deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-6078
Published: 2025-08-02
Description: Partner Software's Partner Software application and Partner Web application allows an authenticated user to add notes on the 'Notes' page when viewing a job but does not completely sanitize input, making it possible to add notes with HTML tags and JavaScript, enabling an attacker to add a note containing malicious JavaScript, leading to stored XSS (cross-site scripting).
CVSS Score: 5.4 (MEDIUM)
References: https://partnersoftware.com/resources/software-release-info-4-32/; https://kb.cert.org/vuls/id/317469; https://www.kb.cert.org/vuls/id/317469
CVE: CVE-2025-7694
Published: 2025-08-02
Description: The Woffice Core plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the woffice_file_manager_delete() function in all versions up to, and including, 5.4.26. This makes it possible for authenticated attackers, with Contributor-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: https://hub.woffice.io/woffice/changelog; https://themeforest.net/item/woffice-intranetextranet-wordpress-theme/11671924; https://www.wordfence.com/threat-intel/vulnerabilities/id/41a362cf-e27e-436a-85f1-7c48e2e098eb?source=cve
CVE: CVE-2025-8146
Published: 2025-08-02
Description: The Qi Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's TypeOut Text widget in all versions up to, and including, 1.9.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset/3335762/; https://wordpress.org/plugins/qi-addons-for-elementor/#developers; https://www.wordfence.com/threat-intel/vulnerabilities/id/4fdfdcbe-014b-4b68-9ac5-976d384106c3?source=cve
CVE: CVE-2025-4588
Published: 2025-08-02
Description: The 360 Photo Spheres plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'sphere' shortcode in all versions up to, and including, 1.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/360-sphere-images/; https://www.wordfence.com/threat-intel/vulnerabilities/id/a654ee62-8742-49bc-95fd-bfab14750b50?source=cve
CVE: CVE-2025-6626
Published: 2025-08-02
Description: The ShortPixel Adaptive Images – WebP, AVIF, CDN, Image Optimization plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the API URL Setting in all versions up to, and including, 3.10.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/shortpixel-adaptive-images/tags/3.10.4/includes/front/vanilla-js-loader.class.php#L48; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3337681%40shortpixel-adaptive-images&new=3337681%40shortpixel-adaptive-images&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/56ab6429-4b1b-461a-9fcd-b4be84985118?source=cve
CVE: CVE-2025-6754
Published: 2025-08-02
Description: The SEO Metrics plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization checks in both the seo_metrics_handle_connect_button_click() AJAX handler and the seo_metrics_handle_custom_endpoint() function in all versions up to, and including, 1.0.15. Because the AJAX action only verifies a nonce, without checking the caller’s capabilities, a subscriber-level user can retrieve the token and then access the custom endpoint to obtain full administrator cookies.
CVSS Score: 8.8 (HIGH)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/seo-metrics-helper/trunk/common-functions.php; https://plugins.trac.wordpress.org/browser/seo-metrics-helper/trunk/endpoint.php; https://plugins.trac.wordpress.org/browser/seo-metrics-helper/trunk/seo-metrics.php
CVE: CVE-2025-8152
Published: 2025-08-02
Description: The WP CTA – Call To Action Plugin, Sticky CTA, Sticky Buttons plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'update_cta_status' and 'change_sticky_sidebar_name' functions in all versions up to, and including, 1.7.0. This makes it possible for unauthenticated attackers to update the status of a sticky and update the name displayed in the back-end WP CTA Dashboard.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/easy-sticky-sidebar/trunk/inc/ClassActions.php#L29; https://plugins.trac.wordpress.org/browser/easy-sticky-sidebar/trunk/inc/ClassActions.php#L52; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3336867%40easy-sticky-sidebar&new=3336867%40easy-sticky-sidebar&sfp_email=&sfph_mail=
CVE: CVE-2025-8212
Published: 2025-08-02
Description: The Medical Addon for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Typewriter widget in all versions up to, and including, 1.6.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3345073%40medical-addon-for-elementor&new=3345073%40medical-addon-for-elementor&sfp_email=&sfph_mail=; https://wordpress.org/plugins/medical-addon-for-elementor/#developers; https://www.wordfence.com/threat-intel/vulnerabilities/id/9dc5452d-41e4-4b28-bb89-fe5ef9c10cb7?source=cve
CVE: CVE-2025-8317
Published: 2025-08-02
Description: The Custom Word Cloud plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘angle’ parameter in all versions up to, and including, 0.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.svn.wordpress.org/custom-word-cloud/trunk/custom-word-cloud.php; https://wordpress.org/plugins/custom-word-cloud/#developers; https://www.wordfence.com/threat-intel/vulnerabilities/id/f153a0ce-c967-43ed-97be-901ea7dcd12b?source=cve
CVE: CVE-2025-6832
Published: 2025-08-02
Description: The All in One Time Clock Lite – Tracking Employee Time Has Never Been Easier plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'nonce' parameter in all versions up to, and including, 2.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3336943%40aio-time-clock-lite&new=3336943%40aio-time-clock-lite&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/844b7471-3adf-45fd-9906-f0c817d6565c?source=cve
CVE: CVE-2025-8391
Published: 2025-08-02
Description: The Magic Edge – Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘height’ parameter in all versions up to, and including, 1.1.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.svn.wordpress.org/magic-edge-lite-image-background-remover/tags/1.1.6/MagicEdgeFrontend.php; https://wordpress.org/plugins/magic-edge-lite-image-background-remover/#developers; https://www.wordfence.com/threat-intel/vulnerabilities/id/fe456de4-4bf3-45aa-938d-8d4561fac44e?source=cve
CVE: CVE-2025-8399
Published: 2025-08-02
Description: The Mmm Unity Loader plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘attributes’ parameter in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.svn.wordpress.org/mmm-unity-loader/trunk/mmm-unity-loader.php; https://wordpress.org/plugins/mmm-unity-loader/#developers; https://www.wordfence.com/threat-intel/vulnerabilities/id/2cee1d75-278c-45c6-915d-60aae6a4d3a2?source=cve
CVE: CVE-2025-8400
Published: 2025-08-02
Description: The Image Gallery plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.svn.wordpress.org/bee-quick-gallery/trunk/includes/bee-quick-gallery-functions.php; https://wordpress.org/plugins/bee-quick-gallery/#developers; https://www.wordfence.com/threat-intel/vulnerabilities/id/ef52026b-1bfc-481c-8eb7-511d1910a35e?source=cve
CVE: CVE-2025-8466
Published: 2025-08-02
Description: A vulnerability was found in code-projects Online Farm System 1.0. It has been classified as critical. Affected is an unknown function of the file /forgot_passfarmer.php. The manipulation of the argument email leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/wllovemy/cve/issues/11; https://vuldb.com/?ctiid.318516
CVE: CVE-2025-6722
Published: 2025-08-02
Description: The BitFire Security – Firewall, WAF, Bot/Spam Blocker, Login Security plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.5 via the bitfire_* directory that automatically gets created and stores potentially sensitive files without any access restrictions. This makes it possible for unauthenticated attackers to extract sensitive data from various files like config.ini, debug.log, and more when directory listing is enabled on the server and the ~/wp-content/plugins/index.php file is missing or ignored.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3334399%40bitfire&new=3334399%40bitfire&sfp_email=&sfph_mail=; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3335461%40bitfire&new=3335461%40bitfire&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/72320980-733d-4fe6-9a13-39c476b77298?source=cve
CVE: CVE-2025-8488
Published: 2025-08-02
Description: The Ultimate Addons for Elementor (Formerly Elementor Header & Footer Builder) plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_hfe_compatibility_option_callback ()function in all versions up to, and including, 2.4.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update the compatibility option setting.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/header-footer-elementor/tags/2.4.6/admin/class-hfe-addons-actions.php#L494; https://plugins.trac.wordpress.org/browser/header-footer-elementor/tags/2.4.7/admin/class-hfe-addons-actions.php#L525; https://www.wordfence.com/threat-intel/vulnerabilities/id/a4b847b5-9deb-41c4-b976-725249e0098e?source=cve
CVE: CVE-2025-8467
Published: 2025-08-02
Description: A vulnerability was found in code-projects Wazifa System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /controllers/regcontrol.php. The manipulation of the argument Username leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/wllovemy/cve/issues/12; https://vuldb.com/?ctiid.318517
CVE: CVE-2025-7500
Published: 2025-08-02
Description: The Ocean Social Sharing plugin for WordPress is vulnerable to Stored Cross-Site Scripting via social icon titles in all versions up to, and including, 2.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/ocean-social-sharing/tags/2.2.1/template/social-share.php#L100; https://plugins.trac.wordpress.org/browser/ocean-social-sharing/tags/2.2.1/template/social-share.php#L176; https://plugins.trac.wordpress.org/browser/ocean-social-sharing/tags/2.2.1/template/social-share.php#L262
CVE: CVE-2025-7710
Published: 2025-08-02
Description: The Brave Conversion Engine (PRO) plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 0.7.7. This is due to the plugin not properly restricting a claimed identity while authenticating with Facebook. This makes it possible for unauthenticated attackers to log in as other users, including administrators.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-288
References: https://getbrave.io/brave-pro-changelog/; https://www.wordfence.com/threat-intel/vulnerabilities/id/604249c6-b23a-40e9-984d-2014f5c97249?source=cve
CVE: CVE-2025-8468
Published: 2025-08-02
Description: A vulnerability was found in code-projects Wazifa System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /controllers/reset.php. The manipulation of the argument email leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/wllovemy/cve/issues/13; https://vuldb.com/?ctiid.318518
CVE: CVE-2025-8469
Published: 2025-08-02
Description: A vulnerability classified as critical has been found in SourceCodester Online Hotel Reservation System 1.0. This affects an unknown part of the file /admin/deletegallery.php. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/K1nakoo/tmp01/blob/main/tmp01.md; https://vuldb.com/?ctiid.318519; https://vuldb.com/?id.318519
CVE: CVE-2025-8470
Published: 2025-08-02
Description: A vulnerability classified as critical was found in SourceCodester Online Hotel Reservation System 1.0. This vulnerability affects unknown code of the file /admin/deleteroom.php. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/K1nakoo/tmp02/blob/main/tmp02.md; https://vuldb.com/?ctiid.318520; https://vuldb.com/?id.318520
CVE: CVE-2025-8471
Published: 2025-08-02
Description: A vulnerability, which was classified as critical, has been found in projectworlds Online Admission System 1.0. This issue affects some unknown processing of the file /adminlogin.php. The manipulation of the argument a_id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/tqlfront/CVE/issues/1; https://vuldb.com/?ctiid.318521; https://vuldb.com/?id.318521
CVE: CVE-2025-23276
Published: 2025-08-02
Description: NVIDIA Installer for Windows contains a vulnerability where an attacker may be able to escalate privileges. A successful exploit of this vulnerability may lead to escalation of privileges, denial of service, code execution, information disclosure and data tampering.
CVSS Score: 7.8 (HIGH)
CWE: CWE-552
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5670
CVE: CVE-2025-23277
Published: 2025-08-02
Description: NVIDIA Display Driver for Linux and Windows contains a vulnerability in the kernel mode driver, where an attacker could access memory outside bounds permitted under normal use cases. A successful exploit of this vulnerability might lead to denial of service, data tampering, or information disclosure.
CVSS Score: 7.3 (HIGH)
CWE: CWE-284
References: https://https://nvidia.custhelp.com/app/answers/detail/a_id/5670
CVE: CVE-2025-23278
Published: 2025-08-02
Description: NVIDIA Display Driver for Windows and Linux contains a vulnerability where an attacker might cause an improper index validation by issuing a call with crafted parameters. A successful exploit of this vulnerability might lead to data tampering  or denial of service.
CVSS Score: 7.1 (HIGH)
CWE: CWE-129
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5670
CVE: CVE-2025-23279
Published: 2025-08-02
Description: NVIDIA .run Installer for Linux and Solaris contains a vulnerability where an attacker could use a race condition to escalate privileges. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, information disclosure, denial of service, or data tampering.
CVSS Score: 7.0 (HIGH)
CWE: CWE-367
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5670
CVE: CVE-2025-23281
Published: 2025-08-02
Description: NVIDIA GPU Display Driver for Windows contains a vulnerability where an attacker with local unprivileged access that can win a race condition might be able to trigger a use-after-free error. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, denial of service, or information disclosure.
CVSS Score: 7.0 (HIGH)
CWE: CWE-416
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5670
CVE: CVE-2025-23283
Published: 2025-08-02
Description: NVIDIA vGPU software for Linux-style hypervisors contains a vulnerability in the Virtual GPU Manager, where a malicious guest could cause stack buffer overflow. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, or data tampering.
CVSS Score: 7.8 (HIGH)
CWE: CWE-121
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5670
CVE: CVE-2025-23286
Published: 2025-08-02
Description: NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability where an attacker could read invalid memory. A successful exploit of this vulnerability might lead to information disclosure.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-125
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5670
CVE: CVE-2025-23287
Published: 2025-08-02
Description: NVIDIA GPU Display Driver for Windows contains a vulnerability where an attacker may access sensitive system-level information. A successful exploit of this vulnerability may lead to Information disclosure.
CVSS Score: 3.3 (LOW)
CWE: CWE-497
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5670
CVE: CVE-2025-23288
Published: 2025-08-02
Description: NVIDIA GPU Display Driver for Windows contains a vulnerability  where an attacker may cause an exposure of sensitive system information with local unprivileged system access. A successful exploit of this vulnerability may lead to Information disclosure.
CVSS Score: 3.3 (LOW)
CWE: CWE-497
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5670
CVE: CVE-2023-32253
Published: 2025-08-02
Description: A flaw was found in the Linux kernel's ksmbd component. A deadlock is triggered by sending multiple concurrent session setup requests, possibly leading to a denial of service.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-413
References: https://access.redhat.com/security/cve/CVE-2023-32253; https://bugzilla.redhat.com/show_bug.cgi?id=2385886
CVE: CVE-2023-32255
Published: 2025-08-02
Description: A flaw was found in the Linux kernel's ksmbd component. A memory leak can occur if a client sends a session setup request with an unknown NTLMSSP message type,  potentially leading to resource exhaustion.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-772
References: https://access.redhat.com/security/cve/CVE-2023-32255; https://bugzilla.redhat.com/show_bug.cgi?id=2385884; https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=6d7cb549c2ca20e1f07593f15e936fd54b763028
CVE: CVE-2025-23284
Published: 2025-08-02
Description: NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager, where a malicious guest could cause a stack buffer overflow. A successful exploit of this vulnerability might lead to code execution, denial of service, information disclosure, or data tampering.
CVSS Score: 7.8 (HIGH)
CWE: CWE-121
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5670
CVE: CVE-2025-23285
Published: 2025-08-02
Description: NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager, where it allows a guest to access global resources. A successful exploit of this vulnerability might lead to denial of service.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-732
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5670
CVE: CVE-2025-23290
Published: 2025-08-02
Description: NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager, where a guest could get global GPU metrics which may be influenced by work in other VMs. A successful exploit of this vulnerability might lead to information disclosure.
CVSS Score: 2.5 (LOW)
CWE: CWE-200
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5670
CVE: CVE-2025-8493
Published: 2025-08-02
Description: A vulnerability classified as critical was found in code-projects Intern Membership Management System 1.0. This vulnerability affects unknown code of the file /admin/edit_student_query.php. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://vuldb.com/?ctiid.318592; https://vuldb.com/?id.318592