deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-22282
Published: 2025-04-04
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in keksdieb ez Form Calculator Premium ez-form-calculator-premium allows Reflected XSS.This issue affects ez Form Calculator Premium: from n/a through <= 2.14.1.2.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/ez-form-calculator-premium/vulnerability/wordpress-ez-form-calculator-wordpress-plugin-plugin-2-14-1-2-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-3239
Published: 2025-04-04
Description: A vulnerability classified as critical was found in PHPGurukul Online Fire Reporting System 1.2. Affected by this vulnerability is an unknown functionality of the file /admin/edit-guard-detail.php. The manipulation of the argument editid leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/JunGu-W/cve/issues/4; https://phpgurukul.com/; https://vuldb.com/?ctiid.303265
CVE: CVE-2025-3240
Published: 2025-04-04
Description: A vulnerability, which was classified as critical, has been found in PHPGurukul Online Fire Reporting System 1.2. Affected by this issue is some unknown functionality of the file /admin/search.php. The manipulation of the argument searchdata leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/JunGu-W/cve/issues/5; https://phpgurukul.com/; https://vuldb.com/?ctiid.303266
CVE: CVE-2025-3241
Published: 2025-04-04
Description: A vulnerability, which was classified as problematic, was found in zhangyanbo2007 youkefu up to 4.2.0. This affects an unknown part of the file src/main/java/com/ukefu/webim/web/handler/admin/callcenter/CallCenterRouterController.java of the component XML Document Handler. The manipulation of the argument routercontent leads to xml external entity reference. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-610, CWE-611, CWE-611
References: https://github.com/askqiu/cve/blob/main/README.md; https://vuldb.com/?ctiid.303267; https://vuldb.com/?id.303267
CVE: CVE-2025-3242
Published: 2025-04-04
Description: A vulnerability has been found in PHPGurukul e-Diary Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file /search-result.php. The manipulation of the argument id/searchdata leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/lkncdy/cve/issues/1; https://phpgurukul.com/; https://vuldb.com/?ctiid.303268
CVE: CVE-2025-3243
Published: 2025-04-04
Description: A vulnerability was found in code-projects Patient Record Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /dental_form.php. The manipulation of the argument itr_no/dental_no leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/BinBall/cve/blob/master/README.md; https://vuldb.com/?ctiid.303269
CVE: CVE-2025-3244
Published: 2025-04-04
Description: A vulnerability was found in SourceCodester Web-based Pharmacy Product Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /add-admin.php of the component Create User Page. The manipulation of the argument Avatar leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-284, CWE-434, CWE-434
References: https://github.com/6s6-630/CVE/blob/main/yaofang.md; https://vuldb.com/?ctiid.303271; https://vuldb.com/?id.303271
CVE: CVE-2025-3245
Published: 2025-04-04
Description: A vulnerability was found in itsourcecode Library Management System 1.0. It has been rated as critical. Affected by this issue is the function Search of the file library_management/src/Library_Management/Forgot.java. The manipulation of the argument txtuname leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/wlingze/IRify_scan/issues/1; https://itsourcecode.com/; https://vuldb.com/?ctiid.303272
CVE: CVE-2025-31420
Published: 2025-04-04
Description: Incorrect Privilege Assignment vulnerability in Tomdever wpForo Forum wpforo allows Privilege Escalation.This issue affects wpForo Forum: from n/a through <= 2.4.2.
CVSS Score: 7.6 (HIGH)
CWE: CWE-266
References: https://patchstack.com/database/Wordpress/Plugin/wpforo/vulnerability/wordpress-wpforo-forum-plugin-2-4-2-privilege-escalation-vulnerability?_s_id=cve
CVE: CVE-2025-31421
Published: 2025-04-04
Description: Insertion of Sensitive Information into Externally-Accessible File or Directory vulnerability in Oblak Studio Srbtranslatin srbtranslatin allows Retrieve Embedded Sensitive Data.This issue affects Srbtranslatin: from n/a through <= 3.2.0.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-538
References: https://patchstack.com/database/Wordpress/Plugin/srbtranslatin/vulnerability/wordpress-srbtranslatin-plugin-3-2-0-sensitive-data-exposure-vulnerability?_s_id=cve
CVE: CVE-2025-3189
Published: 2025-04-04
Description: Stored Cross-Site Scripting (XSS) in DoWISP in versions prior to 1.16.2.50, which consists of an stored XSS through the upload of a profile picture in SVG format with malicious Javascript code in it.
CWE: CWE-78
References: https://www.incibe.es/en/incibe-cert/notices/aviso/stored-cross-site-scripting-xss-dowisp
CVE: CVE-2024-51800
Published: 2025-04-04
Description: Incorrect Privilege Assignment vulnerability in Favethemes Homey allows Privilege Escalation.This issue affects Homey: from n/a through 2.4.1.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-266
References: https://patchstack.com/database/wordpress/theme/homey/vulnerability/wordpress-homey-theme-2-4-1-privilege-escalation-vulnerability?_s_id=cve
CVE: CVE-2025-22281
Published: 2025-04-04
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in joshix Simplish simplish allows Stored XSS.This issue affects Simplish: from n/a through <= 2.6.4.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Theme/simplish/vulnerability/wordpress-simplish-theme-2-6-4-stored-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-22285
Published: 2025-04-04
Description: Missing Authorization vulnerability in enituretechnology Pallet Packaging for WooCommerce pallet-packaging-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Pallet Packaging for WooCommerce: from n/a through <= 1.1.15.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/pallet-packaging-for-woocommerce/vulnerability/wordpress-pallet-packaging-for-woocommerce-plugin-1-1-15-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-28146
Published: 2025-04-04
Description: Edimax AC1200 Wave 2 Dual-Band Gigabit Router BR-6478AC V3 1.0.15 was discovered to contain a command injection vulnerability via fota_url in /boafrm/formLtefotaUpgradeQuectel
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://gist.github.com/regainer27/469a6f2b694a76c3b58249b27fdd0881; https://github.com/regainer27/edimax-br-6478ac_v3-br-6478ac_v3_1.0.15/tree/main/3
CVE: CVE-2025-2798
Published: 2025-04-04
Description: The Woffice CRM theme for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.4.21. This is due to a misconfiguration of excluded roles during registration. This makes it possible for unauthenticated attackers to register with an Administrator role if a custom login form is being used. This can be combined with CVE-2025-2797 to bypass the user approval process if an Administrator can be tricked into taking an action such as clicking a link.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-269
References: https://hub.woffice.io/woffice/changelog#april-1st-2025-version-5422; https://www.wordfence.com/threat-intel/vulnerabilities/id/6dd6169b-bc94-4642-8975-2e96bc01576f?source=cve
CVE: CVE-2025-31381
Published: 2025-04-04
Description: Missing Authorization vulnerability in shiptrack Booking Calendar and Notification booking-calendar-and-notification allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booking Calendar and Notification: from n/a through <= 4.0.3.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/booking-calendar-and-notification/vulnerability/wordpress-booking-calendar-and-notification-plugin-4-0-3-broken-authentication-vulnerability?_s_id=cve
CVE: CVE-2025-31384
Published: 2025-04-04
Description: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Aviplugins Videos allows Reflected XSS.This issue affects Videos: from n/a through 1.0.5.
CVSS Score: 7.1 (HIGH)
CWE: CWE-80
References: https://patchstack.com/database/wordpress/plugin/videos/vulnerability/wordpress-videos-plugin-1-0-5-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-31389
Published: 2025-04-04
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Introvoke Inc. dba Sequel.io Sequel sequel allows Reflected XSS.This issue affects Sequel: from n/a through <= 1.0.11.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/sequel/vulnerability/wordpress-sequel-plugin-1-0-11-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-31403
Published: 2025-04-04
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in shiptrack Booking Calendar and Notification booking-calendar-and-notification allows Blind SQL Injection.This issue affects Booking Calendar and Notification: from n/a through <= 4.0.3.
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/booking-calendar-and-notification/vulnerability/wordpress-booking-calendar-and-notification-plugin-4-0-3-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-31405
Published: 2025-04-04
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in zankover Fami WooCommerce Compare fami-woocommerce-compare allows PHP Local File Inclusion.This issue affects Fami WooCommerce Compare: from n/a through <= 1.0.5.
CVSS Score: 7.5 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Plugin/fami-woocommerce-compare/vulnerability/wordpress-fami-woocommerce-compare-plugin-1-0-5-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-31407
Published: 2025-04-04
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hutsixdigital Tiger allows Stored XSS.This issue affects Tiger: from n/a through 2.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/wordpress/theme/tiger/vulnerability/wordpress-tiger-theme-2-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-31416
Published: 2025-04-04
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AwesomeTOGI Awesome Event Booking awesome-event-booking allows Reflected XSS.This issue affects Awesome Event Booking: from n/a through <= 2.8.4.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/awesome-event-booking/vulnerability/wordpress-awesome-event-booking-plugin-2-8-4-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-31418
Published: 2025-04-04
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in noonnoo Gravel allows Reflected XSS.This issue affects Gravel: from n/a through 1.6.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/wordpress/theme/gravel/vulnerability/wordpress-gravel-theme-1-6-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-3249
Published: 2025-04-04
Description: A vulnerability classified as critical was found in TOTOLINK A6000R 1.0.1-B20[PII_REDACTED]. Affected by this vulnerability is the function apcli_cancel_wps of the file /usr/lib/lua/luci/controller/mtkwifi.lua. The manipulation leads to command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-77
References: https://github.com/fjl1113/cve/blob/main/totolink.md; https://vuldb.com/?ctiid.303319; https://vuldb.com/?id.303319
CVE: CVE-2025-27520
Published: 2025-04-04
Description: BentoML is a Python library for building online serving systems optimized for AI apps and model inference. A Remote Code Execution (RCE) vulnerability caused by insecure deserialization has been identified in the latest version (v1.4.2) of BentoML. It allows any unauthenticated user to execute arbitrary code on the server. It exists an unsafe code segment in serde.py. This vulnerability is fixed in 1.4.3.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://github.com/bentoml/BentoML/commit/b35f4f4fcc53a8c3fe8ed9c18a013fe0a728e194; https://github.com/bentoml/BentoML/security/advisories/GHSA-33xw-247w-6hmc; https://github.com/bentoml/BentoML/security/advisories/GHSA-33xw-247w-6hmc
CVE: CVE-2025-31130
Published: 2025-04-04
Description: gitoxide is an implementation of git written in Rust. Before 0.42.0, gitoxide uses SHA-1 hash implementations without any collision detection, leaving it vulnerable to hash collision attacks. gitoxide uses the sha1_smol or sha1 crate, both of which implement standard SHA-1 without any mitigations for collision attacks. This means that two distinct Git objects with colliding SHA-1 hashes would break the Git object model and integrity checks when used with gitoxide. This vulnerability is fixed in 0.42.0.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-328
References: https://github.com/GitoxideLabs/gitoxide/commit/f253f02a6658b3b7612a50d56c71f5ae4da4ca21; https://github.com/GitoxideLabs/gitoxide/security/advisories/GHSA-2frx-2596-x5r6; https://github.com/GitoxideLabs/gitoxide/security/advisories/GHSA-2frx-2596-x5r6
CVE: CVE-2025-31480
Published: 2025-04-04
Description: aiven-extras is a PostgreSQL extension. This is a privilege escalation vulnerability, allowing elevation to superuser inside PostgreSQL databases that use the aiven-extras package. The vulnerability leverages the format function not being schema-prefixed. Affected users should install 1.1.16 and ensure they run the latest version issuing ALTER EXTENSION aiven_extras UPDATE TO '1.1.16' after installing it. This needs to happen in each database aiven_extras has been installed in.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-426
References: https://github.com/aiven/aiven-extras/commit/77b5f19a0c1d196bc741ff5c774f85fe7ca3063b; https://github.com/aiven/aiven-extras/security/advisories/GHSA-33xh-jqgf-6627
CVE: CVE-2025-3250
Published: 2025-04-04
Description: A vulnerability, which was classified as problematic, has been found in elunez eladmin 2.7. Affected by this issue is some unknown functionality of the file /api/database/testConnect of the component Maintenance Management Module. The manipulation leads to deserialization. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20, CWE-502, CWE-502
References: https://vuldb.com/?ctiid.303320; https://vuldb.com/?id.303320; https://vuldb.com/?submit.546132
CVE: CVE-2025-3251
Published: 2025-04-04
Description: A vulnerability, which was classified as problematic, was found in xujiangfei admintwo 1.0. This affects an unknown part of the file /user/updateSet. The manipulation of the argument motto leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94, CWE-79
References: https://github.com/caigo8/CVE-md/blob/main/admintwo/XSS1.md; https://vuldb.com/?ctiid.303321; https://vuldb.com/?id.303321
CVE: CVE-2025-0468
Published: 2025-04-04
Description: Software installed and run as a non-privileged user may conduct improper GPU system calls to subvert GPU HW to write to arbitrary physical memory pages.

Under certain circumstances this exploit could be used to corrupt data pages not allocated by the GPU driver but memory pages in use by the kernel and drivers running on the platform altering their behaviour.
CVSS Score: 7.1 (HIGH)
CWE: CWE-280
References: https://www.imaginationtech.com/gpu-driver-vulnerabilities/
CVE: CVE-2025-25178
Published: 2025-04-04
Description: Software installed and run as a non-privileged user may conduct improper GPU system calls to cause kernel system memory corruption.
CVSS Score: 7.8 (HIGH)
CWE: CWE-1284
References: https://www.imaginationtech.com/gpu-driver-vulnerabilities/
CVE: CVE-2025-32112
Published: 2025-04-04
Description: Cross-Site Request Forgery (CSRF) vulnerability in OTWthemes Sidebar Manager Light sidebar-manager-light allows Cross Site Request Forgery.This issue affects Sidebar Manager Light: from n/a through <= 1.18.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/sidebar-manager-light/vulnerability/wordpress-sidebar-manager-light-plugin-1-1-8-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE: CVE-2025-32113
Published: 2025-04-04
Description: Cross-Site Request Forgery (CSRF) vulnerability in Renzo Tejada Libro de Reclamaciones y Quejas libro-de-reclamaciones-y-quejas allows Cross Site Request Forgery.This issue affects Libro de Reclamaciones y Quejas: from n/a through <= 1.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/libro-de-reclamaciones-y-quejas/vulnerability/wordpress-libro-de-reclamaciones-y-quejas-plugin-0-9-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE: CVE-2025-32118
Published: 2025-04-04
Description: Unrestricted Upload of File with Dangerous Type vulnerability in NiteoThemes CMP – Coming Soon & Maintenance cmp-coming-soon-maintenance allows Using Malicious Files.This issue affects CMP – Coming Soon & Maintenance: from n/a through <= 4.1.14.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-434
References: https://patchstack.com/database/Wordpress/Plugin/cmp-coming-soon-maintenance/vulnerability/wordpress-cmp-coming-soon-maintenance-plugin-4-1-13-remote-code-execution-rce-vulnerability?_s_id=cve
CVE: CVE-2025-32120
Published: 2025-04-04
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in edanzer Easy Query – WP Query Builder easy-query allows Blind SQL Injection.This issue affects Easy Query – WP Query Builder: from n/a through <= 2.0.4.
CVSS Score: 7.6 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/easy-query/vulnerability/wordpress-easy-query-wp-query-builder-2-0-4-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-32121
Published: 2025-04-04
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in SuitePlugins Video & Photo Gallery for Ultimate Member gallery-for-ultimate-member allows SQL Injection.This issue affects Video & Photo Gallery for Ultimate Member: from n/a through <= 1.1.3.
CVSS Score: 7.6 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/gallery-for-ultimate-member/vulnerability/wordpress-video-photo-gallery-for-ultimate-member-plugin-1-1-3-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-32122
Published: 2025-04-04
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Stylemix uListing ulisting allows Blind SQL Injection.This issue affects uListing: from n/a through <= 2.2.0.
CVSS Score: 7.6 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/ulisting/vulnerability/wordpress-ulisting-plugin-2-1-9-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-32124
Published: 2025-04-04
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in eleopard Behance Portfolio Manager portfolio-manager-powered-by-behance allows Blind SQL Injection.This issue affects Behance Portfolio Manager: from n/a through <= 1.7.5.
CVSS Score: 7.6 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/portfolio-manager-powered-by-behance/vulnerability/wordpress-behance-portfolio-manager-plugin-1-7-4-sql-injection-vulnerability-2?_s_id=cve
CVE: CVE-2025-32125
Published: 2025-04-04
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in silvasoft Silvasoft boekhouden silvasoft-boekhouden allows SQL Injection.This issue affects Silvasoft boekhouden: from n/a through <= 3.0.6.
CVSS Score: 7.6 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/silvasoft-boekhouden/vulnerability/wordpress-silvasoft-boekhouden-plugin-3-0-1-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-32126
Published: 2025-04-04
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in cmsMinds Pay with Contact Form 7 pay-with-contact-form-7 allows SQL Injection.This issue affects Pay with Contact Form 7: from n/a through <= 1.0.4.
CVSS Score: 7.6 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/pay-with-contact-form-7/vulnerability/wordpress-pay-with-contact-form-7-plugin-1-0-4-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-32127
Published: 2025-04-04
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in onOffice GmbH onOffice for WP-Websites onoffice-for-wp-websites allows SQL Injection.This issue affects onOffice for WP-Websites: from n/a through <= 5.7.
CVSS Score: 7.6 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/onoffice-for-wp-websites/vulnerability/wordpress-onoffice-for-wp-websites-plugin-5-7-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-32129
Published: 2025-04-04
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Data443 Risk Mitigation, Inc. Welcome Bar intelly-welcome-bar allows Stored XSS.This issue affects Welcome Bar: from n/a through <= 2.0.4.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/intelly-welcome-bar/vulnerability/wordpress-welcome-bar-plugin-2-0-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-32130
Published: 2025-04-04
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Data443 Risk Mitigation, Inc. Posts Footer Manager intelly-posts-footer-manager allows Stored XSS.This issue affects Posts Footer Manager: from n/a through <= 2.2.0.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/intelly-posts-footer-manager/vulnerability/wordpress-posts-footer-manager-plugin-2-2-0-cross-site-scripting-xss-vulnerability?_s_id=cve