deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-1599
Published: 2025-02-24
Description: A vulnerability was found in SourceCodester Best Church Management Software 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /admin/app/profile_crud.php. The manipulation of the argument old_cat_img leads to path traversal: '../filedir'. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-23, CWE-24, CWE-22
References: https://github.com/xiahao90/CVEproject/blob/main/xiahao.webray.com.cn/best-church-management-software-Delete-any-file.md; https://vuldb.com/?ctiid.296594; https://vuldb.com/?id.296594
CVE: CVE-2025-1606
Published: 2025-02-24
Description: A vulnerability classified as problematic was found in SourceCodester Best Employee Management System 1.0. This vulnerability affects unknown code of the file /admin/backup/backups.php. The manipulation leads to information disclosure. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200, CWE-284
References: https://github.com/xiahao90/CVEproject/blob/main/xiahao.webray.com.cn/Best-employee-management-system-information-leakage.md; https://vuldb.com/?ctiid.296596; https://vuldb.com/?id.296596
CVE: CVE-2025-1607
Published: 2025-02-24
Description: A vulnerability, which was classified as problematic, has been found in SourceCodester Best Employee Management System 1.0. This issue affects some unknown processing of the file /admin/salary_slip.php. The manipulation of the argument id leads to authorization bypass. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-285, CWE-639, CWE-639
References: https://github.com/xiahao90/CVEproject/blob/main/xiahao.webray.com.cn/Best-employee-management-system-unauthorized-access.md; https://vuldb.com/?ctiid.296597; https://vuldb.com/?id.296597
CVE: CVE-2025-1608
Published: 2025-02-24
Description: A vulnerability, which was classified as critical, was found in LB-LINK AC1900 Router 1.0.2. Affected is the function websGetVar of the file /goform/set_manpwd. The manipulation of the argument routepwd  leads to os command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-77, CWE-78, CWE-78
References: https://noisy-caravel-a9a.notion.site/LBLINK_AC1900_V1-0-2_-set_manpwd-_-bl_do_system-_CI-179898c94eac81b9bf56c1f64db77e2d?pvs=74; https://vuldb.com/?ctiid.296598; https://vuldb.com/?id.296598
CVE: CVE-2024-55898
Published: 2025-02-24
Description: IBM i 7.2, 7.3, 7.4, and 7.5 could allow a user with the capability to compile or restore a program to gain elevated privileges due to an unqualified library call. A malicious actor could cause user-controlled code to run with administrator privilege.
CVSS Score: 8.5 (HIGH)
CWE: CWE-427
References: https://www.ibm.com/support/pages/node/7183835
CVE: CVE-2025-1609
Published: 2025-02-24
Description: A vulnerability has been found in LB-LINK AC1900 Router 1.0.2 and classified as critical. Affected by this vulnerability is the function websGetVar of the file /goform/set_cmd. The manipulation of the argument cmd leads to os command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-77, CWE-78, CWE-78
References: https://noisy-caravel-a9a.notion.site/LBLINK_AC1900_V1-0-2_-set_cmd-_-bs_SetCmd-_CI-179898c94eac808e8875e0b8e1bee47e?pvs=74; https://vuldb.com/?ctiid.296599; https://vuldb.com/?id.296599
CVE: CVE-2025-1610
Published: 2025-02-24
Description: A vulnerability was found in LB-LINK AC1900 Router 1.0.2 and classified as critical. Affected by this issue is the function websGetVar of the file /goform/set_blacklist. The manipulation of the argument mac/enable leads to os command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-77, CWE-78, CWE-78
References: https://noisy-caravel-a9a.notion.site/LBLINK_AC1900_V1-0-2_-set_blacklist-_-bs_SetMacBlack-_CI-179898c94eac802b9451fcb79aa668c3?pvs=74; https://vuldb.com/?ctiid.296600; https://vuldb.com/?id.296600
CVE: CVE-2025-1611
Published: 2025-02-24
Description: A vulnerability was found in ShopXO up to 6.4.0. It has been classified as problematic. This affects an unknown part of the file app/service/ThemeAdminService.php of the component Template Handler. The manipulation leads to injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-74, CWE-707
References: https://github.com/jmx0hxq/Vulnerability-learning/blob/main/shopxo-rce.md; https://vuldb.com/?ctiid.296601; https://vuldb.com/?id.296601
CVE: CVE-2025-1612
Published: 2025-02-24
Description: A vulnerability was found in Edimax BR-6288ACL 1.30. It has been declared as problematic. This vulnerability affects unknown code of the file wireless5g_basic.asp. The manipulation of the argument SSID leads to cross site scripting. The attack can be initiated remotely. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94, CWE-79
References: https://vuldb.com/?ctiid.296602; https://vuldb.com/?id.296602; https://vuldb.com/?submit.501309
CVE: CVE-2025-1613
Published: 2025-02-24
Description: A vulnerability was found in FiberHome AN5506-01A ONU GPON RP2511. It has been rated as problematic. This issue affects some unknown processing of the file /goform/URL_filterCfg of the component URL Filtering Submenu. The manipulation of the argument url_IP leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 2.4 (LOW)
CWE: CWE-79, CWE-94, CWE-79
References: https://vuldb.com/?ctiid.296603; https://vuldb.com/?id.296603; https://vuldb.com/?submit.501349
CVE: CVE-2025-1614
Published: 2025-02-24
Description: A vulnerability classified as problematic has been found in FiberHome AN5506-01A ONU GPON RP2511. Affected is an unknown function of the file /goform/portForwardingCfg of the component Port Forwarding Submenu. The manipulation of the argument pf_Description leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 2.4 (LOW)
CWE: CWE-79, CWE-94, CWE-79
References: https://vuldb.com/?ctiid.296604; https://vuldb.com/?id.296604; https://vuldb.com/?submit.501365
CVE: CVE-2025-1615
Published: 2025-02-24
Description: A vulnerability classified as problematic was found in FiberHome AN5506-01A ONU GPON RP2511. Affected by this vulnerability is an unknown functionality of the component NAT Submenu. The manipulation of the argument Description leads to cross site scripting. The attack can be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 2.4 (LOW)
CWE: CWE-79, CWE-94, CWE-79
References: https://vuldb.com/?ctiid.296605; https://vuldb.com/?id.296605; https://vuldb.com/?submit.501408
CVE: CVE-2025-1616
Published: 2025-02-24
Description: A vulnerability, which was classified as critical, has been found in FiberHome AN5506-01A ONU GPON RP2511. Affected by this issue is some unknown functionality of the component Diagnosis. The manipulation of the argument Destination Address leads to os command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-77, CWE-78, CWE-78
References: https://vuldb.com/?ctiid.296606; https://vuldb.com/?id.296606; https://vuldb.com/?submit.501483
CVE: CVE-2025-1617
Published: 2025-02-24
Description: A vulnerability, which was classified as problematic, was found in Netis WF2780 2.1.41925. This affects an unknown part of the component Wireless 2.4G Menu. The manipulation of the argument SSID leads to cross site scripting. It is possible to initiate the attack remotely. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 2.4 (LOW)
CWE: CWE-79, CWE-94
References: https://vuldb.com/?ctiid.296607; https://vuldb.com/?id.296607; https://vuldb.com/?submit.501472
CVE: CVE-2025-1618
Published: 2025-02-24
Description: A vulnerability has been found in vTiger CRM 6.4.0/6.5.0 and classified as problematic. This vulnerability affects unknown code of the file /modules/Mobile/index.php. The manipulation of the argument _operation leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 7.0 is able to address this issue. It is recommended to upgrade the affected component.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79, CWE-94, CWE-79
References: https://vuldb.com/?ctiid.296608; https://vuldb.com/?id.296608; https://vuldb.com/?submit.501840
CVE: CVE-2025-1629
Published: 2025-02-24
Description: A vulnerability was found in Excitel Broadband Private my Excitel App 3.13.0 on Android. It has been classified as problematic. Affected is an unknown function of the component One-Time Password Handler. The manipulation leads to improper restriction of excessive authentication attempts. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 3.5 (LOW)
CWE: CWE-307, CWE-799
References: https://vuldb.com/?ctiid.296610; https://vuldb.com/?id.296610; https://vuldb.com/?submit.501868
CVE: CVE-2024-12308
Published: 2025-02-24
Description: The Logo Slider  WordPress plugin before 4.6.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/fa82ada7-357b-4f01-a0d6-ff633b188a80/
CVE: CVE-2024-13605
Published: 2025-02-24
Description: The Form Maker by 10Web  WordPress plugin before 1.15.33 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/d5543b3b-1c28-481b-aba4-9a07d160e1f2/
CVE: CVE-2024-13822
Published: 2025-02-24
Description: The Photo Contest  | Competition | Video Contest WordPress plugin through 2.8.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/1f0f1553-1987-428c-9fe3-ffb3f6b0aecc/
CVE: CVE-2025-0690
Published: 2025-02-24
Description: The read command is used to read the keyboard input from the user, while reads it keeps the input length in a 32-bit integer value which is further used to reallocate the line buffer to accept the next character. During this process, with a line big enough it's possible to make this variable to overflow leading to a out-of-bounds write in the heap based buffer. This flaw may be leveraged to corrupt grub's internal critical data and secure boot bypass is not discarded as consequence.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-787
References: https://access.redhat.com/errata/RHSA-2025:6990; https://access.redhat.com/security/cve/CVE-2025-0690; https://bugzilla.redhat.com/show_bug.cgi?id=2346123
CVE: CVE-2025-1412
Published: 2025-02-24
Description: Mattermost versions 9.11.x <= 9.11.6, 10.4.x <= 10.4.1 fail to invalidate all active sessions when converting a user to a bot, with allows the converted user to escalate their privileges depending on the permissions granted to the bot.
CVSS Score: 3.1 (LOW)
CWE: CWE-384
References: https://mattermost.com/security-updates
CVE: CVE-2025-20051
Published: 2025-02-24
Description: Mattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to properly validate input when patching and duplicating a board, which allows a user to read any arbitrary file on the system via duplicating a specially crafted block in Boards.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-22
References: https://mattermost.com/security-updates
CVE: CVE-2025-24490
Published: 2025-02-24
Description: Mattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to use prepared statements in the SQL query of boards reordering which allows an attacker to retrieve data from the database, via a SQL injection when reordering specially crafted boards categories.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-89
References: https://mattermost.com/security-updates
CVE: CVE-2025-24526
Published: 2025-02-24
Description: Mattermost versions 10.1.x <= 10.1.3, 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to restrict channel export of archived channels when the "Allow users to view archived channels" is disabled which allows a user to export channel contents when they shouldn't have access to it
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-863
References: https://mattermost.com/security-updates
CVE: CVE-2025-25279
Published: 2025-02-24
Description: Mattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to properly validate board blocks when importing boards which allows an attacker could read any arbitrary file on the system via importing and exporting a specially crafted import archive in Boards.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-22
References: https://mattermost.com/security-updates
CVE: CVE-2023-52926
Published: 2025-02-24
Description: In the Linux kernel, the following vulnerability has been resolved:

IORING_OP_READ did not correctly consume the provided buffer list when
read i/o returned < 0 (except for -EAGAIN and -EIOCBQUEUED return).
This can lead to a potential use-after-free when the completion via
io_rw_done runs at separate context.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://git.kernel.org/stable/c/6c27fc6a783c8a77c756dd5461b15e465020d075; https://git.kernel.org/stable/c/72060434a14caea20925e492310d6e680e3f9007; https://git.kernel.org/stable/c/a08d195b586a217d76b42062f88f375a3eedda4d
CVE: CVE-2025-1488
Published: 2025-02-24
Description: The WPO365 | MICROSOFT 365 GRAPH MAILER plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 3.2. This is due to insufficient validation on the redirect url supplied via the 'redirect_to' parameter. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites if 1. they can successfully trick them into performing an action and 2. the plugin is activated but not configured.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-601, CWE-601
References: https://plugins.trac.wordpress.org/changeset/3244747/; https://wordpress.org/plugins/wpo365-msgraphmailer/#developers; https://www.wordfence.com/threat-intel/vulnerabilities/id/3a1782c3-ae0b-42f1-aa5e-dabfa2a5bbcd?source=cve
CVE: CVE-2024-5174
Published: 2025-02-24
Description: A flaw in Gliffy results in broken authentication through the reset functionality of the application.
CWE: CWE-287
References: https://portal.perforce.com/s/detail/a91PA000001ScD3YAK
CVE: CVE-2025-0545
Published: 2025-02-24
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Tekrom Technology T-Soft E-Commerce allows Cross-Site Scripting (XSS).This issue affects T-Soft E-Commerce: before v5.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-79
References: https://www.usom.gov.tr/bildirim/tr-25-0041
CVE: CVE-2025-1632
Published: 2025-02-24
Description: A vulnerability was found in libarchive up to 3.7.7. It has been classified as problematic. This affects the function list of the file bsdunzip.c. The manipulation leads to null pointer dereference. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 3.3 (LOW)
CWE: CWE-404, CWE-476, CWE-476
References: https://github.com/Ekkosun/pocs/blob/main/bsdunzip-poc; https://vuldb.com/?ctiid.296619; https://vuldb.com/?id.296619
CVE: CVE-2024-12916
Published: 2025-02-24
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Agito Computer Life4All allows SQL Injection.This issue affects Life4All: before 10.01.2025.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://www.usom.gov.tr/bildirim/tr-25-0042
CVE: CVE-2024-12917
Published: 2025-02-24
Description: Files or Directories Accessible to External Parties vulnerability in Agito Computer Health4All allows Exploiting Incorrectly Configured Access Control Security Levels, Authentication Abuse.This issue affects Health4All: before 10.01.2025.
CVSS Score: 8.3 (HIGH)
CWE: CWE-552
References: https://www.usom.gov.tr/bildirim/tr-25-0042
CVE: CVE-2024-12918
Published: 2025-02-24
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Agito Computer Health4All allows SQL Injection.This issue affects Health4All: before 10.01.2025.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://www.usom.gov.tr/bildirim/tr-25-0042
CVE: CVE-2025-23017
Published: 2025-02-24
Description: WorkOS Hosted AuthKit before 2025-01-07 allows a password authentication MFA bypass (by enrolling a new authentication factor) when the attacker knows the user's password. No exploitation occurred.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-305
References: https://workos.com/security/advisories; https://www.authkit.com
CVE: CVE-2025-26883
Published: 2025-02-24
Description: Missing Authorization vulnerability in bPlugins Animated Text Block animated-text-block allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Animated Text Block: from n/a through <= 1.0.7.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/animated-text-block/vulnerability/wordpress-animated-text-block-plugin-1-0-7-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-27265
Published: 2025-02-24
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Aaron D. Campbell Google Maps for WordPress google-maps-for-wordpress allows DOM-Based XSS.This issue affects Google Maps for WordPress: from n/a through <= 1.0.3.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/google-maps-for-wordpress/vulnerability/wordpress-google-maps-for-wordpress-plugin-1-0-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-27266
Published: 2025-02-24
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ignacio Perez Hover Image Button hover-image-button allows DOM-Based XSS.This issue affects Hover Image Button: from n/a through <= 1.1.2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/hover-image-button/vulnerability/wordpress-hover-image-button-plugin-1-1-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-27272
Published: 2025-02-24
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in vinagecko VG PostCarousel vg-postcarousel allows PHP Local File Inclusion.This issue affects VG PostCarousel: from n/a through <= 1.1.
CVSS Score: 7.5 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Plugin/vg-postcarousel/vulnerability/wordpress-vg-postcarousel-plugin-1-1-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-27276
Published: 2025-02-24
Description: Cross-Site Request Forgery (CSRF) vulnerability in lizeipe Photo Gallery ( Responsive ) photo-gallery-pearlbells allows Privilege Escalation.This issue affects Photo Gallery ( Responsive ): from n/a through <= 4.0.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/photo-gallery-pearlbells/vulnerability/wordpress-photo-gallery-responsive-plugin-4-0-csrf-to-privilege-escalation-vulnerability?_s_id=cve
CVE: CVE-2025-27277
Published: 2025-02-24
Description: Cross-Site Request Forgery (CSRF) vulnerability in tiefpunkt Add Linked Images To Gallery add-linked-images-to-gallery-v01 allows Cross Site Request Forgery.This issue affects Add Linked Images To Gallery: from n/a through <= 1.4.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/add-linked-images-to-gallery-v01/vulnerability/wordpress-add-linked-images-to-gallery-plugin-1-4-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE: CVE-2025-27280
Published: 2025-02-24
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Alobaidi Archive Page archive-page allows DOM-Based XSS.This issue affects Archive Page: from n/a through <= 1.0.2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/archive-page/vulnerability/wordpress-archive-page-plugin-1-0-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-27290
Published: 2025-02-24
Description: Cross-Site Request Forgery (CSRF) vulnerability in seyyed-amir Erima Zarinpal Donate erima-zarinpal-donate allows Cross Site Request Forgery.This issue affects Erima Zarinpal Donate: from n/a through <= 1.0.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/erima-zarinpal-donate/vulnerability/wordpress-select-erima-zarinpal-donate-plugin-1-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-27294
Published: 2025-02-24
Description: Missing Authorization vulnerability in platcom WP-Asambleas wp-asambleas allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP-Asambleas: from n/a through <= 2.85.0.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/wp-asambleas/vulnerability/wordpress-wp-asambleas-plugin-2-85-0-arbitrary-shortcode-execution-vulnerability?_s_id=cve
CVE: CVE-2025-27296
Published: 2025-02-24
Description: Missing Authorization vulnerability in revenueflex Auto Ad Inserter – Increase Google Adsense and Ad Manager Revenue revenueflex-easy-ads allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Auto Ad Inserter – Increase Google Adsense and Ad Manager Revenue: from n/a through <= 1.5.
CVSS Score: 7.2 (HIGH)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/revenueflex-easy-ads/vulnerability/wordpress-auto-ad-inserter-increase-google-adsense-and-ad-manager-revenue-plugin-1-5-settings-change-vulnerability?_s_id=cve