Wifi-soft%20UniBox%20controller-authentication_logout.pdf; https://vuldb.com/?ctiid.312571; https://vuldb.com/?id.312571
CVE: CVE-2025-6103
Published: 2025-06-16
Description: A vulnerability, which was classified as critical, has been found in Wifi-soft UniBox Controller up to 20250506. Affected by this issue is some unknown functionality of the file /billing/test_accesscodelogin.php. The manipulation of the argument Password leads to os command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 8.8 (HIGH)
CWE: CWE-77, CWE-78
References: https://github.com/h0e4a0r1t/h0e4a0r1t.github.io/blob/master/2025/1/Command%20Injection%20Vulnerability%20in%20Wifi-soft%20UniBox%20controller-billing-test_accesscodelogin.pdf; https://vuldb.com/?ctiid.312572; https://vuldb.com/?id.312572
CVE: CVE-2025-6104
Published: 2025-06-16
Description: A vulnerability, which was classified as critical, was found in Wifi-soft UniBox Controller up to 20250506. This affects an unknown part of the file /billing/pms_check.php. The manipulation of the argument ipaddress leads to os command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 8.8 (HIGH)
CWE: CWE-77, CWE-78
References: https://github.com/h0e4a0r1t/h0e4a0r1t.github.io/blob/master/2025/1/Command%20Injection%20Vulnerability%20in%20Wifi-soft%20UniBox%20controller-billing-pms_check.pdf; https://vuldb.com/?ctiid.312573; https://vuldb.com/?id.312573
CVE: CVE-2025-6105
Published: 2025-06-16
Description: A vulnerability has been found in jflyfox jfinal_cms 5.0.1 and classified as problematic. This vulnerability affects unknown code of the file HOME.java. The manipulation of the argument Logout leads to cross-site request forgery. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352, CWE-862, CWE-352
References: https://github.com/webzzaa/CVE-/issues/3; https://vuldb.com/?ctiid.312574; https://vuldb.com/?id.312574
CVE: CVE-2025-6106
Published: 2025-06-16
Description: A vulnerability was found in WuKongOpenSource WukongCRM 9.0 and classified as problematic. This issue affects some unknown processing of the file AdminRoleController.java. The manipulation leads to cross-site request forgery. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352, CWE-862
References: https://github.com/luokuang1/CVE/issues/2; https://vuldb.com/?ctiid.312575; https://vuldb.com/?id.312575
CVE: CVE-2025-6107
Published: 2025-06-16
Description: A vulnerability was found in comfyanonymous comfyui 0.3.40. It has been classified as problematic. Affected is the function set_attr of the file /comfy/utils.py. The manipulation leads to dynamically-determined object attributes. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 3.1 (LOW)
CWE: CWE-913, CWE-915
References: https://gist.github.com/superboy-zjc/f71b84ed074260a5e459581caa2f1fb2; https://gist.github.com/superboy-zjc/f71b84ed074260a5e459581caa2f1fb2#proof-of-concept; https://vuldb.com/?ctiid.312576