deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-20967
Published: 2025-05-07
Description: Improper access control in Samsung Gallery prior to version 14.5.10.3 in Global Android 13, 14.5.09.3 in China Android 13, and 15.5.04.5 in Android 14 allows attackers to read and write arbitrary file with the privilege of Samsung Gallery.
CVSS Score: 5.1 (MEDIUM)
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2025&month=05
CVE: CVE-2025-20968
Published: 2025-05-07
Description: Improper access control in Samsung Gallery prior to version 14.5.10.3 in Global Android 13, 14.5.09.3 in China Android 13, and 15.5.04.5 in Android 14 allows remote attackers to access data and perform internal operations within Samsung Gallery.
CVSS Score: 7.2 (HIGH)
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2025&month=05
CVE: CVE-2025-20969
Published: 2025-05-07
Description: Improper input validation in Samsung Gallery prior to version 14.5.10.3 in Global Android 13, 14.5.09.3 in China Android 13, and 15.5.04.5 in Android 14 allows local attackers to access data within Samsung Gallery.
CVSS Score: 5.5 (MEDIUM)
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2025&month=05
CVE: CVE-2025-20970
Published: 2025-05-07
Description: Improper access control in Bixby Vision prior to version 3.8.1 in Android 13, 3.8.3 in Android 14, 3.8.21 in Android 15 allows local attackers to access image files with Bixby Vision privilege.
CVSS Score: 6.2 (MEDIUM)
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2025&month=05
CVE: CVE-2025-20971
Published: 2025-05-07
Description: Improper input validation in Samsung Flow prior to version 4.9.17.6 allows local attackers to access data within Samsung Flow.
CVSS Score: 5.5 (MEDIUM)
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2025&month=05
CVE: CVE-2025-20972
Published: 2025-05-07
Description: Improper verification of intent by broadcast receiver in Samsung Flow prior to version 4.9.17.6 allows local attackers to modify Samsung Flow configuration.
CVSS Score: 6.2 (MEDIUM)
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2025&month=05
CVE: CVE-2025-20973
Published: 2025-05-07
Description: Improper authentication in Secure Folder prior to version 1.8.12.0 in Android 13, and 1.9.21.00 in Android 14 allows physical attackers to reset the lock type of Secure Folder.
CVSS Score: 5.4 (MEDIUM)
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2025&month=05
CVE: CVE-2025-20974
Published: 2025-05-07
Description: Improper handling of insufficient permission in PackageInstallerCN prior to version 15.0.11.0 allows local attacker to bypass user interaction for requested installation.
CVSS Score: 6.1 (MEDIUM)
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2025&month=05
CVE: CVE-2025-20975
Published: 2025-05-07
Description: Improper Export of Android Application Components in AODService prior to version 8.8.28.12 allows local attackers to launch arbitrary activity with systemui privilege.
CVSS Score: 5.5 (MEDIUM)
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2025&month=05
CVE: CVE-2025-20976
Published: 2025-05-07
Description: Out-of-bounds read in applying binary of text content in Samsung Notes prior to version 4.4.29.23 allows attackers to read out-of-bounds memory.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2025&month=05
CVE: CVE-2025-20977
Published: 2025-05-07
Description: Use of implicit intent for sensitive communication in translation in Samsung Notes prior to version 4.4.29.23 allows local attackers to get sensitive information. User interaction is required for triggering this vulnerability.
CVSS Score: 3.3 (LOW)
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2025&month=05
CVE: CVE-2025-20978
Published: 2025-05-07
Description: Improper access control in PENUP prior to version 3.9.19.32 allows local attackers to access files with PENUP privilege.
CVSS Score: 6.2 (MEDIUM)
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2025&month=05
CVE: CVE-2025-20979
Published: 2025-05-07
Description: Out-of-bounds write in libsavscmn prior to Android 15 allows local attackers to execute arbitrary code.
CVSS Score: 8.4 (HIGH)
CWE: CWE-787
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2025&month=05
CVE: CVE-2025-20980
Published: 2025-05-07
Description: Out-of-bounds write in libsavscmn prior to Android 15 allows local attackers to cause memory corruption.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-787
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2025&month=05
CVE: CVE-2025-27533
Published: 2025-05-07
Description: Memory Allocation with Excessive Size Value vulnerability in Apache ActiveMQ.

During unmarshalling of OpenWire commands the size value of buffers was not properly validated which could lead to excessive memory allocation and be exploited to cause a denial of service (DoS) by depleting process memory, thereby affecting applications and services that rely on the availability of the ActiveMQ broker when not using mutual TLS connections.
This issue affects Apache ActiveMQ: from 6.0.0 before 6.1.6, from 5.18.0 before 5.18.7, from 5.17.0 before 5.17.7, before 5.16.8. ActiveMQ 5.19.0 is not affected.

Users are recommended to upgrade to version 6.1.6+, 5.19.0+,  5.18.7+, 5.17.7, or 5.16.8 or which fixes the issue.

Existing users may implement mutual TLS to mitigate the risk on affected brokers.
CVSS Score: 7.5 (HIGH)
CWE: CWE-789
References: https://lists.apache.org/thread/8hcm25vf7mchg4zbbhnlx2lc5bs705hg; http://www.openwall.com/lists/oss-security/2025/05/06/1; https://lists.debian.org/debian-lts-announce/2025/06/msg00020.html
CVE: CVE-2025-39361
Published: 2025-05-07
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Royal Royal Elementor Addons royal-elementor-addons allows Stored XSS.This issue affects Royal Elementor Addons: from n/a through <= 1.7.1017.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/royal-elementor-addons/vulnerability/wordpress-royal-elementor-addons-plugin-1-7-1017-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-4104
Published: 2025-05-07
Description: The Frontend Dashboard plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the fed_wp_ajax_fed_login_form_post() function in versions 1.0 to 2.2.6. This makes it possible for unauthenticated attackers to reset the administrator’s email and password, and elevate their privileges to that of an administrator.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-285
References: https://plugins.trac.wordpress.org/browser/frontend-dashboard/tags/2.2.6/includes/frontend/request/login/index.php#L21; https://plugins.trac.wordpress.org/browser/frontend-dashboard/tags/2.2.6/includes/frontend/request/login/register.php#L16; https://plugins.trac.wordpress.org/browser/frontend-dashboard/tags/2.2.7/includes/frontend/request/login/validation.php
CVE: CVE-2025-33093
Published: 2025-05-07
Description: IBM Sterling Partner Engagement Manager 6.1.0, 6.2.0, 6.2.2 JWT secret is stored in public Helm Charts and is not stored as a Kubernetes secret.
CVSS Score: 7.5 (HIGH)
CWE: CWE-260, CWE-522
References: https://www.ibm.com/support/pages/node/7232762
CVE: CVE-2020-36791
Published: 2025-05-07
Description: In the Linux kernel, the following vulnerability has been resolved:

net_sched: keep alloc_hash updated after hash allocation

In commit 599be01ee567 ("net_sched: fix an OOB access in cls_tcindex")
I moved cp->hash calculation before the first
tcindex_alloc_perfect_hash(), but cp->alloc_hash is left untouched.
This difference could lead to another out of bound access.

cp->alloc_hash should always be the size allocated, we should
update it after this tcindex_alloc_perfect_hash().
CVSS Score: 7.1 (HIGH)
CWE: CWE-125
References: https://blog.cdthoughts.ch/2021/03/16/syzbot-bug.html; https://git.kernel.org/stable/c/0d1c3530e1bd38382edef72591b78e877e0edcd3; https://git.kernel.org/stable/c/557d015ffb27b672e24e6ad141fd887783871dc2
CVE: CVE-2025-29152
Published: 2025-05-07
Description: Cross-Site Scripting vulnerability in lemeconsultoria HCM galera.app v.4.58.0 allows an attacker to execute arbitrary code via multiple components, including Strategic Planning Perspective Registration, Training Request, Perspective Editing, Education Registration, Hierarchical Level Registration, Decision Level Registration, Perspective Registration, Company Group Registration, Company Registration, News Registration, Employee Editing, Goal Team Registration, Learning Resource Type Registration, Learning Resource Family Registration, Learning Resource Supplier Registration, and Cycle Maintenance.
CVSS Score: 7.6 (HIGH)
CWE: CWE-79
References: https://medium.com/@worzyus/poc-2fd1d2ec1eb9; https://wellington-almeida.medium.com/poc-2fd1d2ec1eb9; https://wellington-almeida.medium.com/poc-2fd1d2ec1eb9
CVE: CVE-2025-29153
Published: 2025-05-07
Description: SQL Injection vulnerability in lemeconsultoria HCM galera.app v.4.58.0 allows an attacker to execute arbitrary code via the Data export, filters functions.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-89
References: https://wellington-almeida.medium.com/poc-sql-391c437c3960; https://worzyus.medium.com/391c437c3960; https://wellington-almeida.medium.com/poc-sql-391c437c3960
CVE: CVE-2025-29154
Published: 2025-05-07
Description: HTML injection vulnerability in lemeconsultoria HCM galera.app v.4.58.0 allows an attacker to execute arbitrary code via the .galera.app/ted/solicitacao_treinamento/, .galera.app/rh/metas/perspectiva_estrategica/edicao/, .galera.app/rh/cadastros/perspectivas/listagem/adc/, .galera.app/escolaridade/listagem/, .galera.app/estados_civis/cadastro/, .galera.app/nivel_hierarquico/listagem/, .galera.app/nivel_decisorio/cadastro/, .galera.app/escolaridade/cadastro/, .galera.app/nivel_decisorio/listagem/, .galera.app/rh/cadastros/perspectivas/listagem/, .galera.app/empresas_grupo/cadastro/, .galera.app/empresas/edicao/, .galera.app/liais/listagem/, .galera.app/noticias/listagem/, .galera.app/gerenciamento-de-ciclo/abertura/cadastrar, .galera.app/colaborador/cadastro/cursos/adc/edicao/, .galera.app/colaborador/cadastro/adc/, .galera.app/cads_aux/escalact/, .galera.app/ncf/tec/cadastro/ct/ .galera.app/rh/metas/painel/, .galera.app/rh/metas/equipe/edicao/, .galera.app/rh/pdi/tipo_recursos/edicao/, .galera.app/rh/pdi/familia_recursos/cadastro/, .galera.app/rh/pdi/fornecedores/edicao/, and .galera.app/rh/pdi/recursos/cadastro/ components.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-77
References: https://wellington-almeida.medium.com/poc-html-injection-0f27e657c962; https://worzyus.medium.com/0f27e657c962
CVE: CVE-2025-29602
Published: 2025-05-07
Description: flatpress 1.3.1 is vulnerable to Cross Site Scripting (XSS) in Administration area via Manage categories.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/flatpressblog/flatpress; https://harish0x.github.io/blog/CVE-2025-29602
CVE: CVE-2025-29448
Published: 2025-05-07
Description: Booking logic flaw in Easy!Appointments v1.5.1 allows unauthenticated attackers to create appointments with excessively long durations, causing a denial of service by blocking all future booking availability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-284
References: https://github.com/Abdullah4eb/CVE-2025-29448
CVE: CVE-2025-2775
Published: 2025-05-07
Description: SysAid On-Prem versions <= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the Checkin processing functionality,  allowing for administrator account takeover and file read primitives.
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-611
References: https://documentation.sysaid.com/docs/24-40-60; https://labs.watchtowr.com/sysowned-your-friendly-rce-support-ticket/; https://labs.watchtowr.com/sysowned-your-friendly-rce-support-ticket/
CVE: CVE-2025-2776
Published: 2025-05-07
Description: SysAid On-Prem versions <= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the Server URL processing functionality, allowing for administrator account takeover and file read primitives.
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-611
References: https://documentation.sysaid.com/docs/24-40-60; https://labs.watchtowr.com/sysowned-your-friendly-rce-support-ticket/; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-2776
CVE: CVE-2025-2777
Published: 2025-05-07
Description: SysAid On-Prem versions <= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the lshw processing functionality,  allowing for administrator account takeover and file read primitives.
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-611
References: https://documentation.sysaid.com/docs/24-40-60; https://labs.watchtowr.com/sysowned-your-friendly-rce-support-ticket/; https://labs.watchtowr.com/sysowned-your-friendly-rce-support-ticket/
CVE: CVE-2025-2778
Published: 2025-05-07
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2025-47439
Published: 2025-05-07
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in WP Chill Download Monitor download-monitor allows PHP Local File Inclusion.This issue affects Download Monitor: from n/a through <= 5.0.22.
CVSS Score: 7.5 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Plugin/download-monitor/vulnerability/wordpress-download-monitor-5-0-22-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-47440
Published: 2025-05-07
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Greg Winiarski WPAdverts wpadverts allows PHP Local File Inclusion.This issue affects WPAdverts: from n/a through <= 2.2.2.
CVSS Score: 7.5 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Plugin/wpadverts/vulnerability/wordpress-wpadverts-2-2-2-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-47441
Published: 2025-05-07
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Chris Reynolds Progress Bar progress-bar allows Stored XSS.This issue affects Progress Bar: from n/a through <= 2.2.3.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/progress-bar/vulnerability/wordpress-progress-bar-2-2-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-47442
Published: 2025-05-07
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CC CC BMI Calculator cc-bmi-calculator allows Stored XSS.This issue affects CC BMI Calculator: from n/a through <= 2.1.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/cc-bmi-calculator/vulnerability/wordpress-cc-bmi-calculator-2-1-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-47443
Published: 2025-05-07
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpdevart Widget Countdown widget-countdown allows Stored XSS.This issue affects Widget Countdown: from n/a through <= 2.7.4.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/widget-countdown/vulnerability/wordpress-widget-countdown-2-7-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-47446
Published: 2025-05-07
Description: Cross-Site Request Forgery (CSRF) vulnerability in listamester Listamester listamester allows Cross Site Request Forgery.This issue affects Listamester: from n/a through <= 2.3.6.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/listamester/vulnerability/wordpress-listamester-2-3-6-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-47447
Published: 2025-05-07
Description: Cross-Site Request Forgery (CSRF) vulnerability in Hossni Mubarak Cool Author Box hm-cool-author-box-widget allows Cross Site Request Forgery.This issue affects Cool Author Box: from n/a through <= 3.0.0.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/hm-cool-author-box-widget/vulnerability/wordpress-cool-author-box-3-0-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-47448
Published: 2025-05-07
Description: Cross-Site Request Forgery (CSRF) vulnerability in ThimPress WP Hotel Booking wp-hotel-booking allows Cross Site Request Forgery.This issue affects WP Hotel Booking: from n/a through <= 2.1.9.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/wp-hotel-booking/vulnerability/wordpress-wp-hotel-booking-2-1-9-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-47449
Published: 2025-05-07
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jordy Meow Meow Gallery meow-gallery allows Stored XSS.This issue affects Meow Gallery: from n/a through <= 5.2.7.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/meow-gallery/vulnerability/wordpress-meow-gallery-5-2-7-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-47450
Published: 2025-05-07
Description: Missing Authorization vulnerability in Mitchell Bennis Simple File List simple-file-list allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simple File List: from n/a through <= 6.1.13.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/simple-file-list/vulnerability/wordpress-simple-file-list-6-1-13-settings-change-vulnerability?_s_id=cve
CVE: CVE-2025-47451
Published: 2025-05-07
Description: Cross-Site Request Forgery (CSRF) vulnerability in silverplugins217 Product Quantity Dropdown For Woocommerce product-quantity-dropdown-for-woocommerce allows Cross Site Request Forgery.This issue affects Product Quantity Dropdown For Woocommerce: from n/a through <= 1.2.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/product-quantity-dropdown-for-woocommerce/vulnerability/wordpress-product-quantity-dropdown-for-woocommerce-plugin-1-2-cross-site-request-forgery-csrf-to-settings-change-vulnerability?_s_id=cve
CVE: CVE-2025-47454
Published: 2025-05-07
Description: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CRM Perks WP Gravity Forms Dynamics CRM gf-dynamics-crm allows Phishing.This issue affects WP Gravity Forms Dynamics CRM: from n/a through <= 1.1.4.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-601
References: https://patchstack.com/database/Wordpress/Plugin/gf-dynamics-crm/vulnerability/wordpress-wp-gravity-forms-dynamics-crm-1-1-4-open-redirection-vulnerability?_s_id=cve
CVE: CVE-2025-47455
Published: 2025-05-07
Description: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CRM Perks Integration for WooCommerce and Salesforce woo-salesforce-plugin-crm-perks allows Phishing.This issue affects Integration for WooCommerce and Salesforce: from n/a through <= 1.7.5.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-601
References: https://patchstack.com/database/Wordpress/Plugin/woo-salesforce-plugin-crm-perks/vulnerability/wordpress-integration-for-woocommerce-and-salesforce-1-7-5-open-redirection-vulnerability?_s_id=cve
CVE: CVE-2025-47456
Published: 2025-05-07
Description: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CRM Perks WP Gravity Forms Zendesk gf-zendesk allows Phishing.This issue affects WP Gravity Forms Zendesk: from n/a through <= 1.1.2.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-601
References: https://patchstack.com/database/Wordpress/Plugin/gf-zendesk/vulnerability/wordpress-wp-gravity-forms-zendesk-1-1-2-open-redirection-vulnerability?_s_id=cve
CVE: CVE-2025-47457
Published: 2025-05-07
Description: Missing Authorization vulnerability in dgamoni LocateAndFilter locateandfilter allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects LocateAndFilter: from n/a through <= 1.6.16.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/locateandfilter/vulnerability/wordpress-locateandfilter-1-6-16-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-47459
Published: 2025-05-07
Description: Cross-Site Request Forgery (CSRF) vulnerability in Roxnor FundEngine wp-fundraising-donation allows Cross Site Request Forgery.This issue affects FundEngine: from n/a through <= 1.7.3.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/wp-fundraising-donation/vulnerability/wordpress-wp-fundraising-donation-and-crowdfunding-platform-1-7-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-47460
Published: 2025-05-07
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TrackShip TrackShip for WooCommerce trackship-for-woocommerce allows SQL Injection.This issue affects TrackShip for WooCommerce: from n/a through <= 1.9.1.
CVSS Score: 7.6 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/trackship-for-woocommerce/vulnerability/wordpress-trackship-for-woocommerce-1-9-1-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-47462
Published: 2025-05-07
Description: Cross-Site Request Forgery (CSRF) vulnerability in WebAppick Challan webappick-pdf-invoice-for-woocommerce allows Privilege Escalation.This issue affects Challan: from n/a through <= 3.7.58.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/webappick-pdf-invoice-for-woocommerce/vulnerability/wordpress-challan-plugin-3-7-58-csrf-to-privilege-escalation-vulnerability?_s_id=cve
CVE: CVE-2025-47464
Published: 2025-05-07
Description: Server-Side Request Forgery (SSRF) vulnerability in solacewp Solace Extra solace-extra allows Server Side Request Forgery.This issue affects Solace Extra: from n/a through <= 1.3.1.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-918
References: https://patchstack.com/database/Wordpress/Plugin/solace-extra/vulnerability/wordpress-solace-extra-1-3-1-server-side-request-forgery-ssrf-vulnerability?_s_id=cve
CVE: CVE-2025-47465
Published: 2025-05-07
Description: Missing Authorization vulnerability in creativethemeshq Blocksy blocksy allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Blocksy: from n/a through <= 2.0.97.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Theme/blocksy/vulnerability/wordpress-blocksy-2-0-97-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-47466
Published: 2025-05-07
Description: Cross-Site Request Forgery (CSRF) vulnerability in Rustaurius Ultimate WP Mail ultimate-wp-mail allows Cross Site Request Forgery.This issue affects Ultimate WP Mail: from n/a through <= 1.3.4.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/ultimate-wp-mail/vulnerability/wordpress-ultimate-wp-mail-1-3-4-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-47467
Published: 2025-05-07
Description: Missing Authorization vulnerability in GS Plugins GS Testimonial Slider gs-testimonial allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GS Testimonial Slider: from n/a through <= 3.3.0.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/gs-testimonial/vulnerability/wordpress-gs-testimonial-slider-3-3-0-broken-access-control-vulnerability?_s_id=cve