deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-31466
Published: 2025-03-28
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Falcon Solutions Duplicate Page and Post duplicate-post-and-page allows Blind SQL Injection.This issue affects Duplicate Page and Post: from n/a through <= 1.0.
CVSS Score: 8.5 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/duplicate-post-and-page/vulnerability/wordpress-duplicate-page-and-post-1-0-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-31469
Published: 2025-03-28
Description: Missing Authorization vulnerability in webrangers Clear Sucuri Cache clear-sucuri-cache allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Clear Sucuri Cache: from n/a through <= 1.4.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/clear-sucuri-cache/vulnerability/wordpress-clear-sucuri-cache-1-4-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-31470
Published: 2025-03-28
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FancyThemes Page Takeover page-takeover allows Stored XSS.This issue affects Page Takeover: from n/a through <= 1.1.6.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/page-takeover/vulnerability/wordpress-page-takeover-1-1-6-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-31471
Published: 2025-03-28
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Falcon Solutions Duplicate Page and Post duplicate-post-and-page allows Stored XSS.This issue affects Duplicate Page and Post: from n/a through <= 1.0.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/duplicate-post-and-page/vulnerability/wordpress-duplicate-page-and-post-1-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-31472
Published: 2025-03-28
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Michele Marri Flatty flatty-flat-admin-theme allows Stored XSS.This issue affects Flatty: from n/a through <= 2.0.0.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/flatty-flat-admin-theme/vulnerability/wordpress-flatty-2-0-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-31473
Published: 2025-03-28
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in matthewprice1178 WP Database Optimizer wp-database-optimizer allows Stored XSS.This issue affects WP Database Optimizer: from n/a through <= 1.2.1.3.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wp-database-optimizer/vulnerability/wordpress-wp-database-optimizer-1-2-1-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-31474
Published: 2025-03-28
Description: Cross-Site Request Forgery (CSRF) vulnerability in matthewprice1178 WP Database Optimizer wp-database-optimizer allows Cross Site Request Forgery.This issue affects WP Database Optimizer: from n/a through <= 1.2.1.3.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/wp-database-optimizer/vulnerability/wordpress-wp-database-optimizer-1-2-1-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2024-11504
Published: 2025-03-28
Description: Input from multiple fields in Streamsoft Prestiż is not sanitized properly, leading to an SQL injection vulnerability, which might be exploited by an authenticated remote attacker. 
This issue was fixed in 18.1.376.37 version of the software.
CWE: CWE-89
References: https://cert.pl/en/posts/2025/03/CVE-2024-7407/; https://www.streamsoft.pl/streamsoft-prestiz/
CVE: CVE-2024-7407
Published: 2025-03-28
Description: Use of a custom password encoding algorithm in Streamsoft Prestiż software allows straightforward decoding of passwords using their encoded forms, which are stored in the application's database. One has to know the encoding algorithm, but it can be deduced by observing how password are transformed. 
This issue was fixed in 18.2.377 version of the software.
CWE: CWE-261
References: https://cert.pl/en/posts/2025/03/CVE-2024-7407/; https://www.streamsoft.pl/streamsoft-prestiz/
CVE: CVE-2025-2908
Published: 2025-03-28
Description: The exposure of credentials in the call forwarding configuration module in MeetMe products in versions prior to 2024-09 allows an attacker to gain access to some important assets via configuration files.
CWE: CWE-522
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-fermax-mobile-applications
CVE: CVE-2025-2909
Published: 2025-03-28
Description: The lack of encryption in the DuoxMe (formerly Blue) application binary in versions prior to 3.3.1 for iOS devices allows an attacker to gain unauthorised access to the application code and discover sensitive information.
CWE: CWE-312
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-fermax-mobile-applications
CVE: CVE-2025-2910
Published: 2025-03-28
Description: User enumeration in the password reset module of the MeetMe authentication service in versions prior to 2024-09 allows an attacker to determine whether an email address is registered through specific error messages.
CWE: CWE-204
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-fermax-mobile-applications
CVE: CVE-2025-2911
Published: 2025-03-28
Description: Unauthorised access to the call forwarding service system in MeetMe products in versions prior to 2024-09 allows an attacker to identify multiple users and perform brute force attacks via extensions.
CWE: CWE-307
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-fermax-mobile-applications
CVE: CVE-2025-0986
Published: 2025-03-28
Description: IBM PowerVM Hypervisor FW1050.00 through FW1050.30 and FW1060.00 through FW1060.20 could allow a local user, under certain Linux processor combability mode configurations, to cause undetected data loss or errors when performing gzip compression using HW acceleration.
CVSS Score: 4.5 (MEDIUM)
CWE: CWE-409
References: https://www.ibm.com/support/pages/node/7229349
CVE: CVE-2025-1781
Published: 2025-03-28
Description: There is a XXE in W3CSS Validator versions before cssval-20250226 that allows an attacker to use specially-crafted XML objects to coerce server-side request forgery (SSRF).  This could be exploited to read arbitrary local files if an attacker has access to exception messages.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-611
References: https://github.com/google/security-research/security/advisories/GHSA-745m-xmq6-g6x7
CVE: CVE-2025-28219
Published: 2025-03-28
Description: Netgear DC112A V1.0.0.64 has an OS command injection vulnerability in the usb_adv.cgi, which allows remote attackers to execute arbitrary commands via parameter "deviceName" passed to the binary through a POST request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://github.com/IdaJea/IOT_vuln_1/blob/master/DC112A_V1.0.0.64/sub_69600.pdf
CVE: CVE-2025-28220
Published: 2025-03-28
Description: Tenda W6_S v1.0.0.4_510 has a Buffer Overflow vulnerability in the setcfm function, which allows remote attackers to cause web server crash via parameter funcpara1 passed to the binary through a POST request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120
References: https://github.com/IdaJea/IOT_vuln_1/blob/master/w6_s_v1.0.0.4/setcfm.pdf
CVE: CVE-2025-28221
Published: 2025-03-28
Description: Tenda W6_S v1.0.0.4_510 has a Buffer Overflow vulnerability in the set_local_time function, which allows remote attackers to cause web server crash via parameter time passed to the binary through a POST request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120
References: https://github.com/IdaJea/IOT_vuln_1/blob/master/w6_s_v1.0.0.4/time.pdf
CVE: CVE-2025-2858
Published: 2025-03-28
Description: Privilege escalation vulnerability in the saTECH BCU firmware version 2.1.3. An attacker with access to the CLI of the device could make use of the nice command to bypass all restrictions and elevate privileges as a superuser.
CVSS Score: 8.8 (HIGH)
CWE: CWE-269
References: https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-arteches-satech-bcu
CVE: CVE-2025-2859
Published: 2025-03-28
Description: An attacker with network access, could capture traffic and obtain user cookies, allowing the attacker to steal the active user session and make changes to the device via web, depending on the privileges obtained by the user.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-arteches-satech-bcu
CVE: CVE-2025-2860
Published: 2025-03-28
Description: SaTECH BCU in its firmware version 2.1.3, allows an authenticated attacker to access information about the credentials that users have within the web (.xml file). In order to exploit this vulnerability, the attacker must know the path, regardless of the user's privileges on the website.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-arteches-satech-bcu
CVE: CVE-2025-2861
Published: 2025-03-28
Description: SaTECH BCU in its firmware version 2.1.3 uses the HTTP protocol. The use of the HTTP protocol for web browsing has the problem that information is exchanged in unencrypted text. Since sensitive data such as credentials are exchanged, an attacker could obtain them and log in legitimately.
CVSS Score: 7.5 (HIGH)
CWE: CWE-319
References: https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-arteches-satech-bcu
CVE: CVE-2025-2862
Published: 2025-03-28
Description: SaTECH BCU, in its firmware version 2.1.3, performs weak password encryption. This allows an attacker with access to the device's system or website to obtain the credentials, as the storage methods used are not strong enough in terms of encryption.
CVSS Score: 7.5 (HIGH)
CWE: CWE-261
References: https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-arteches-satech-bcu
CVE: CVE-2025-2863
Published: 2025-03-28
Description: Cross-site request forgery (CSRF) vulnerability in the web application of saTECH BCU firmware version 2.1.3, which could allow an unauthenticated local attacker to exploit active administrator sessions and perform malicious actions. The malicious actions that can be executed by the attacker depend on the logged-in user, and may include rebooting the device or modifying roles and permissions.
CVSS Score: 7.8 (HIGH)
CWE: CWE-352
References: https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-arteches-satech-bcu
CVE: CVE-2025-2864
Published: 2025-03-28
Description: SaTECH BCU in its firmware version 2.1.3 allows an attacker to inject malicious code into the legitimate website owning the affected device, once the cookie is set. This attack only impacts the victim's browser (reflected XSS).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-arteches-satech-bcu
CVE: CVE-2025-2865
Published: 2025-03-28
Description: SaTECH BCU, in its firmware version 2.1.3, could allow XSS attacks and other malicious resources to be stored on the web server. An attacker with some knowledge of the web application could send a malicious request to the victim users. Through this request, the victims would interpret the code (resources) stored on another malicious website owned by the attacker.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-942, CWE-79
References: https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-arteches-satech-bcu
CVE: CVE-2025-2877
Published: 2025-03-28
Description: A flaw was found in the Ansible Automation Platform's Event-Driven Ansible. In configurations where verbosity is set to "debug", inventory passwords are exposed in plain text when starting a rulebook activation. This issue exists for any "debug" action in a rulebook and also affects Event Streams.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-1295
References: https://access.redhat.com/errata/RHSA-2025:3636; https://access.redhat.com/errata/RHSA-2025:3637; https://access.redhat.com/security/cve/CVE-2025-2877
CVE: CVE-2025-2901
Published: 2025-03-28
Description: Rejected reason: This vulnerability is redundant to CVE-2025-23366 and CVE-2024-10234.
CVE: CVE-2024-39311
Published: 2025-03-28
Description: Publify is a self hosted Web publishing platform on Rails. Prior to version 10.0.1 of Publify, corresponding to versions prior to 10.0.2 of the `publify_core` rubygem, publisher on a `publify` application is able to perform a cross-site scripting (XSS) attack on an administrator using the redirect functionality. The exploitation of this XSS vulnerability requires the administrator to click a malicious link. An attack could attempt to hide their payload by using HTML, or other encodings, as to not make it obvious to an administrator that this is a malicious link. A publisher may attempt to use this vulnerability to escalate their privileges and become an administrator. Version 10.0.1 of Publify and version 10.0.2 of the `publify_core` rubygem fix the issue.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/publify/publify/security/advisories/GHSA-8fm5-gg2f-f66q; https://github.com/publify/publify/security/advisories/GHSA-8fm5-gg2f-f66q
CVE: CVE-2024-48615
Published: 2025-03-28
Description: Null Pointer Dereference vulnerability in libarchive 3.7.6 and earlier when running program bsdtar in function header_pax_extension at rchive_read_support_format_tar.c:1844:8.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://github.com/88Sanghy88/crash-test; https://github.com/libarchive/libarchive/releases/download/v3.7.6/libarchive-3.7.6.tar.gz; https://github.com/88Sanghy88/crash-test
CVE: CVE-2024-51624
Published: 2025-03-28
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in jajapagamentos Já-Já Pagamentos for WooCommerce wc-ja-ja-pagamentos-multicaixa-express allows Reflected XSS.This issue affects Já-Já Pagamentos for WooCommerce: from n/a through <= 1.3.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wc-ja-ja-pagamentos-multicaixa-express/vulnerability/wordpress-ja-ja-pagamentos-for-woocommerce-plugin-1-3-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-54291
Published: 2025-03-28
Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in labs64 PluginPass pluginpass-pro-plugintheme-licensing allows Manipulating Web Input to File System Calls.This issue affects PluginPass: from n/a through <= 0.9.10.
CVSS Score: 8.6 (HIGH)
CWE: CWE-22
References: https://patchstack.com/database/Wordpress/Plugin/pluginpass-pro-plugintheme-licensing/vulnerability/wordpress-pluginpass-plugin-0-9-10-arbitrary-file-download-delete-vulnerability?_s_id=cve
CVE: CVE-2024-54362
Published: 2025-03-28
Description: Path Traversal: '.../...//' vulnerability in boggibill GetShop ecommerce getshop-ecommerce allows Path Traversal.This issue affects GetShop ecommerce: from n/a through <= 1.3.
CVSS Score: 8.1 (HIGH)
CWE: CWE-35
References: https://patchstack.com/database/Wordpress/Plugin/getshop-ecommerce/vulnerability/wordpress-getshop-ecommerce-plugin-1-3-path-traversal-vulnerability?_s_id=cve
CVE: CVE-2025-22356
Published: 2025-03-28
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Stencies Stencies stencies allows Reflected XSS.This issue affects Stencies: from n/a through <= 0.58.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/stencies/vulnerability/wordpress-stencies-plugin-0-58-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-22360
Published: 2025-03-28
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in promact WP Azure offload wp-azure-offload allows Reflected XSS.This issue affects WP Azure offload: from n/a through <= 2.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wp-azure-offload/vulnerability/wordpress-wp-azure-offload-plugin-2-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-22501
Published: 2025-03-28
Description: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Improve My City Improve My City improve-my-city allows Reflected XSS.This issue affects Improve My City: from n/a through <= 1.6.
CVSS Score: 7.1 (HIGH)
CWE: CWE-80
References: https://patchstack.com/database/Wordpress/Plugin/improve-my-city/vulnerability/wordpress-improve-my-city-plugin-1-6-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-22523
Published: 2025-03-28
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in scheduler Schedule schedule allows Blind SQL Injection.This issue affects Schedule: from n/a through <= 1.0.0.
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/schedule/vulnerability/wordpress-schedule-plugin-1-0-0-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-22526
Published: 2025-03-28
Description: Deserialization of Untrusted Data vulnerability in mywebtonet PHP/MySQL CPU performance statistics mywebtonet-performancestats allows Object Injection.This issue affects PHP/MySQL CPU performance statistics: from n/a through <= 1.2.1.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://patchstack.com/database/Wordpress/Plugin/mywebtonet-performancestats/vulnerability/wordpress-php-mysql-cpu-performance-statistics-plugin-1-2-1-php-object-injection-vulnerability?_s_id=cve
CVE: CVE-2025-22566
Published: 2025-03-28
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in extendyourweb ULTIMATE VIDEO GALLERY ultimate-gallery allows Reflected XSS.This issue affects ULTIMATE VIDEO GALLERY: from n/a through <= 1.4.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/ultimate-gallery/vulnerability/wordpress-ultimate-video-gallery-plugin-1-4-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-22575
Published: 2025-03-28
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in extendyourweb SUPER RESPONSIVE SLIDER super-slider allows Reflected XSS.This issue affects SUPER RESPONSIVE SLIDER: from n/a through <= 1.4.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/super-slider/vulnerability/wordpress-super-responsive-slider-plugin-1-4-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-22767
Published: 2025-03-28
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Global Payments GlobalPayments WooCommerce global-payments-woocommerce allows Reflected XSS.This issue affects GlobalPayments WooCommerce: from n/a through <= 1.13.2.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/global-payments-woocommerce/vulnerability/wordpress-globalpayments-woocommerce-plugin-1-12-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-29928
Published: 2025-03-28
Description: authentik is an open-source identity provider. Prior to versions 2024.12.4 and 2025.2.3, when authentik was configured to use the database for session storage (which is a non-default setting), deleting sessions via the Web Interface or the API would not revoke the session and the session holder would continue to have access to authentik. authentik 2025.2.3 and 2024.12.4 fix this issue. Switching to the cache-based session storage until the authentik instance can be upgraded is recommended. This will however also delete all existing sessions and users will have to re-authenticate.
CVSS Score: 8.0 (HIGH)
CWE: CWE-384
References: https://github.com/goauthentik/authentik/commit/71294b7deb6eb5726a782de83b957eaf25fc4cf6; https://github.com/goauthentik/authentik/security/advisories/GHSA-p6p8-f853-9g2p
CVE: CVE-2025-30211
Published: 2025-03-28
Description: Erlang/OTP is a set of libraries for the Erlang programming language. Prior to versions OTP-27.3.1, 26.2.5.10, and 25.3.2.19, a maliciously formed KEX init message can result with high memory usage. Implementation does not verify RFC specified limits on algorithm names (64 characters) provided in KEX init message. Big KEX init packet may lead to inefficient processing of the error data. As a result, large amount of memory will be allocated for processing malicious data. Versions OTP-27.3.1, OTP-26.2.5.10, and OTP-25.3.2.19 fix the issue. Some workarounds are available. One may set option `parallel_login` to `false` and/or reduce the `max_sessions` option.
CVSS Score: 7.5 (HIGH)
CWE: CWE-789
References: https://github.com/erlang/otp/security/advisories/GHSA-vvr3-fjhh-cfwc; https://lists.debian.org/debian-lts-announce/2025/04/msg00028.html
CVE: CVE-2025-30371
Published: 2025-03-28
Description: Metabase is a business intelligence and embedded analytics tool. Versions prior to v0.52.16.4, v1.52.16.4, v0.53.8, and v1.53.8 are vulnerable to circumvention of local link access protection in GeoJson endpoint. Self hosted Metabase instances that are using the GeoJson feature could be potentially impacted if their Metabase is colocated with other unsecured resources. This is fixed in v0.52.16.4, v1.52.16.4, v0.53.8, and v1.53.8. Migrating to Metabase Cloud or redeploying Metabase in a dedicated subnet with strict outbound port controls is an available workaround.
CWE: CWE-59
References: https://github.com/metabase/metabase/security/advisories/GHSA-8xf9-9jc8-qp98
CVE: CVE-2025-30372
Published: 2025-03-28
Description: Emlog is an open source website building system. Emlog Pro versions pro-2.5.7 and pro-2.5.8 contain an SQL injection vulnerability. `search_controller.php` does not use addslashes after urldecode, allowing the preceeding addslashes to be bypassed by URL double encoding. This could result in potential leakage of sensitive information from the user database. Version pro-2.5.9 fixes the issue.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/emlog/emlog/security/advisories/GHSA-w6xc-r6x5-m77c; https://github.com/emlog/emlog/security/advisories/GHSA-w6xc-r6x5-m77c
CVE: CVE-2025-31010
Published: 2025-03-28
Description: Cross-Site Request Forgery (CSRF) vulnerability in ReichertBrothers SimplyRETS Real Estate IDX simply-rets allows Cross Site Request Forgery.This issue affects SimplyRETS Real Estate IDX: from n/a through <= 3.0.5.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/simply-rets/vulnerability/wordpress-simplyrets-real-estate-idx-plugin-3-0-3-csrf-to-multiple-admin-actions-vulnerability?_s_id=cve
CVE: CVE-2025-2713
Published: 2025-03-28
Description: Google gVisor's runsc component exhibited a local privilege escalation vulnerability due to incorrect handling of file access permissions, which allowed unprivileged users to access restricted files. This occurred because the process initially ran with root-like permissions until the first fork.
CVSS Score: 7.8 (HIGH)
CWE: CWE-266
References: https://github.com/google/gvisor/commit/586c38d70081b13b2ed494cef48e99b93956843e