deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-4761
Published: 2025-05-16
Description: A vulnerability has been found in PHPGurukul Complaint Management System 2.0 and classified as critical. This vulnerability affects unknown code of the file /admin/admin-profile.php. The manipulation of the argument mobilenumber leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/bleakTS/myCVE/issues/5; https://phpgurukul.com/; https://vuldb.com/?ctiid.309064
CVE: CVE-2025-1975
Published: 2025-05-16
Description: A vulnerability in the Ollama server version 0.5.11 allows a malicious user to cause a Denial of Service (DoS) attack by customizing the manifest content and spoofing a service. This is due to improper validation of array index access when downloading a model via the /api/pull endpoint, which can lead to a server crash.
CVSS Score: 7.5 (HIGH)
CWE: CWE-129
References: https://huntr.com/bounties/921ba5d4-f1d0-4c66-9764-4f72dffe7acd
CVE: CVE-2025-4679
Published: 2025-05-16
Description: A vulnerability in Synology Active Backup for Microsoft 365 allows remote authenticated attackers to obtain sensitive information via unspecified vectors.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-522
References: https://www.synology.com/en-global/security/advisory/Synology_SA_25_06; https://modzero.com/en/blog/when-backups-open-backdoors-synology-active-backup-m365/; https://modzero.com/static/MZ-25-02_modzero_Synology-Active-Backup-M365.pdf
CVE: CVE-2025-4765
Published: 2025-05-16
Description: A vulnerability was found in PHPGurukul Zoo Management System 2.1. It has been classified as critical. Affected is an unknown function of the file /admin/contactus.php. The manipulation of the argument mobnum leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/bleakTS/myCVE/issues/9; https://phpgurukul.com/; https://vuldb.com/?ctiid.309066
CVE: CVE-2025-4766
Published: 2025-05-16
Description: A vulnerability was found in PHPGurukul Zoo Management System 2.1. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /admin/profile.php. The manipulation of the argument contactnumber leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/bleakTS/myCVE/issues/10; https://phpgurukul.com/; https://vuldb.com/?ctiid.309067
CVE: CVE-2025-4767
Published: 2025-05-16
Description: A vulnerability was found in defog-ai introspect up to 0.1.4. It has been rated as critical. Affected by this issue is the function test_custom_tool of the file introspect/backend/integration_routes.py of the component Test Endpoint. The manipulation of the argument input_model leads to code injection. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-74, CWE-94
References: https://github.com/defog-ai/introspect/issues/496; https://github.com/defog-ai/introspect/issues/496#issue[PII_REDACTED]; https://vuldb.com/?ctiid.309068
CVE: CVE-2025-4768
Published: 2025-05-16
Description: A vulnerability classified as critical has been found in feng_ha_ha/megagao ssm-erp and production_ssm 1.0. This affects the function uploadPicture of the file PictureServiceImpl.java. The manipulation of the argument File leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. This product is distributed under two entirely different names.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-284, CWE-434
References: https://github.com/Hao-Ni/CVE/issues/4; https://vuldb.com/?ctiid.309069; https://vuldb.com/?id.309069
CVE: CVE-2025-40630
Published: 2025-05-16
Description: Open redirection vulnerability in IceWarp Mail Server affecting version 11.4.0. This vulnerability allows an attacker to redirect a user to any domain by sending a malicious URL to the victim, for example “ https://icewarp.domain.com//<MALICIOUS_DOMAIN>/%2e%2e” https://icewarp.domain.com///%2e%2e” . This vulnerability has been tested in Firefox.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-icewarp-mail-server
CVE: CVE-2025-40631
Published: 2025-05-16
Description: HTTP host header injection vulnerability in Icewarp Mail Server affecting version 11.4.0. By modifying the Host header and adding a payload, arbitrary JavaScript code can be executed on page load. The user must interact with a malicious link to be redirected.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-644
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-icewarp-mail-server
CVE: CVE-2025-40632
Published: 2025-05-16
Description: Cross-site scripting (XSS) in Icewarp Mail Server affecting version 11.4.0. This vulnerability allows an attacker to modify the “lastLogin” cookie with malicious JavaScript code that will be executed when the page is rendered.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-icewarp-mail-server
CVE: CVE-2025-4769
Published: 2025-05-16
Description: A vulnerability classified as critical was found in CBEWIN Anytxt Searcher 1.3.1128.0. This vulnerability affects unknown code of the file ATService.exe. The manipulation leads to uncontrolled search path. The attack needs to be approached locally. The complexity of an attack is rather high. The exploitation appears to be difficult.
CVSS Score: 7.0 (HIGH)
CWE: CWE-426, CWE-427
References: https://vuldb.com/?ctiid.309070; https://vuldb.com/?id.309070; https://vuldb.com/?submit.571820
CVE: CVE-2025-4770
Published: 2025-05-16
Description: A vulnerability, which was classified as critical, has been found in PHPGurukul Park Ticketing Management System 2.0. This issue affects some unknown processing of the file /view-normal-ticket.php. The manipulation of the argument viewid leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/f1rstb100d/myCVE/issues/2; https://phpgurukul.com/; https://vuldb.com/?ctiid.309071
CVE: CVE-2025-4771
Published: 2025-05-16
Description: A vulnerability, which was classified as critical, was found in PHPGurukul Online Course Registration 3.1. Affected is an unknown function of the file /admin/course.php. The manipulation of the argument coursecode leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/FLYFISH567/CVE/issues/4; https://phpgurukul.com/; https://vuldb.com/?ctiid.309072
CVE: CVE-2025-4772
Published: 2025-05-16
Description: A vulnerability has been found in PHPGurukul Online Course Registration 3.1 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin/department.php. The manipulation of the argument department leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/FLYFISH567/CVE/issues/5; https://phpgurukul.com/; https://vuldb.com/?ctiid.309073
CVE: CVE-2024-40120
Published: 2025-05-16
Description: seaweedfs v3.68 was discovered to contain a SQL injection vulnerability via the component /abstract_sql/abstract_sql_store.go.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: https://gist.github.com/sud0why/1b2115c1d644bd3db1c1b3f16684a78c; https://github.com/seaweedfs/seaweedfs/issues/5710
CVE: CVE-2025-2305
Published: 2025-05-16
Description: A Path traversal vulnerability in the file
download functionality was identified. This vulnerability allows
unauthenticated users to download arbitrary files, in the context of the
application server, from the Linux server.
CVSS Score: 8.6 (HIGH)
CWE: CWE-20
References: https://www.cirosec.de/sa/sa-2025-003
CVE: CVE-2025-2306
Published: 2025-05-16
Description: An Improper Access Control vulnerability was
identified in the file download functionality. This vulnerability allows users
to download sensitive documents without authentication, if the URL is known.



The attack
requires the attacker to know the documents UUIDv4.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-284
References: https://www.cirosec.de/sa/sa-2025-004
CVE: CVE-2025-37890
Published: 2025-05-16
Description: In the Linux kernel, the following vulnerability has been resolved:

net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc

As described in Gerrard's report [1], we have a UAF case when an hfsc class
has a netem child qdisc. The crux of the issue is that hfsc is assuming
that checking for cl->qdisc->q.qlen == 0 guarantees that it hasn't inserted
the class in the vttree or eltree (which is not true for the netem
duplicate case).

This patch checks the n_active class variable to make sure that the code
won't insert the class in the vttree or eltree twice, catering for the
reentrant case.

[1] https://lore.kernel.org/netdev/CAHcdcOm+03OD2j6R0=YHKqmy=VgJ8xEOKuP6c7mSgnp-TEJJbw@mail.gmail.com/
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://git.kernel.org/stable/c/141d34391abbb315d68556b7c67ad[PII_REDACTED]7; https://git.kernel.org/stable/c/273bbcfa53541cde38b2003ad88a59b770306421; https://git.kernel.org/stable/c/2e7093c7a8aba5d4f8809f271488e5babe75e202
CVE: CVE-2025-40629
Published: 2025-05-16
Description: PNETLab 4.2.10 does not properly sanitize user inputs in its file access mechanisms. This allows attackers to perform directory traversal by manipulating file paths in HTTP requests. Specifically, the application is vulnerable to requests that access sensitive files outside the intended directory.
CWE: CWE-22
References: https://www.incibe.es/en/incibe-cert/notices/aviso/path-traversal-vulnerability-pnetlab
CVE: CVE-2025-40907
Published: 2025-05-16
Description: FCGI versions 0.44 through 0.82, for Perl, include a vulnerable version of the FastCGI fcgi2 (aka fcgi) library.

The included FastCGI library is affected by  CVE-2025-23016, causing an integer overflow (and resultant heap-based buffer overflow) via crafted nameLen or valueLen values in data to the IPC socket. This occurs in ReadParams in fcgiapp.c.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-122, CWE-190, CWE-190
References: http://www.openwall.com/lists/oss-security/2025/04/23/4; https://github.com/FastCGI-Archives/fcgi2/issues/67; https://github.com/FastCGI-Archives/fcgi2/releases/tag/2.4.5
CVE: CVE-2025-4773
Published: 2025-05-16
Description: A vulnerability was found in PHPGurukul Online Course Registration 3.1 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/level.php. The manipulation of the argument level leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/FLYFISH567/CVE/issues/6; https://phpgurukul.com/; https://vuldb.com/?ctiid.309074
CVE: CVE-2025-4777
Published: 2025-05-16
Description: A vulnerability was found in PHPGurukul Park Ticketing Management System 2.0. It has been classified as critical. This affects an unknown part of the file /view-foreigner-ticket.php. The manipulation of the argument viewid leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/f1rstb100d/myCVE/issues/3; https://phpgurukul.com/; https://vuldb.com/?ctiid.309075
CVE: CVE-2025-32962
Published: 2025-05-16
Description: Flask-AppBuilder is an application development framework built on top of Flask. Versions prior to 4.6.2 would allow for a malicious unauthenticated actor to perform an open redirect by manipulating the Host header in HTTP requests. Flask-AppBuilder 4.6.2 introduced the `FAB_SAFE_REDIRECT_HOSTS` configuration variable, which allows administrators to explicitly define which domains are considered safe for redirection. As a workaround, use a reverse proxy to enforce trusted host headers.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-601
References: https://github.com/dpgaspar/Flask-AppBuilder/commit/32eedbbb5cb483a3e782c5f2732de4a6a650d9b6; https://github.com/dpgaspar/Flask-AppBuilder/security/advisories/GHSA-99pm-ch96-ccp2
CVE: CVE-2025-47790
Published: 2025-05-16
Description: Nextcloud Server is a self hosted personal cloud system. Nextcloud Server prior to 29.0.15, 30.0.9, and 31.0.3 and Nextcloud Enterprise Server prior to 26.0.13.15, 27.1.11.15, 28.0.14.6, 29.0.15, 30.0.9, and 31.0.3 have a bug with session handling. The bug caused skipping the second factor confirmation after a successful login with the username and password when the server was configured with `remember_login_cookie_lifetime` set to `0`, once the session expired on the page to select the second factor and the page is reloaded. Nextcloud Server 29.0.15, 30.0.9, and 31.0.3 and Nextcloud Enterprise Server is upgraded to 26.0.13.15, 27.1.11.15, 28.0.14.6, 29.0.15, 30.0.9 and 31.0.3 contain a patch. As a workaround, set the `remember_login_cookie_lifetime` in config.php to a value other than `0`, e.g. `900`. Beware that this is only a workaround for new sessions created after the configuration change. System administration can delete affected sessions.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-287
References: https://github.com/nextcloud/security-advisories/security/advisories/GHSA-9h3w-f3h4-qqrh; https://github.com/nextcloud/server/pull/51905; https://hackerone.com/reports/2729367
CVE: CVE-2025-4211
Published: 2025-05-16
Description: Improper Link Resolution Before File Access ('Link Following') vulnerability in QFileSystemEngine in the Qt corelib module on Windows which potentially allows Symlink Attacks and the use of Malicious Files. Issue originates from CVE-2024-38081. The vulnerability arises from the use of the GetTempPath API, which can be exploited by attackers to manipulate temporary file paths, potentially leading to unauthorized access and privilege escalation. The affected public API in the Qt Framework is QDir::tempPath() and anything that uses it, such as QStandardPaths with TempLocation, QTemporaryDir, and QTemporaryFile.This issue affects all version of Qt up to and including 5.15.18, from 6.0.0 through 6.5.8, from 6.6.0 through 6.8.1. It is fixed in Qt 5.15.19, Qt 6.5.9, Qt 6.8.2, 6.9.0
CWE: CWE-59
References: https://codereview.qt-project.org/c/qt/qtbase/+/632231
CVE: CVE-2025-4600
Published: 2025-05-16
Description: A request smuggling vulnerability existed in the Google Cloud Classic Application Load Balancer due to improper handling of chunked-encoded HTTP requests. This allowed attackers to craft requests that could be misinterpreted by backend servers. The issue was fixed by disallowing stray data after a chunk, and is no longer exploitable. No action is required as Classic Application Load Balancer service after 2025-04-26 is not vulnerable.
CVSS Score: 7.5 (HIGH)
CWE: CWE-444
References: https://cloud.google.com/support/bulletins#gcp-2025-027
CVE: CVE-2025-4778
Published: 2025-05-16
Description: A vulnerability was found in PHPGurukul Park Ticketing Management System 2.0. It has been declared as critical. This vulnerability affects unknown code of the file /normal-search.php. The manipulation of the argument searchdata leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/f1rstb100d/myCVE/issues/4; https://phpgurukul.com/; https://vuldb.com/?ctiid.309076
CVE: CVE-2025-4780
Published: 2025-05-16
Description: A vulnerability was found in PHPGurukul Park Ticketing Management System 2.0. It has been rated as critical. This issue affects some unknown processing of the file /foreigner-search.php. The manipulation of the argument searchdata leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/f1rstb100d/myCVE/issues/5; https://phpgurukul.com/; https://vuldb.com/?ctiid.309077
CVE: CVE-2025-47791
Published: 2025-05-16
Description: Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server prior to 28.0.13, 29.0.10, and 30.0.3 and Nextcloud Enterprise Server prior to 28.0.13, 29.0.10, and 30.0.3, a currently unused endpoint to verify a share recipient was not protected correctly, allowing to proxy requests to another server. The endpoint was removed in Nextcloud Server 28.0.13, 29.0.10, and 30.0.3 and Nextcloud Enterprise Server 28.0.13, 29.0.10, and 30.0.3. No known workarounds are available.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-918
References: https://github.com/nextcloud/security-advisories/security/advisories/GHSA-c7vq-m7f8-rx37; https://github.com/nextcloud/server/pull/49558
CVE: CVE-2025-47792
Published: 2025-05-16
Description: Nextcloud Desktop is the desktop sync client for Nextcloud. In versions of Nextcloud Desktop prior to 3.15, 3rdparty applications already installed on a user machine can create link shares for almost all data via the socket API. These shares can then be easily sent off to an external service. Nextcloud Desktop fixes the issue in version 3.15. No known workarounds are available.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-284, CWE-862
References: https://github.com/nextcloud/desktop/pull/7517; https://github.com/nextcloud/security-advisories/security/advisories/GHSA-qm2f-959g-7p65; https://hackerone.com/reports/1995856
CVE: CVE-2025-47793
Published: 2025-05-16
Description: Nextcloud Server is a self hosted personal cloud system, and the Nextcloud Groupfolders app provides admin-configured folders shared by everyone in a group or team. In Nextcloud Server prior to 30.0.2, 29.0.9, and 28.0.1, Nextcloud Enterprise Server prior to 30.0.2 and 29.0.9, and Nextcloud Groupfolders app prior to 18.0.3, 17.0.5, and 16.0.11, the absence of quota checking on attachments allowed logged-in users to upload files exceeding the group folder quota. Nextcloud Server versions 30.0.2 and 29.0.9, Nextcloud Enterprise Server versions 30.0.2, 29.0.9, or 28.0.12, and Nextcloud Groupfolders app 18.0.3, 17.0.5, and 16.0.11 fix the issue. No known workarounds are available.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-770
References: https://github.com/nextcloud/groupfolders/pull/3328; https://github.com/nextcloud/security-advisories/security/advisories/GHSA-qqgg-hhfq-vhww; https://github.com/nextcloud/server/pull/48623
CVE: CVE-2025-47794
Published: 2025-05-16
Description: Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server prior to 29.0.13, 30.0.7, and 31.0.1 and Nextcloud Enterprise Server prior to 26.0.13.13, 27.1.11.13, 28.0.14.4, 29.0.13, 30.0.7, and 31.0.1, an attacker on a multi-user system may read temporary files from Nextcloud running with a different user account, or run a symlink attack. Nextcloud Server versions 29.0.13, 30.0.7, and 31.0.1 and Nextcloud Enterprise Server 26.0.13.13, 27.1.11.13, 28.0.14.4, 29.0.13, 30.0.7, and 31.0.1 fix the issue. No known workarounds are available.
CVSS Score: 2.6 (LOW)
CWE: CWE-284
References: https://github.com/nextcloud/security-advisories/security/advisories/GHSA-q568-2933-gcjq; https://github.com/nextcloud/server/pull/51194; https://hackerone.com/reports/1960647
CVE: CVE-2025-47916
Published: 2025-05-16
Description: Invision Community 5.0.0 before 5.0.7 allows remote code execution via crafted template strings to themeeditor.php. The issue lies within the themeeditor controller (file: /applications/core/modules/front/system/themeeditor.php), where a protected method named customCss can be invoked by unauthenticated users. This method passes the value of the content parameter to the Theme::makeProcessFunction() method; hence it is evaluated by the template engine. Accordingly, this can be exploited by unauthenticated attackers to inject and execute arbitrary PHP code by providing crafted template strings.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-1336, CWE-94
References: https://invisioncommunity.com/release-notes-v5/507-r41/; https://karmainsecurity.com/KIS-2025-02; http://seclists.org/fulldisclosure/2025/May/4
CVE: CVE-2025-4478
Published: 2025-05-16
Description: A flaw was found in the FreeRDP used by Anaconda's remote install feature, where a crafted RDP packet could trigger a segmentation fault. This issue causes the service to crash and remain defunct, resulting in a denial of service. It occurs pre-boot and is likely due to a NULL pointer dereference. Rebooting is required to recover the system.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476
References: https://access.redhat.com/errata/RHSA-2025:9307; https://access.redhat.com/security/cve/CVE-2025-4478; https://bugzilla.redhat.com/show_bug.cgi?id=2365232
CVE: CVE-2025-4781
Published: 2025-05-16
Description: A vulnerability classified as critical has been found in PHPGurukul Park Ticketing Management System 2.0. Affected is an unknown function of the file /forgot-password.php. The manipulation of the argument email/contactno leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/f1rstb100d/myCVE/issues/6; https://phpgurukul.com/; https://vuldb.com/?ctiid.309078
CVE: CVE-2025-4782
Published: 2025-05-16
Description: A vulnerability has been found in SourceCodester/oretnom23 Stock Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file /sms/admin/?page=receiving/view_receiving&id=1. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/th3w0lf-1337/Vulnerabilities/blob/main/SMS-PHP/SQLi/Receiving/info.md; https://vuldb.com/?ctiid.309082; https://vuldb.com/?id.309082
CVE: CVE-2025-4785
Published: 2025-05-16
Description: A vulnerability was found in PHPGurukul Daily Expense Tracker System 1.1. It has been rated as critical. Affected by this issue is some unknown functionality of the file /user-profile.php. The manipulation of the argument fullname/contactnumber leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/f1rstb100d/myCVE/issues/10; https://github.com/f1rstb100d/myCVE/issues/9; https://phpgurukul.com/
CVE: CVE-2025-31062
Published: 2025-05-16
Description: Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in redqteam Wishlist wishlist allows Retrieve Embedded Sensitive Data.This issue affects Wishlist: from n/a through <= 2.1.0.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-497
References: https://patchstack.com/database/Wordpress/Plugin/wishlist/vulnerability/wordpress-wishlist-2-1-0-sensitive-data-exposure-vulnerability?_s_id=cve
CVE: CVE-2025-31063
Published: 2025-05-16
Description: Missing Authorization vulnerability in redqteam Wishlist wishlist allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Wishlist: from n/a through <= 2.1.0.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/wishlist/vulnerability/wordpress-wishlist-2-1-0-broken-access-control-vulnerability?_s_id=cve