deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-25097
Published: 2025-02-07
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in kwiliarty External Video For Everybody external-video-for-everybody allows Stored XSS.This issue affects External Video For Everybody: from n/a through <= 2.1.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/external-video-for-everybody/vulnerability/wordpress-external-video-for-everybody-plugin-2-1-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-25098
Published: 2025-02-07
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Zack Katz Links in Captions links-in-captions allows Stored XSS.This issue affects Links in Captions: from n/a through <= 1.2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/links-in-captions/vulnerability/wordpress-links-in-captions-plugin-1-2-stored-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-25101
Published: 2025-02-07
Description: Cross-Site Request Forgery (CSRF) vulnerability in MetricThemes Munk Sites munk-sites allows Cross Site Request Forgery.This issue affects Munk Sites: from n/a through <= 1.0.7.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/munk-sites/vulnerability/wordpress-munk-sites-plugin-1-0-7-csrf-to-arbitrary-plugin-installation-vulnerability?_s_id=cve
CVE: CVE-2025-25103
Published: 2025-02-07
Description: Cross-Site Request Forgery (CSRF) vulnerability in bnielsen Indeed API indeed-api allows Cross Site Request Forgery.This issue affects Indeed API: from n/a through <= 0.5.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/indeed-api/vulnerability/wordpress-indeed-api-plugin-0-5-csrf-to-settings-change-vulnerability?_s_id=cve
CVE: CVE-2025-25104
Published: 2025-02-07
Description: Cross-Site Request Forgery (CSRF) vulnerability in mraliende URL-Preview-Box good-url-preview-box allows Cross Site Request Forgery.This issue affects URL-Preview-Box: from n/a through <= 1.20.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/good-url-preview-box/vulnerability/wordpress-url-preview-box-plugin-1-20-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE: CVE-2025-25105
Published: 2025-02-07
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in coffeestudios Pop Up popup-seo-optimized allows Stored XSS.This issue affects Pop Up: from n/a through <= 0.1.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/popup-seo-optimized/vulnerability/wordpress-pop-up-plugin-0-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-25106
Published: 2025-02-07
Description: Cross-Site Request Forgery (CSRF) vulnerability in FancyWP Starter Templates by FancyWP starter-templates allows Cross Site Request Forgery.This issue affects Starter Templates by FancyWP: from n/a through <= 2.0.0.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/starter-templates/vulnerability/wordpress-starter-templates-by-fancywp-plugin-2-0-0-csrf-to-arbitrary-plugin-installation-vulnerability?_s_id=cve
CVE: CVE-2025-25107
Published: 2025-02-07
Description: Cross-Site Request Forgery (CSRF) vulnerability in sainwp OneStore Sites onestore-sites allows Cross Site Request Forgery.This issue affects OneStore Sites: from n/a through <= 0.1.1.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/onestore-sites/vulnerability/wordpress-onestore-sites-plugin-0-1-1-csrf-to-arbitrary-plugin-installation-vulnerability?_s_id=cve
CVE: CVE-2025-25110
Published: 2025-02-07
Description: Missing Authorization vulnerability in Metagauss Event Kikfyre kikfyre-events-calendar-tickets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Kikfyre: from n/a through <= 2.1.8.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/kikfyre-events-calendar-tickets/vulnerability/wordpress-event-kikfyre-plugin-2-1-8-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-25111
Published: 2025-02-07
Description: Cross-Site Request Forgery (CSRF) vulnerability in WP Spell Check WP Spell Check wp-spell-check allows Cross Site Request Forgery.This issue affects WP Spell Check: from n/a through <= 9.21.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/wp-spell-check/vulnerability/wordpress-wp-spell-check-plugin-9-21-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-25116
Published: 2025-02-07
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in sudipto Link to URL / Post link-to-url-post allows Blind SQL Injection.This issue affects Link to URL / Post: from n/a through <= 1.3.
CVSS Score: 7.6 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/link-to-url-post/vulnerability/wordpress-link-to-url-post-plugin-1-3-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-25117
Published: 2025-02-07
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Alex Polonski Smart Countdown FX smart-countdown-fx allows Stored XSS.This issue affects Smart Countdown FX: from n/a through <= 1.5.5.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/smart-countdown-fx/vulnerability/wordpress-smart-countdown-fx-plugin-1-5-5-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-25120
Published: 2025-02-07
Description: Missing Authorization vulnerability in Melodic Media Slide Banners slide-banners allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Slide Banners: from n/a through <= 1.3.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/slide-banners/vulnerability/wordpress-slide-banners-plugin-1-3-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-25123
Published: 2025-02-07
Description: Cross-Site Request Forgery (CSRF) vulnerability in xdark Easy Related Posts easy-related-posts allows Stored XSS.This issue affects Easy Related Posts: from n/a through <= 2.0.2.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/easy-related-posts/vulnerability/wordpress-easy-related-posts-plugin-2-0-2-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE: CVE-2025-25125
Published: 2025-02-07
Description: Cross-Site Request Forgery (CSRF) vulnerability in CyrilG Fyrebox Quizzes fyrebox-shortcode allows Stored XSS.This issue affects Fyrebox Quizzes: from n/a through <= 3.1.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/fyrebox-shortcode/vulnerability/wordpress-fyrebox-quizzes-plugin-2-7-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE: CVE-2025-25126
Published: 2025-02-07
Description: Cross-Site Request Forgery (CSRF) vulnerability in zmseo ZMSEO zmseo allows Stored XSS.This issue affects ZMSEO: from n/a through <= 1.14.1.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/zmseo/vulnerability/wordpress-zmseo-plugin-1-14-1-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE: CVE-2025-25128
Published: 2025-02-07
Description: Cross-Site Request Forgery (CSRF) vulnerability in orlandolac Facilita Form Tracker facilita-form-tracker allows Stored XSS.This issue affects Facilita Form Tracker: from n/a through <= 1.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/facilita-form-tracker/vulnerability/wordpress-facilita-form-tracker-plugin-1-0-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE: CVE-2025-25135
Published: 2025-02-07
Description: Cross-Site Request Forgery (CSRF) vulnerability in Victor Barkalov Custom Links On Admin Dashboard Toolbar customize-wpadmin allows Stored XSS.This issue affects Custom Links On Admin Dashboard Toolbar: from n/a through <= 3.3.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/customize-wpadmin/vulnerability/wordpress-custom-links-on-admin-dashboard-toolbar-plugin-3-3-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE: CVE-2025-25136
Published: 2025-02-07
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in shujahat21 Optimate Ads optimate-ads allows Stored XSS.This issue affects Optimate Ads: from n/a through <= 1.0.3.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/optimate-ads/vulnerability/wordpress-optimate-ads-plugin-1-0-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-25138
Published: 2025-02-07
Description: Cross-Site Request Forgery (CSRF) vulnerability in Rishi On Page SEO + Whatsapp Chat Button ops-robots-txt allows Stored XSS.This issue affects On Page SEO + Whatsapp Chat Button: from n/a through <= 2.0.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/ops-robots-txt/vulnerability/wordpress-on-page-seo-social-live-chat-formerly-ops-plugin-2-0-0-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE: CVE-2025-25139
Published: 2025-02-07
Description: Cross-Site Request Forgery (CSRF) vulnerability in Cynob IT Consultancy WP Custom Post RSS Feed wp-custom-post-rss-feed allows Stored XSS.This issue affects WP Custom Post RSS Feed: from n/a through <= 1.0.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/wp-custom-post-rss-feed/vulnerability/wordpress-wp-custom-post-rss-feed-plugin-1-0-0-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE: CVE-2025-25140
Published: 2025-02-07
Description: Cross-Site Request Forgery (CSRF) vulnerability in Scriptonite Simple User Profile simple-user-profile allows Stored XSS.This issue affects Simple User Profile: from n/a through <= 1.9.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/simple-user-profile/vulnerability/wordpress-simple-user-profile-plugin-1-9-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE: CVE-2025-25141
Published: 2025-02-07
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in zankover Fami Sales Popup fami-sales-popup allows PHP Local File Inclusion.This issue affects Fami Sales Popup: from n/a through <= 2.0.0.
CVSS Score: 7.5 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Plugin/fami-sales-popup/vulnerability/wordpress-fami-sales-popup-plugin-2-0-0-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-25143
Published: 2025-02-07
Description: Cross-Site Request Forgery (CSRF) vulnerability in ibasit GlobalQuran globalquran allows Cross Site Request Forgery.This issue affects GlobalQuran: from n/a through <= 1.0.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/globalquran/vulnerability/wordpress-globalquran-plugin-1-0-csrf-to-settings-change-vulnerability?_s_id=cve
CVE: CVE-2025-25144
Published: 2025-02-07
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in theasys Theasys theasys allows Stored XSS.This issue affects Theasys: from n/a through <= 1.0.1.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/theasys/vulnerability/wordpress-theasys-plugin-1-0-1-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE: CVE-2025-25145
Published: 2025-02-07
Description: Cross-Site Request Forgery (CSRF) vulnerability in jordan.hatch Infusionsoft Analytics infusionsoft-web-tracker allows Cross Site Request Forgery.This issue affects Infusionsoft Analytics: from n/a through <= 2.0.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/infusionsoft-web-tracker/vulnerability/wordpress-infusionsoft-analytics-plugin-2-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-25146
Published: 2025-02-07
Description: Cross-Site Request Forgery (CSRF) vulnerability in saleandro Songkick Concerts and Festivals songkick-concerts-and-festivals allows Cross Site Request Forgery.This issue affects Songkick Concerts and Festivals: from n/a through <= 0.9.7.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/songkick-concerts-and-festivals/vulnerability/wordpress-songkick-concerts-and-festivals-plugin-0-9-7-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-25147
Published: 2025-02-07
Description: Cross-Site Request Forgery (CSRF) vulnerability in Phillip.Gooch Auto SEO auto-seo allows Stored XSS.This issue affects Auto SEO: from n/a through <= 2.5.6.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/auto-seo/vulnerability/wordpress-auto-seo-plugin-2-5-6-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE: CVE-2025-25148
Published: 2025-02-07
Description: Cross-Site Request Forgery (CSRF) vulnerability in ElbowRobo Read More Copy Link read-more-copy-link allows Stored XSS.This issue affects Read More Copy Link: from n/a through <= 1.0.2.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/read-more-copy-link/vulnerability/wordpress-read-more-copy-link-plugin-1-0-2-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE: CVE-2025-25149
Published: 2025-02-07
Description: Cross-Site Request Forgery (CSRF) vulnerability in Danillo Nunes Login-box login-box allows Stored XSS.This issue affects Login-box: from n/a through <= 2.0.4.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/login-box/vulnerability/wordpress-login-box-plugin-2-0-4-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE: CVE-2025-25151
Published: 2025-02-07
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Stylemix uListing ulisting allows SQL Injection.This issue affects uListing: from n/a through <= 2.1.6.
CVSS Score: 8.5 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/ulisting/vulnerability/wordpress-ulisting-plugin-2-1-6-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-25152
Published: 2025-02-07
Description: Cross-Site Request Forgery (CSRF) vulnerability in LukaszWiecek Smart DoFollow smart-dofollow allows Stored XSS.This issue affects Smart DoFollow: from n/a through <= 1.0.2.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/smart-dofollow/vulnerability/wordpress-smart-dofollow-plugin-1-0-2-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE: CVE-2025-25153
Published: 2025-02-07
Description: Cross-Site Request Forgery (CSRF) vulnerability in djjmz Simple Auto Tag simple-auto-tag allows Stored XSS.This issue affects Simple Auto Tag: from n/a through <= 1.1.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/simple-auto-tag/vulnerability/wordpress-simple-auto-tag-plugin-1-1-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE: CVE-2025-25154
Published: 2025-02-07
Description: Cross-Site Request Forgery (CSRF) vulnerability in scweber Custom Comment Notifications custom-comment-notifications allows Stored XSS.This issue affects Custom Comment Notifications: from n/a through <= 1.0.8.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/custom-comment-notifications/vulnerability/wordpress-custom-comment-notifications-plugin-1-0-8-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE: CVE-2025-25155
Published: 2025-02-07
Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in efreja Music Sheet Viewer music-sheet-viewer allows Path Traversal.This issue affects Music Sheet Viewer: from n/a through <= 4.1.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://patchstack.com/database/Wordpress/Plugin/music-sheet-viewer/vulnerability/wordpress-music-sheet-viewer-plugin-4-1-arbitrary-file-read-vulnerability?_s_id=cve
CVE: CVE-2025-25156
Published: 2025-02-07
Description: Cross-Site Request Forgery (CSRF) vulnerability in Stanko Metodiev Quote Comments quote-comments allows Stored XSS.This issue affects Quote Comments: from n/a through <= 3.0.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/quote-comments/vulnerability/wordpress-quote-comments-plugin-2-2-1-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE: CVE-2025-25159
Published: 2025-02-07
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in robert_kolatzek WP doodlez wpdoodlez allows Stored XSS.This issue affects WP doodlez: from n/a through <= 1.0.10.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wpdoodlez/vulnerability/wordpress-wp-doodlez-plugin-1-0-10-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-25160
Published: 2025-02-07
Description: Cross-Site Request Forgery (CSRF) vulnerability in Mark Barnes Style Tweaker style-tweaker allows Stored XSS.This issue affects Style Tweaker: from n/a through <= 0.11.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/style-tweaker/vulnerability/wordpress-style-tweaker-plugin-0-11-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE: CVE-2025-25163
Published: 2025-02-07
Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Zach Swetz Plugin A/B Image Optimizer images-optimizer allows Path Traversal.This issue affects Plugin A/B Image Optimizer: from n/a through <= 3.3.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://patchstack.com/database/Wordpress/Plugin/images-optimizer/vulnerability/wordpress-plugin-a-b-image-optimizer-plugin-3-3-arbitrary-file-download-vulnerability?_s_id=cve
CVE: CVE-2025-25166
Published: 2025-02-07
Description: Cross-Site Request Forgery (CSRF) vulnerability in gabrieldarezzo InLocation inlocation allows Stored XSS.This issue affects InLocation: from n/a through <= 1.8.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/inlocation/vulnerability/wordpress-inlocation-plugin-1-8-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-25167
Published: 2025-02-07
Description: Missing Authorization vulnerability in Black and White BookPress – For Book Authors book-press allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BookPress – For Book Authors: from n/a through <= 1.2.7.
CVSS Score: 8.2 (HIGH)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/book-press/vulnerability/wordpress-bookpress-for-book-authors-plugin-1-2-7-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-25168
Published: 2025-02-07
Description: Cross-Site Request Forgery (CSRF) vulnerability in Black and White BookPress – For Book Authors book-press allows Cross-Site Scripting (XSS).This issue affects BookPress – For Book Authors: from n/a through <= 1.2.7.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/book-press/vulnerability/wordpress-bookpress-for-book-authors-plugin-1-2-7-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE: CVE-2025-25069
Published: 2025-02-07
Description: A Cross-Protocol Scripting vulnerability is found in Apache Kvrocks.

Since Kvrocks didn't detect if "Host:" or "POST" appears in RESP requests,
a valid HTTP request can also be sent to Kvrocks as a valid RESP request 
and trigger some database operations, which can be dangerous when 
it is chained with SSRF.

It is similiar to CVE-2016-10517 in Redis.

This issue affects Apache Kvrocks: from the initial version to the latest version 2.11.0.

Users are recommended to upgrade to version 2.11.1, which fixes the issue.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-115
References: https://lists.apache.org/thread/gbxv9gpsskmdzg6z48zm3tvo8cyo9v3t; https://www.cve.org/CVERecord?id=CVE-2016-10517
CVE: CVE-2025-1107
Published: 2025-02-07
Description: Unverified password change vulnerability in Janto, versions prior to r12. This could allow an unauthenticated attacker to change another user's password without knowing their current password. To exploit the vulnerability, the attacker must create a specific POST request and send it to the endpoint ‘/public/cgi/Gateway.php’.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-620
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-janto
CVE: CVE-2025-1108
Published: 2025-02-07
Description: Insufficient data authenticity verification vulnerability in Janto, versions prior to r12. This allows an unauthenticated attacker to modify the content of emails sent to reset the password. To exploit the vulnerability, the attacker must create a POST request by injecting malicious content into the ‘Xml’ parameter on the ‘/public/cgi/Gateway.php’ endpoint.
CVSS Score: 8.6 (HIGH)
CWE: CWE-345
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-janto
CVE: CVE-2024-10383
Published: 2025-02-07
Description: An issue has been discovered in the gitlab-web-ide-vscode-fork component distributed over CDN affecting all versions prior to 1.89.1-1.0.0-dev[PII_REDACTED]4343and used by all versions of GitLab CE/EE starting from 15.11 prior to 17.3 and which also temporarily affected versions 17.4, 17.5 and 17.6, where a XSS attack was possible when loading .ipynb files in the web IDE
CVSS Score: 8.7 (HIGH)
CWE: CWE-79
References: https://gitlab.com/gitlab-org/gitlab/-/issues/500785; https://hackerone.com/reports/2765778; https://gitlab.com/gitlab-org/gitlab/-/issues/500785
CVE: CVE-2024-35106
Published: 2025-02-07
Description: NEXTU FLETA AX1500 WIFI6 v1.0.3 was discovered to contain a buffer overflow at /boafrm/formIpQoS. This vulnerability allows attackers to cause a Denial of Service (DoS) or potentially arbitrary code execution via a crafted POST request.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-120
References: https://ez-net.co.kr/new_2012/customer/download_view.php?cid=&sid=&goods=&cate=&q=&seq=233; https://ez-net.co.kr/new_2012/product/view.php?cid=461&sid=467&q=%C7%C3%B7%B9%C5%B8&seq=3479&page=; https://gist.github.com/laskdjlaskdj12/571db73f18be1da1271fa1eb09f488de
CVE: CVE-2025-1103
Published: 2025-02-07
Description: A vulnerability, which was classified as problematic, was found in D-Link DIR-823X 240126/240802. This affects the function set_wifi_blacklists of the file /goform/set_wifi_blacklists of the component HTTP POST Request Handler. The manipulation of the argument macList leads to null pointer dereference. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-404, CWE-476, CWE-476
References: https://tasty-foxtrot-3a8.notion.site/D-link-DIR-823X-set_wifi_blacklists-Vulnerability-1870448e619580e5bf09cf628692f7a9?pvs=73; https://vuldb.com/?ctiid.294933; https://vuldb.com/?id.294933
CVE: CVE-2024-48091
Published: 2025-02-07
Description: Tally Prime Edit Log v2.1 was discovered to contain a DLL hijacking vulnerability via the component TextShaping.dll. This vulnerability allows attackers to execute arbitrary code via a crafted DLL.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427
References: https://gist.github.com/singhmanpreet493/0f1df7fa4e744a3317877ab85d187937#file-gistfile1-txt; https://tallysolutions.com/download/