deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-26756
Published: 2025-02-22
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in grimdonkey Magic the Gathering Card Tooltips magic-the-gathering-card-tooltips allows Stored XSS.This issue affects Magic the Gathering Card Tooltips: from n/a through <= 3.5.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/magic-the-gathering-card-tooltips/vulnerability/wordpress-magic-the-gathering-card-tooltips-plugin-3-5-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-26757
Published: 2025-02-22
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in FULL SERVICES FULL Customer full-customer allows PHP Local File Inclusion.This issue affects FULL Customer: from n/a through <= 3.1.26.
CVSS Score: 7.5 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Plugin/full-customer/vulnerability/wordpress-full-cliente-plugin-3-1-26-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-26760
Published: 2025-02-22
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Wow-Company Calculator Builder calculator-builder allows PHP Local File Inclusion.This issue affects Calculator Builder: from n/a through <= 1.6.2.
CVSS Score: 7.5 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Plugin/calculator-builder/vulnerability/wordpress-calculator-builder-plugin-1-6-2-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-26763
Published: 2025-02-22
Description: Deserialization of Untrusted Data vulnerability in MetaSlider Responsive Slider by MetaSlider ml-slider allows Object Injection.This issue affects Responsive Slider by MetaSlider: from n/a through <= 3.94.0.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://patchstack.com/database/Wordpress/Plugin/ml-slider/vulnerability/wordpress-slider-gallery-and-carousel-by-metaslider-image-slider-video-slider-plugin-3-94-0-php-object-injection-vulnerability?_s_id=cve
CVE: CVE-2025-26764
Published: 2025-02-22
Description: Missing Authorization vulnerability in enituretechnology Distance Based Shipping Calculator distance-based-shipping-calculator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Distance Based Shipping Calculator: from n/a through <= 2.0.22.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/distance-based-shipping-calculator/vulnerability/wordpress-distance-based-shipping-calculator-plugin-2-0-22-settings-change-vulnerability?_s_id=cve
CVE: CVE-2025-26774
Published: 2025-02-22
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rock Solid Responsive Modal Builder for High Conversion – Easy Popups easy-popups allows Reflected XSS.This issue affects Responsive Modal Builder for High Conversion – Easy Popups: from n/a through <= 1.5.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/easy-popups/vulnerability/wordpress-responsive-modal-builder-for-high-conversion-easy-popups-plugin-1-5-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-26776
Published: 2025-02-22
Description: Unrestricted Upload of File with Dangerous Type vulnerability in NotFound Chaty Pro allows Upload a Web Shell to a Web Server. This issue affects Chaty Pro: from n/a through 3.3.3.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-434
References: https://patchstack.com/database/wordpress/plugin/chaty-pro/vulnerability/wordpress-chaty-pro-plugin-3-3-3-arbitrary-file-upload-vulnerability?_s_id=cve
CVE: CVE-2025-26973
Published: 2025-02-22
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WarfarePlugins Social Warfare social-warfare allows DOM-Based XSS.This issue affects Social Warfare: from n/a through <= 4.5.5.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/social-warfare/vulnerability/wordpress-social-warfare-plugin-4-5-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-27012
Published: 2025-02-22
Description: Cross-Site Request Forgery (CSRF) vulnerability in a1post A1POST.BG Shipping for Woo a1post-bg-shipping-for-woocommerce allows Privilege Escalation.This issue affects A1POST.BG Shipping for Woo: from n/a through <= 1.5.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/a1post-bg-shipping-for-woocommerce/vulnerability/wordpress-a1post-bg-shipping-for-woo-plugin-1-5-1-csrf-to-privilege-escalation-vulnerability?_s_id=cve
CVE: CVE-2022-28339
Published: 2025-02-22
Description: Trend Micro HouseCall for Home Networks version 5.3.1302 and below contains an uncontrolled search patch element vulnerability that could allow an attacker with low user privileges to create a malicious DLL that could lead to escalated privileges.
CVSS Score: 7.3 (HIGH)
CWE: CWE-427
References: https://helpcenter.trendmicro.com/en-us/article/tmka-21734; https://www.zerodayinitiative.com/advisories/ZDI-22-620/
CVE: CVE-2025-1575
Published: 2025-02-23
Description: A vulnerability classified as problematic has been found in Harpia DiagSystem 12. Affected is an unknown function of the file /diagsystem/PACS/atualatendimento_jpeg.php. The manipulation of the argument cod/codexame leads to improper control of resource identifiers. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-99
References: https://drive.google.com/file/d/1zBAwcqfv6-HvDQg6ch3ywbllo0VlLIoQ/view?usp=sharing; https://vuldb.com/?ctiid.296550; https://vuldb.com/?id.296550
CVE: CVE-2025-1576
Published: 2025-02-23
Description: A vulnerability classified as critical was found in code-projects Real Estate Property Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /ajax_state.php. The manipulation of the argument StateName as part of String leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://code-projects.org/; https://github.com/fjl1113/cve/blob/main/sql-fjl.md; https://vuldb.com/?ctiid.296551
CVE: CVE-2024-13728
Published: 2025-02-23
Description: The Accept Donations with PayPal & Stripe plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the rf parameter in all versions up to, and including, 1.4.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/easy-paypal-donation/tags/1.4.4/core/Base/Stripe.php#L227; https://www.wordfence.com/threat-intel/vulnerabilities/id/3891a807-aace-460a-ad49-6a282af16084?source=cve
CVE: CVE-2025-1577
Published: 2025-02-23
Description: A vulnerability, which was classified as problematic, has been found in code-projects Blood Bank System 1.0. Affected by this issue is some unknown functionality of the file /prostatus.php. The manipulation of the argument message leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94, CWE-79
References: https://code-projects.org/; https://github.com/heiheiworld/cve/blob/main/xss-h.md; https://vuldb.com/?ctiid.296552
CVE: CVE-2025-1578
Published: 2025-02-23
Description: A vulnerability, which was classified as critical, was found in PHPGurukul/Campcodes Online Shopping Portal 2.1. This affects an unknown part of the file /search-result.php. The manipulation of the argument Product leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/panghuanjie/Code-audits/blob/main/PHPGurukul%20Online%20Shopping%20Portal%20v2.1%20Foreground%20SQL%20Injection%20Vulnerability2.pdf; https://vuldb.com/?ctiid.296553; https://vuldb.com/?id.296553
CVE: CVE-2025-1579
Published: 2025-02-23
Description: A vulnerability was found in code-projects Blood Bank System 1.0 and classified as problematic. This issue affects some unknown processing of the file /admin/user.php. The manipulation of the argument email leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.
CVSS Score: 2.4 (LOW)
CWE: CWE-79, CWE-94, CWE-79
References: https://code-projects.org/; https://github.com/R2og/cve/blob/main/xss-r2og.md; https://vuldb.com/?ctiid.296555
CVE: CVE-2025-1580
Published: 2025-02-23
Description: A vulnerability was found in PHPGurukul Nipah Virus Testing Management System 1.0. It has been classified as critical. Affected is an unknown function of the file /search-report-result.php. The manipulation of the argument searchdata leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The initial researcher advisory mentions contradicting parameter names to be affected.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/wqywfvc/CVE/issues/5; https://phpgurukul.com/; https://vuldb.com/?ctiid.296556
CVE: CVE-2025-1581
Published: 2025-02-23
Description: A vulnerability was found in PHPGurukul Online Nurse Hiring System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /book-nurse.php?bookid=1. The manipulation of the argument contactname leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/wqywfvc/CVE/issues/10; https://phpgurukul.com/; https://vuldb.com/?ctiid.296557
CVE: CVE-2025-1582
Published: 2025-02-23
Description: A vulnerability was found in PHPGurukul Online Nurse Hiring System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin/all-request.php. The manipulation of the argument viewid leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/wqywfvc/CVE/issues/11; https://phpgurukul.com/; https://vuldb.com/?ctiid.296558
CVE: CVE-2025-1583
Published: 2025-02-23
Description: A vulnerability classified as critical has been found in PHPGurukul Online Nurse Hiring System 1.0. This affects an unknown part of the file /admin/search-report-details.php. The manipulation of the argument searchinput leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/wqywfvc/CVE/issues/12; https://phpgurukul.com/; https://vuldb.com/?ctiid.296559
CVE: CVE-2025-1584
Published: 2025-02-23
Description: A vulnerability classified as problematic was found in opensolon Solon up to 3.0.8. This vulnerability affects unknown code of the file solon-projects/solon-web/solon-web-staticfiles/src/main/java/org/noear/solon/web/staticfiles/StaticMappings.java. The manipulation leads to path traversal: '../filedir'. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 3.0.9 is able to address this issue. The name of the patch is f46e47fd1f8455b9467d7ead3cdb0509115b2ef1. It is recommended to upgrade the affected component.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-23, CWE-24
References: https://github.com/opensolon/solon/commit/f46e47fd1f8455b9467d7ead3cdb0509115b2ef1; https://github.com/opensolon/solon/issues/332; https://github.com/opensolon/solon/issues/332#issue[PII_REDACTED]
CVE: CVE-2025-1585
Published: 2025-02-23
Description: A vulnerability, which was classified as problematic, has been found in otale tale up to 2.0.5. This issue affects the function OptionsService of the file src/main/resources/templates/themes/default/partial/header.html. The manipulation of the argument logo_url leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
CVSS Score: 2.4 (LOW)
CWE: CWE-79, CWE-94, CWE-79
References: https://github.com/dragonkeep/cve/blob/main/Tale_Blog_xss.md; https://vuldb.com/?ctiid.296561; https://vuldb.com/?id.296561
CVE: CVE-2025-1586
Published: 2025-02-23
Description: A vulnerability was found in code-projects Blood Bank System 1.0. It has been declared as problematic. This vulnerability affects unknown code of the file /Blood/A-.php. The manipulation of the argument Bloodname leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94, CWE-79
References: https://code-projects.org/; https://github.com/1337g/bloodbanksystem_poc/blob/main/xss-gu(1).pdf; https://vuldb.com/?ctiid.296566
CVE: CVE-2025-1587
Published: 2025-02-23
Description: A vulnerability was found in SourceCodester Telecom Billing Management System 1.0. It has been rated as critical. This issue affects the function addrecords of the file main.cpp of the component Add New Record. The manipulation of the argument name/phonenumber leads to buffer overflow. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-119, CWE-120, CWE-120
References: https://github.com/wshRE/CVE/issues/1; https://vuldb.com/?ctiid.296567; https://vuldb.com/?id.296567
CVE: CVE-2025-1467
Published: 2025-02-23
Description: Versions of the package tarteaucitronjs before 1.17.0 are vulnerable to Cross-site Scripting (XSS) via the getElemWidth() and getElemHeight(). This is related to [SNYK-JS-TARTEAUCITRONJS-8366541](https://security.snyk.io/vuln/SNYK-JS-TARTEAUCITRONJS-8366541)
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://gist.github.com/Rudloff/d48f525215bd5426cbb076116c4422dd; https://github.com/AmauriC/tarteaucitron.js/commit/[PII_REDACTED]d5caa187adcaecb01da570a12076b; https://github.com/AmauriC/tarteaucitron.js/issues/1184
CVE: CVE-2025-1588
Published: 2025-02-23
Description: A vulnerability has been found in PHPGurukul Online Nurse Hiring System 1.0 and classified as critical. This vulnerability affects unknown code of the file /admin/manage-nurse.php. The manipulation of the argument profilepic leads to path traversal: '../filedir'. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The initial researcher advisory mentions contradicting vulnerability classes.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-23, CWE-24, CWE-22
References: https://github.com/wqywfvc/CVE/issues/16; https://phpgurukul.com/; https://vuldb.com/?ctiid.296572
CVE: CVE-2025-1589
Published: 2025-02-23
Description: A vulnerability was found in SourceCodester E-Learning System 1.0 and classified as problematic. This issue affects some unknown processing of the file /register.php of the component User Registration Handler. The manipulation leads to cross site scripting. The attack may be initiated remotely.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79, CWE-94, CWE-79
References: https://vuldb.com/?ctiid.296573; https://vuldb.com/?id.296573; https://vuldb.com/?submit.504039
CVE: CVE-2025-1590
Published: 2025-02-23
Description: A vulnerability was found in SourceCodester E-Learning System 1.0. It has been classified as critical. Affected is an unknown function of the file /admin/modules/lesson/index.php of the component List of Lessons Page. The manipulation leads to unrestricted upload. It is possible to launch the attack remotely.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-284, CWE-434, CWE-434
References: https://vuldb.com/?ctiid.296574; https://vuldb.com/?id.296574; https://vuldb.com/?submit.504045
CVE: CVE-2025-1591
Published: 2025-02-23
Description: A vulnerability was found in SourceCodester Employee Management System 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /department.php of the component Department Page. The manipulation of the argument Department Name leads to cross site scripting. The attack can be launched remotely.
CVSS Score: 2.4 (LOW)
CWE: CWE-79, CWE-94, CWE-79
References: https://vuldb.com/?ctiid.296575; https://vuldb.com/?id.296575; https://vuldb.com/?submit.504048
CVE: CVE-2025-1592
Published: 2025-02-23
Description: A vulnerability was found in SourceCodester Best Employee Management System 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /admin/Operations/Role.php of the component Add Role Page. The manipulation of the argument assign_name/description leads to cross site scripting. The attack may be launched remotely.
CVSS Score: 2.4 (LOW)
CWE: CWE-79, CWE-94, CWE-79
References: https://vuldb.com/?ctiid.296576; https://vuldb.com/?id.296576; https://vuldb.com/?submit.505210
CVE: CVE-2025-1593
Published: 2025-02-23
Description: A vulnerability classified as critical has been found in SourceCodester Best Employee Management System 1.0. This affects an unknown part of the file /_hr_soft/assets/uploadImage/Profile/ of the component Profile Picture Handler. The manipulation leads to unrestricted upload. It is possible to initiate the attack remotely.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-284, CWE-434, CWE-434
References: https://vuldb.com/?ctiid.296577; https://vuldb.com/?id.296577; https://vuldb.com/?submit.505212
CVE: CVE-2025-1594
Published: 2025-02-23
Description: A vulnerability, which was classified as critical, was found in FFmpeg up to 7.1. This affects the function ff_aac_search_for_tns of the file libavcodec/aacenc_tns.c of the component AAC Encoder. The manipulation leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-119, CWE-121, CWE-787
References: https://ffmpeg.org/; https://trac.ffmpeg.org/attachment/ticket/11418/poc; https://trac.ffmpeg.org/ticket/11418#comment:3
CVE: CVE-2025-1595
Published: 2025-02-23
Description: A vulnerability has been found in Anhui Xufan Information Technology EasyCVR up to 2.7.0 and classified as problematic. This vulnerability affects unknown code of the file /api/v1/getbaseconfig. The manipulation leads to information disclosure. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200, CWE-284
References: https://github.com/MH521/POC/blob/main/EasyCVR-%E8%A7%86%E9%A2%91%E7%AE%A1%E7%90%86%E5%B9%B3%E5%8F%B0getbaseconfig%E6%8E%A5%E5%8F%A3%E6%9C%AA%E6%8E%88%E6%9D%83%E8%AE%BF%E9%97%AE.md; https://vuldb.com/?ctiid.296590; https://vuldb.com/?id.296590
CVE: CVE-2025-1596
Published: 2025-02-23
Description: A vulnerability was found in SourceCodester Best Church Management Software 1.0 and classified as critical. This issue affects some unknown processing of the file /fpassword.php. The manipulation of the argument email leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/xiahao90/CVEproject/blob/main/xiahao.webray.com.cn/best-church-management-software-sql.md; https://vuldb.com/?ctiid.296591; https://vuldb.com/?id.296591
CVE: CVE-2025-1597
Published: 2025-02-23
Description: A vulnerability was found in SourceCodester Best Church Management Software 1.0. It has been classified as problematic. Affected is an unknown function of the file /admin/redirect.php. The manipulation of the argument a leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94, CWE-79
References: https://github.com/xiahao90/CVEproject/blob/main/xiahao.webray.com.cn/best-church-management-software-xss.md; https://vuldb.com/?ctiid.296592; https://vuldb.com/?id.296592
CVE: CVE-2025-22631
Published: 2025-02-23
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in vbout Marketing Automation marketing-automation allows Reflected XSS.This issue affects Marketing Automation: from n/a through <= 1.2.6.8.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/marketing-automation/vulnerability/wordpress-marketing-automation-plugin-1-2-6-8-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-22632
Published: 2025-02-23
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in totalsoft WooCommerce Pricing – Product Pricing woo-pricing-table allows Stored XSS.This issue affects WooCommerce Pricing – Product Pricing: from n/a through <= 1.0.9.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/woo-pricing-table/vulnerability/wordpress-woocommerce-pricing-product-pricing-plugin-1-0-9-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-22633
Published: 2025-02-23
Description: Insertion of Sensitive Information into Externally-Accessible File or Directory vulnerability in StellarWP Give – Divi Donation Modules give-donation-modules-for-divi allows Retrieve Embedded Sensitive Data.This issue affects Give – Divi Donation Modules: from n/a through <= 2.0.0.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-538
References: https://patchstack.com/database/Wordpress/Plugin/give-donation-modules-for-divi/vulnerability/wordpress-give-divi-donation-modules-plugin-2-0-0-sensitive-data-exposure-vulnerability?_s_id=cve
CVE: CVE-2025-22635
Published: 2025-02-23
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in imithemes Eventer eventer allows Reflected XSS.This issue affects Eventer: from n/a through < 3.9.9.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/eventer/vulnerability/wordpress-eventer-wordpress-event-booking-manager-plugin-plugin-3-9-9-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-1598
Published: 2025-02-24
Description: A vulnerability was found in SourceCodester Best Church Management Software 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /admin/app/asset_crud.php. The manipulation of the argument photo1 leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-284, CWE-434, CWE-434
References: https://github.com/xiahao90/CVEproject/blob/main/xiahao.webray.com.cn/best-church-management-software-Arbitrary-File-Upload.md; https://vuldb.com/?ctiid.296593; https://vuldb.com/?id.296593