deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-27297
Published: 2025-02-24
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in guelben Bravo Search & Replace bravo-search-and-replace allows Blind SQL Injection.This issue affects Bravo Search & Replace: from n/a through <= 1.0.
CVSS Score: 7.6 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/bravo-search-and-replace/vulnerability/wordpress-bravo-search-replace-plugin-1-0-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-27298
Published: 2025-02-24
Description: Cross-Site Request Forgery (CSRF) vulnerability in cmstactics WP Video Posts wp-video-posts allows OS Command Injection.This issue affects WP Video Posts: from n/a through <= 3.5.1.
CVSS Score: 8.3 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/wp-video-posts/vulnerability/wordpress-wp-video-posts-plugin-3-5-1-csrf-to-remote-code-execution-rce-vulnerability?_s_id=cve
CVE: CVE-2025-27300
Published: 2025-02-24
Description: Deserialization of Untrusted Data vulnerability in giuliopanda ADFO admin-form allows Object Injection.This issue affects ADFO: from n/a through <= 1.9.1.
CVSS Score: 7.2 (HIGH)
CWE: CWE-502
References: https://patchstack.com/database/Wordpress/Plugin/admin-form/vulnerability/wordpress-adfo-plugin-1-9-1-deserialization-of-untrusted-data-vulnerability?_s_id=cve
CVE: CVE-2025-27301
Published: 2025-02-24
Description: Deserialization of Untrusted Data vulnerability in Nazmul Hasan Robin NHR Options Table Manager nhrrob-options-table-manager allows Object Injection.This issue affects NHR Options Table Manager: from n/a through <= 1.1.2.
CVSS Score: 7.2 (HIGH)
CWE: CWE-502
References: https://patchstack.com/database/Wordpress/Plugin/nhrrob-options-table-manager/vulnerability/wordpress-nhr-options-table-manager-plugin-1-1-2-deserialization-of-untrusted-data-vulnerability?_s_id=cve
CVE: CVE-2025-27303
Published: 2025-02-24
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themelogger Contact Form 7 Star Rating contact-form-7-star-rating allows Stored XSS.This issue affects Contact Form 7 Star Rating: from n/a through <= 1.10.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/contact-form-7-star-rating/vulnerability/wordpress-contact-form-7-star-rating-plugin-1-10-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-27304
Published: 2025-02-24
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themelogger Contact Form 7 Star Rating with font Awesome contact-form-7-star-rating-with-font-awersome allows Stored XSS.This issue affects Contact Form 7 Star Rating with font Awesome: from n/a through <= 1.3.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/contact-form-7-star-rating-with-font-awersome/vulnerability/wordpress-contact-form-7-star-rating-with-font-awesome-plugin-1-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-27305
Published: 2025-02-24
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Achal Jain Table of Contents Block table-of-contents allows Stored XSS.This issue affects Table of Contents Block: from n/a through <= 1.0.2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/table-of-contents/vulnerability/wordpress-table-of-contents-block-plugin-1-0-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-27306
Published: 2025-02-24
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pathomation Pathomation pathomation allows Stored XSS.This issue affects Pathomation: from n/a through <= 2.5.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/pathomation/vulnerability/wordpress-pathomation-plugin-2-5-1-stored-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-27307
Published: 2025-02-24
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in oooorgle Quotes llama quotes-llama allows Reflected XSS.This issue affects Quotes llama: from n/a through <= 3.0.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/quotes-llama/vulnerability/wordpress-quotes-llama-plugin-3-0-1-stored-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-27311
Published: 2025-02-24
Description: Cross-Site Request Forgery (CSRF) vulnerability in luk3thomas Bulk Content Creator bulk-content-creator allows Cross Site Request Forgery.This issue affects Bulk Content Creator: from n/a through <= 1.2.1.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/bulk-content-creator/vulnerability/wordpress-bulk-content-creator-plugin-1-2-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-27312
Published: 2025-02-24
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Jenst WP Sitemap wp-sitemap allows SQL Injection.This issue affects WP Sitemap: from n/a through <= 1.0.
CVSS Score: 8.5 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/wp-sitemap/vulnerability/wordpress-wp-sitemap-plugin-1-0-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-27315
Published: 2025-02-24
Description: Cross-Site Request Forgery (CSRF) vulnerability in wptom All-In-One Cufon all-in-one-cufon allows Cross Site Request Forgery.This issue affects All-In-One Cufon: from n/a through <= 1.3.0.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/all-in-one-cufon/vulnerability/wordpress-all-in-one-cufon-plugin-1-3-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-27316
Published: 2025-02-24
Description: Cross-Site Request Forgery (CSRF) vulnerability in hosting.io JPG, PNG Compression and Optimization wp-image-compression allows Cross Site Request Forgery.This issue affects JPG, PNG Compression and Optimization: from n/a through <= 1.7.35.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/wp-image-compression/vulnerability/wordpress-jpg-png-compression-and-optimization-plugin-1-7-35-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-27317
Published: 2025-02-24
Description: Cross-Site Request Forgery (CSRF) vulnerability in IT-RAYS RAYS Grid rays-grid allows Cross Site Request Forgery.This issue affects RAYS Grid: from n/a through <= 1.3.1.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/rays-grid/vulnerability/wordpress-rays-grid-plugin-1-3-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-27318
Published: 2025-02-24
Description: Cross-Site Request Forgery (CSRF) vulnerability in ixiter Simple Google Sitemap simple-google-sitemap allows Cross Site Request Forgery.This issue affects Simple Google Sitemap: from n/a through <= 1.6.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/simple-google-sitemap/vulnerability/wordpress-simple-google-sitemap-plugin-1-6-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-27320
Published: 2025-02-24
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pankaj Mondal Profile Widget Ninja profile-widget-ninja allows DOM-Based XSS.This issue affects Profile Widget Ninja: from n/a through <= 4.3.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/profile-widget-ninja/vulnerability/wordpress-profile-widget-ninja-plugin-4-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-27321
Published: 2025-02-24
Description: Cross-Site Request Forgery (CSRF) vulnerability in Blighty Blightly Explorer blighty-explorer allows Stored XSS.This issue affects Blightly Explorer: from n/a through <= 2.3.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/blighty-explorer/vulnerability/wordpress-blightly-explorer-plugin-2-3-0-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE: CVE-2025-27323
Published: 2025-02-24
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jon Bishop WP About Author wp-about-author allows DOM-Based XSS.This issue affects WP About Author: from n/a through <= 1.5.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wp-about-author/vulnerability/wordpress-wp-about-author-plugin-1-5-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-27325
Published: 2025-02-24
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bruce Video.js HLS Player videojs-hls-player allows DOM-Based XSS.This issue affects Video.js HLS Player: from n/a through <= 1.0.2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/videojs-hls-player/vulnerability/wordpress-video-js-hls-player-plugin-1-0-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-27327
Published: 2025-02-24
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Winlin Live Streaming Video Player – by SRS Player srs-player allows DOM-Based XSS.This issue affects Live Streaming Video Player – by SRS Player: from n/a through <= 1.0.18.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/srs-player/vulnerability/wordpress-live-streaming-video-player-by-srs-player-plugin-1-0-18-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-27328
Published: 2025-02-24
Description: Cross-Site Request Forgery (CSRF) vulnerability in queeez WP-PostRatings Cheater wp-postratings-cheater allows Cross Site Request Forgery.This issue affects WP-PostRatings Cheater: from n/a through <= 1.5.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/wp-postratings-cheater/vulnerability/wordpress-wp-postratings-cheater-plugin-1-5-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-27329
Published: 2025-02-24
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in inlinkz EZ InLinkz linkup inlinkz-scripter allows DOM-Based XSS.This issue affects EZ InLinkz linkup: from n/a through <= 0.18.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/inlinkz-scripter/vulnerability/wordpress-ez-inlinkz-linkup-plugin-0-18-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-27330
Published: 2025-02-24
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PlayerJS PlayerJS playerjs allows DOM-Based XSS.This issue affects PlayerJS: from n/a through <= 2.23.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/playerjs/vulnerability/wordpress-playerjs-plugin-2-23-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-27331
Published: 2025-02-24
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sébastien Dumont WooCommerce Display Products by Tags woocommerce-display-products-by-tags allows DOM-Based XSS.This issue affects WooCommerce Display Products by Tags: from n/a through <= 1.0.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/woocommerce-display-products-by-tags/vulnerability/wordpress-woocommerce-display-products-by-tags-plugin-1-0-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-27332
Published: 2025-02-24
Description: Cross-Site Request Forgery (CSRF) vulnerability in gmnazmul Smart Maintenance & Countdown smart-maintenance-countdown allows Stored XSS.This issue affects Smart Maintenance & Countdown: from n/a through <= 1.2.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/smart-maintenance-countdown/vulnerability/wordpress-smart-maintenance-countdown-plugin-1-2-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE: CVE-2025-27335
Published: 2025-02-24
Description: Cross-Site Request Forgery (CSRF) vulnerability in Free plug in by SEO Roma Auto Tag Links auto-tag-links allows Cross Site Request Forgery.This issue affects Auto Tag Links: from n/a through <= 1.0.13.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/auto-tag-links/vulnerability/wordpress-auto-tag-links-plugin-1-0-13-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-27336
Published: 2025-02-24
Description: Cross-Site Request Forgery (CSRF) vulnerability in Alex Prokopenko / JustCoded Just Variables just-wp-variables allows Cross Site Request Forgery.This issue affects Just Variables: from n/a through <= 1.2.3.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/just-wp-variables/vulnerability/wordpress-just-variables-plugin-1-2-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-27339
Published: 2025-02-24
Description: Cross-Site Request Forgery (CSRF) vulnerability in Will Anderson Minimum Password Strength minimum-password-strength allows Cross Site Request Forgery.This issue affects Minimum Password Strength: from n/a through <= 1.2.0.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/minimum-password-strength/vulnerability/wordpress-minimum-password-strength-plugin-1-2-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-27340
Published: 2025-02-24
Description: Cross-Site Request Forgery (CSRF) vulnerability in Forge12 Interactive GmbH F12-Profiler f12-profiler allows Cross Site Request Forgery.This issue affects F12-Profiler: from n/a through <= 1.3.9.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/f12-profiler/vulnerability/wordpress-f12-profiler-plugin-1-3-9-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-27341
Published: 2025-02-24
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in afzal_du Reactive Mortgage Calculator reactive-mortgage-calculator allows Stored XSS.This issue affects Reactive Mortgage Calculator: from n/a through <= 1.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/reactive-mortgage-calculator/vulnerability/wordpress-reactive-mortgage-calculator-plugin-1-1-stored-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-27342
Published: 2025-02-24
Description: Cross-Site Request Forgery (CSRF) vulnerability in josesan WooCommerce Recargo de Equivalencia woo-recargo-de-equivalencia allows Cross Site Request Forgery.This issue affects WooCommerce Recargo de Equivalencia: from n/a through <= 1.6.24.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/woo-recargo-de-equivalencia/vulnerability/wordpress-woocommerce-recargo-de-equivalencia-plugin-1-6-24-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-27344
Published: 2025-02-24
Description: Cross-Site Request Forgery (CSRF) vulnerability in filipstepanov Phee's LinkPreview linkpreview allows Cross Site Request Forgery.This issue affects Phee's LinkPreview: from n/a through <= 1.6.7.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/linkpreview/vulnerability/wordpress-phee-s-linkpreview-plugin-1-6-7-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-27347
Published: 2025-02-24
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in techmix Direct Checkout Button for WooCommerce woo-direct-checkout-button allows Stored XSS.This issue affects Direct Checkout Button for WooCommerce: from n/a through <= 1.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/woo-direct-checkout-button/vulnerability/wordpress-direct-checkout-button-for-woocommerce-plugin-1-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-27348
Published: 2025-02-24
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Daniel WP Social SEO Booster – Knowledge Graph Social Signals SEO wp-social-seo-booster allows Stored XSS.This issue affects WP Social SEO Booster – Knowledge Graph Social Signals SEO: from n/a through <= 1.2.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wp-social-seo-booster/vulnerability/wordpress-wp-social-seo-booster-plugin-1-2-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-27349
Published: 2025-02-24
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in nurelm Get Posts nurelm-get-posts allows Stored XSS.This issue affects Get Posts: from n/a through <= 0.6.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/nurelm-get-posts/vulnerability/wordpress-get-posts-plugin-0-6-stored-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-27351
Published: 2025-02-24
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ExpertBusinessSearch Local Search SEO Contact Page local-search-seo-contact-page allows Stored XSS.This issue affects Local Search SEO Contact Page: from n/a through <= 4.0.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/local-search-seo-contact-page/vulnerability/wordpress-local-search-seo-contact-page-plugin-4-0-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-27352
Published: 2025-02-24
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wumii team 无觅相关文章插件 wumii-related-posts allows Stored XSS.This issue affects 无觅相关文章插件: from n/a through <= 1.0.5.7.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wumii-related-posts/vulnerability/wordpress-plugin-1-0-5-7-csrf-to-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-27353
Published: 2025-02-24
Description: Cross-Site Request Forgery (CSRF) vulnerability in Bob Namaste! LMS namaste-lms allows Cross Site Request Forgery.This issue affects Namaste! LMS: from n/a through <= 2.6.5.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/namaste-lms/vulnerability/wordpress-namaste-lms-plugin-2-6-5-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-27355
Published: 2025-02-24
Description: Cross-Site Request Forgery (CSRF) vulnerability in Nicolas GRILLET Woocommerce – Loi Hamon loi-hamon allows Stored XSS.This issue affects Woocommerce – Loi Hamon: from n/a through <= 1.1.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/loi-hamon/vulnerability/wordpress-woocommerce-loi-hamon-plugin-1-1-0-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE: CVE-2025-27356
Published: 2025-02-24
Description: Missing Authorization vulnerability in Hardik Sticky Header On Scroll sticky-header-on-scroll allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sticky Header On Scroll: from n/a through <= 1.0.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/sticky-header-on-scroll/vulnerability/wordpress-sticky-header-on-scroll-plugin-1-0-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-27357
Published: 2025-02-24
Description: Cross-Site Request Forgery (CSRF) vulnerability in Musa AVCI Önceki Yazı Link onceki-yazi-linki allows Cross Site Request Forgery.This issue affects Önceki Yazı Link: from n/a through <= 1.3.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/onceki-yazi-linki/vulnerability/wordpress-oenceki-yazi-link-plugin-1-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2024-56897
Published: 2025-02-24
Description: Improper access control in the HTTP server in YI Car Dashcam v3.88 allows unrestricted file downloads, uploads, and API commands. API commands can also be made to make unauthorized modifications to the device settings, such as disabling recording, disabling sounds, factory reset.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434, CWE-434
References: https://geochen.medium.com/cve-2024-56897-yi-car-dashcam-39304a4b21b4; https://github.com/geo-chen/YI-Smart-Dashcam/; https://yitechnology.com.sg/products/dash-camera/
CVE: CVE-2025-25460
Published: 2025-02-24
Description: A stored Cross-Site Scripting (XSS) vulnerability was identified in FlatPress 1.3.1 within the "Add Entry" feature. This vulnerability allows authenticated attackers to inject malicious JavaScript payloads into blog posts, which are executed when other users view the posts. The issue arises due to improper input sanitization of the "TextArea" field in the blog entry submission form.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/RoNiXxCybSeC0101/CVE-2025-25460; https://github.com/flatpressblog/flatpress; https://github.com/RoNiXxCybSeC0101/CVE-2025-25460
CVE: CVE-2025-26803
Published: 2025-02-24
Description: The http parser in Phusion Passenger 6.0.21 through 6.0.25 before 6.0.26 allows a denial of service during parsing of a request with an invalid HTTP method.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-908
References: https://blog.phusion.nl/2025/02/19/passenger-6-0-26/; https://github.com/phusion/passenger/commit/bb[PII_REDACTED]064ab2d578d5f9660b2a4168017; https://github.com/phusion/passenger/compare/release-6.0.25...release-6.0.26
CVE: CVE-2025-22495
Published: 2025-02-24
Description: An improper input validation vulnerability was discovered in the NTP server configuration field of the Network-M2 card. This could result in an authenticated high privileged user having the ability to execute arbitrary commands. The vulnerability has been resolved in the version 3.0.4. 
Note - Network-M2 has been declared end-of-life in early 2024 and Network-M3 has been released as a fit-and-functional replacement.
CVSS Score: 8.4 (HIGH)
CWE: CWE-78
References: https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/etn-va-2025-1004.pdf; https://www.eaton.com/content/dam/eaton/products/backup-power-ups-surge-it-power-distribution/power-management-software-connectivity/eaton-gigabit-network-card/Network-M2%20EOL.pdf
CVE: CVE-2025-26200
Published: 2025-02-24
Description: SQL injection in SLIMS v.9.6.1 allows a remote attacker to escalate privileges via the month parameter in the visitor_report_day.php component.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/slims/slims9_bulian/issues/269; https://mebroccoli.blogspot.com/2025/02/cve2.html
CVE: CVE-2025-26201
Published: 2025-02-24
Description: Credential disclosure vulnerability via the /staff route in GreaterWMS <= 2.1.49 allows a remote unauthenticated attackers to bypass authentication and escalate privileges.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-294
References: http://greaterwms.com; https://github.com/Elymaro/CVE/blob/main/GreaterWMS/CVE-2025-26201.md; https://github.com/GreaterWMS/GreaterWMS/issues/383