deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-8277
Published: 2025-09-09
Description: A flaw was found in libssh's handling of key exchange (KEX) processes when a client repeatedly sends incorrect KEX guesses. The library fails to free memory during these rekey operations, which can gradually exhaust system memory. This issue can lead to crashes on the client side, particularly when using libgcrypt, which impacts application stability and availability.
CVSS Score: 3.1 (LOW)
CWE: CWE-401
References: https://access.redhat.com/security/cve/CVE-2025-8277; https://bugzilla.redhat.com/show_bug.cgi?id=2383888; https://www.libssh.org/security/advisories/CVE-2025-8277.txt
CVE: CVE-2025-7350
Published: 2025-09-09
Description: A security issue affecting multiple Cisco devices also directly impacts Stratix® 5410, 5700, and 8000 devices. This can lead to remote code execution by uploading and running malicious configurations without authentication.
CWE: CWE-74
References: https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1745.html
CVE: CVE-2025-7970
Published: 2025-09-09
Description: A security issue exists within FactoryTalk Activation Manager.  An error in the implementation of cryptography within the software could allow attackers to decrypt traffic. This could result in data exposure, session hijacking, or full communication compromise.
CVSS Score: 7.5 (HIGH)
CWE: CWE-306
References: https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1741.html
CVE: CVE-2025-8007
Published: 2025-09-09
Description: A security issue exists in the protected mode of 1756-EN4TR and 1756-EN2TR communication modules, where a Concurrent Forward Close operation can trigger a Major Non-Recoverable (MNFR) fault. This condition may lead to unexpected system crashes and loss of device availability.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1739.html
CVE: CVE-2025-8008
Published: 2025-09-09
Description: A security issue exists in the protected mode of EN4TR devices, where sending specifically crafted messages during a Forward Close operation can cause the device to crash.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-755
References: https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1739.html
CVE: CVE-2025-9065
Published: 2025-09-09
Description: A server-side request forgery security issue exists within Rockwell Automation ThinManager® software due to the lack of input sanitization. Authenticated attackers can exploit this vulnerability by specifying external SMB paths, exposing the ThinServer® service account NTLM hash.
CVSS Score: 8.8 (HIGH)
CWE: CWE-610, CWE-918
References: https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1743.html
CVE: CVE-2025-9160
Published: 2025-09-09
Description: A code execution security issue exists in the affected product. An attacker with physical access could abuse the maintenance menu of the controller with a crafted payload. The security issue can result in arbitrary code execution.
CWE: CWE-306
References: https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1746.html
CVE: CVE-2025-9161
Published: 2025-09-09
Description: A security issue exists within FactoryTalk Optix MQTT broker due to the lack of URI sanitization. This flaw enables the loading of remote Mosquito plugins, which can be used to achieve remote code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-77
References: https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1742.html
CVE: CVE-2025-9166
Published: 2025-09-09
Description: A denial-of-service security issue exists in the affected product and version. The security issue stems from the controller repeatedly attempting to forward messages. The issue could result in a major nonrecoverable fault on the controller.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1747.html
CVE: CVE-2025-9364
Published: 2025-09-09
Description: An open database issue exists in the affected product and version. The security issue stems from an over permissive Redis instance. This could result in an attacker on the intranet accessing sensitive data and potential alteration of data.
CVSS Score: 8.8 (HIGH)
CWE: CWE-497
References: https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1748.html
CVE: CVE-2024-45325
Published: 2025-09-09
Description: An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerabilities [CWE-78] in Fortinet FortiDDoS-F version 7.0.0 through 7.02 and before 6.6.3 may allow a privileged attacker to execute unauthorized code or commands via crafted CLI requests.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-78
References: https://fortiguard.fortinet.com/psirt/FG-IR-24-344
CVE: CVE-2025-33045
Published: 2025-09-09
Description: APTIOV contains vulnerabilities in the BIOS where a privileged user may cause “Write-what-where Condition” and “Exposure of Sensitive Information to an Unauthorized Actor” through local access. The successful exploitation of these vulnerabilities can lead to information disclosure, arbitrary data writing, and impact Confidentiality, Integrity, and Availability.
CVSS Score: 8.2 (HIGH)
CWE: CWE-123, CWE-200
References: https://go.ami.com/hubfs/Security%20Advisories/2025/AMI-SA-2025007.pdf
CVE: CVE-2025-47416
Published: 2025-09-09
Description: A vulnerability exists in the ConsoleFindCommandMatchList function in libsymproc. so imported by ctpd that may lead to unauthorized execution of an attacker-defined file that gets prioritized by the ConsoleFindCommandMatchList.



A third-party researcher discovered that the ConsoleFindCommandMatchList enumerates the /dev/shm/symproc/c directory in alphabetical order to identify console commands. Permission levels are inferred from the integer values present in each command's file name. 



Confirmed Affected Hardware: TSW-760, TSW-1060 



Confirmed Affected Firmware: 3.002.1061 



Fixed Firmware: no fixed released (product is discontinued and end of life)



 



For x70  



The Affected Firmware:- 3.000.0110.001  and versions below 



The Fixed Firmware:- 3.001.0031.001
CWE: CWE-697
References: https://security.crestron.com; https://www.crestron.com/Software-Firmware/Firmware/Touchpanels/TS-770-TS-1070-TSS-770-TSS-1070-TSW-570/3-002-0040-001
CVE: CVE-2025-53609
Published: 2025-09-09
Description: A Relative Path Traversal vulnerability [CWE-23] in FortiWeb 7.6.0 through 7.6.4, 7.4.0 through 7.4.8, 7.2.0 through 7.2.11, 7.0.2 through 7.0.11 may allow an authenticated attacker to perform an arbitrary file read on the underlying system via crafted requests.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-23
References: https://fortiguard.fortinet.com/psirt/FG-IR-25-512
CVE: CVE-2025-54236
Published: 2025-09-09
Description: Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by an Improper Input Validation vulnerability. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality, and integrity impact to high. Exploitation of this issue does not require user interaction.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-20
References: https://helpx.adobe.com/security/products/magento/apsb25-88.html; https://experienceleague.adobe.com/en/docs/experience-cloud-kcs/kbarticles/ka-27397; https://nullsecurityx.codes/cve-2025-54236-sessionreaper-unauthenticated-rce-in-magento
CVE: CVE-2025-9951
Published: 2025-09-09
Description: A heap-buffer-overflow write exists in jpeg2000dec FFmpeg which allows an attacker to potentially gain remote code execution or cause denial of service via the channel definition cdef atom of JPEG2000.
CWE: CWE-122
References: https://github.com/google/security-research/security/advisories/GHSA-39q3-f8jq-v6mg
CVE: CVE-2025-9994
Published: 2025-09-09
Description: The Amp’ed RF BT-AP 111 Bluetooth access point's HTTP admin interface does not have an authentication feature, allowing unauthorized access to anyone with network access.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287, CWE-306
References: https://www.ampedrftech.com/guides/BT-AP111_UserManual.pdf; https://www.kb.cert.org/vuls/id/763183
CVE: CVE-2025-10107
Published: 2025-09-09
Description: A vulnerability has been found in TRENDnet TEW-831DR 1.0 (601.130.1.1410). Impacted is an unknown function of the file /boafrm/formSysCmd. The manipulation of the argument sysHost leads to command injection. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-74, CWE-77
References: https://github.com/Darklab-limited/TRENDnet-AC1200-RCE/blob/main/TRENDnet%20Post-auth%20RCE.pdf; https://vuldb.com/?ctiid.323208; https://vuldb.com/?id.323208
CVE: CVE-2025-10183
Published: 2025-09-09
Description: A blind XML External Entity (XXE) injection in the OpenMessaging webservice in TecCom TecConnect 4.1 allows an unauthenticated attacker to exfiltrate arbitrary files to an attacker-controlled server. TecConnect 4.1 is considered end-of-life as of December 2023. Users are advised to upgrade to TecCom Connect 5.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-611
References: https://blog.blacklanternsecurity.com/p/teccom-tecconnect-41-xml-external
CVE: CVE-2025-43776
Published: 2025-09-09
Description: A Stored cross-site scripting vulnerability in the Liferay Portal  7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.9, 2025.Q1.0 through 2025.Q1.16, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.19 and 7.4 GA through update 92 allows an remote authenticated attacker to inject JavaScript through Custom Object field label. The malicious payload is stored and executed through Process Builder's Configuration tab without proper escaping.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-209, CWE-79
References: https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43776
CVE: CVE-2025-52277
Published: 2025-09-09
Description: Cross Site Scripting vulnerability in YesWiki v.4.54 allows a remote attacker to execute arbitrary code via a crafted payload to the meta configuration robots field
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://yeswiki.com; https://github.com/nakkouchtarek/CVE/tree/main/CVE-2025-52277; https://github.com/nakkouchtarek/CVE/tree/main/CVE-2025-52277
CVE: CVE-2025-52322
Published: 2025-09-09
Description: An issue in Open5GS v2.7.2 and before allows a remote attacker to cause a denial of service via a crafted Create Session Request message to the SMF (PGW-C), using the IP address of a legitimate UE in the PDN Address Allocation (PAA) field
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://github.com/ZHENGHAOHELLO/BugReport/blob/main/CVE-2025-52322; https://github.com/open5gs/open5gs/discussions/3919; https://github.com/open5gs/open5gs/discussions/3919
CVE: CVE-2025-52915
Published: 2025-09-09
Description: K7RKScan.sys 23.0.0.10, part of the K7 Security Anti-Malware suite, allows an admin-privileged user to send crafted IOCTL requests to terminate processes that are protected through a third-party implementation. This is caused by insufficient caller validation in the driver's IOCTL handler, enabling unauthorized processes to perform those actions in kernel space. Successful exploitation can lead to denial of service by disrupting critical third-party services or applications.
CVSS Score: 7.2 (HIGH)
CWE: CWE-269
References: https://k7computing.com; https://support.k7computing.com/index.php?/solutions/view-article/Advisory-issued-on-2nd-Sep-2025
CVE: CVE-2025-55139
Published: 2025-09-09
Description: SSRF in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed on 02-Aug-2025) allows a remote authenticated attacker with admin privileges to enumerate internal services.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-918
References: https://forums.ivanti.com/s/article/September-Security-Advisory-Ivanti-Connect-Secure-Policy-Secure-ZTA-Gateways-and-Neurons-for-Secure-Access-Multiple-CVEs?language=en_US
CVE: CVE-2025-55141
Published: 2025-09-09
Description: Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed on 02-Aug-2025) allows a remote authenticated attacker with read-only admin privileges to configure authentication related settings.
CVSS Score: 8.8 (HIGH)
CWE: CWE-862
References: https://forums.ivanti.com/s/article/September-Security-Advisory-Ivanti-Connect-Secure-Policy-Secure-ZTA-Gateways-and-Neurons-for-Secure-Access-Multiple-CVEs?language=en_US
CVE: CVE-2025-55142
Published: 2025-09-09
Description: Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed on 02-Aug-2025) allows a remote authenticated attacker with read-only admin privileges to configure authentication related settings.
CVSS Score: 8.8 (HIGH)
CWE: CWE-862
References: https://forums.ivanti.com/s/article/September-Security-Advisory-Ivanti-Connect-Secure-Policy-Secure-ZTA-Gateways-and-Neurons-for-Secure-Access-Multiple-CVEs?language=en_US
CVE: CVE-2025-55143
Published: 2025-09-09
Description: Reflected text injection in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed on 02-Aug-2025) allows a remote unauthenticated attacker to inject arbitrary text into a crafted HTTP response. User interaction is required.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://forums.ivanti.com/s/article/September-Security-Advisory-Ivanti-Connect-Secure-Policy-Secure-ZTA-Gateways-and-Neurons-for-Secure-Access-Multiple-CVEs?language=en_US
CVE: CVE-2025-55144
Published: 2025-09-09
Description: Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed on 02-Aug-2025) allows a remote authenticated attacker with read-only admin privileges to configure restricted settings.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862
References: https://forums.ivanti.com/s/article/September-Security-Advisory-Ivanti-Connect-Secure-Policy-Secure-ZTA-Gateways-and-Neurons-for-Secure-Access-Multiple-CVEs?language=en_US
CVE: CVE-2025-55145
Published: 2025-09-09
Description: Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723  and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed on 02-Aug-2025) allows a remote authenticated attacker to hijack existing HTML5 connections.
CVSS Score: 8.9 (HIGH)
CWE: CWE-862
References: https://forums.ivanti.com/s/article/September-Security-Advisory-Ivanti-Connect-Secure-Policy-Secure-ZTA-Gateways-and-Neurons-for-Secure-Access-Multiple-CVEs?language=en_US
CVE: CVE-2025-55146
Published: 2025-09-09
Description: An unchecked return value in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed on 02-Aug-2025) allows a remote authenticated attacker with admin privileges to trigger a denial of service.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-252
References: https://forums.ivanti.com/s/article/September-Security-Advisory-Ivanti-Connect-Secure-Policy-Secure-ZTA-Gateways-and-Neurons-for-Secure-Access-Multiple-CVEs?language=en_US
CVE: CVE-2025-55147
Published: 2025-09-09
Description: CSRF in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed on 02-Aug-2025) allows a remote unauthenticated attacker to execute sensitive actions on behalf of the victim user. User interaction is required
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://forums.ivanti.com/s/article/September-Security-Advisory-Ivanti-Connect-Secure-Policy-Secure-ZTA-Gateways-and-Neurons-for-Secure-Access-Multiple-CVEs?language=en_US
CVE: CVE-2025-55148
Published: 2025-09-09
Description: Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed on 02-Aug-2025) allows a remote authenticated attacker with read-only admin privileges to configure restricted settings.
CVSS Score: 7.6 (HIGH)
CWE: CWE-862
References: https://forums.ivanti.com/s/article/September-Security-Advisory-Ivanti-Connect-Secure-Policy-Secure-ZTA-Gateways-and-Neurons-for-Secure-Access-Multiple-CVEs?language=en_US
CVE: CVE-2025-8711
Published: 2025-09-09
Description: CSRF in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed on 02-Aug-2025) allows a remote unauthenticated attacker to execute limited actions on behalf of the victim user. User interaction is required.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://forums.ivanti.com/s/article/September-Security-Advisory-Ivanti-Connect-Secure-Policy-Secure-ZTA-Gateways-and-Neurons-for-Secure-Access-Multiple-CVEs?language=en_US
CVE: CVE-2025-8712
Published: 2025-09-09
Description: Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 22.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed on 02-Aug-2025) allows a remote authenticated attacker with read-only admin privileges to configure restricted settings.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862
References: https://forums.ivanti.com/s/article/September-Security-Advisory-Ivanti-Connect-Secure-Policy-Secure-ZTA-Gateways-and-Neurons-for-Secure-Access-Multiple-CVEs
CVE: CVE-2025-9712
Published: 2025-09-09
Description: Insufficient filename validation in Ivanti Endpoint Manager before 2024 SU3 SR1 and 2022 SU8 SR2 allows a remote unauthenticated attacker to achieve remote code execution. User interaction is required.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://forums.ivanti.com/s/article/Security-Advisory-September-2025-for-Ivanti-EPM-2024-SU3-and-EPM-2022-SU8
CVE: CVE-2025-9872
Published: 2025-09-09
Description: Insufficient filename validation in Ivanti Endpoint Manager before 2024 SU3 SR1 and 2022 SU8 SR2 allows a remote unauthenticated attacker to achieve remote code execution. User interaction is required.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://forums.ivanti.com/s/article/Security-Advisory-September-2025-for-Ivanti-EPM-2024-SU3-and-EPM-2022-SU8
CVE: CVE-2025-30875
Published: 2025-09-09
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Alexandre Froger WP Weixin wp-weixin allows Stored XSS.This issue affects WP Weixin: from n/a through <= 1.3.16.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Theme/wp-weixin/vulnerability/wordpress-wp-weixin-plugin-1-3-16-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-32486
Published: 2025-09-09
Description: Weak Password Recovery Mechanism for Forgotten Password vulnerability in Hossein Material Dashboard material-dashboard.This issue affects Material Dashboard: from n/a through <= 1.4.6.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-640
References: https://patchstack.com/database/Wordpress/Plugin/material-dashboard/vulnerability/wordpress-material-dashboard-1-4-6-privilege-escalation-vulnerability?_s_id=cve
CVE: CVE-2025-32688
Published: 2025-09-09
Description: Missing Authorization vulnerability in Nebojsa Target Video Easy Publish brid-video-easy-publish.This issue affects Target Video Easy Publish: from n/a through <= 3.8.9.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/brid-video-easy-publish/vulnerability/wordpress-target-video-easy-publish-plugin-3-8-5-arbitrary-shortcode-execution-vulnerability?_s_id=cve
CVE: CVE-2025-32689
Published: 2025-09-09
Description: Improper Validation of Specified Quantity in Input vulnerability in Convers Lab WP SmartPay smartpay.This issue affects WP SmartPay: from n/a through <= 2.8.2.
CVSS Score: 7.5 (HIGH)
CWE: CWE-1284
References: https://patchstack.com/database/Wordpress/Plugin/smartpay/vulnerability/wordpress-download-manager-and-payment-form-2-7-12-other-vulnerability-type-vulnerability?_s_id=cve
CVE: CVE-2025-39523
Published: 2025-09-09
Description: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in GoodBarber GoodBarber goodbarber.This issue affects GoodBarber: from n/a through <= 1.0.26.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-601
References: https://patchstack.com/database/Wordpress/Plugin/goodbarber/vulnerability/wordpress-goodbarber-1-0-26-open-redirection-vulnerability?_s_id=cve
CVE: CVE-2025-39541
Published: 2025-09-09
Description: Missing Authorization vulnerability in Roland Murg WP Simple Booking Calendar wp-simple-booking-calendar.This issue affects WP Simple Booking Calendar: from n/a through <= 2.0.13.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/wp-simple-booking-calendar/vulnerability/wordpress-wp-simple-booking-calendar-plugin-2-0-13-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-39553
Published: 2025-09-09
Description: Missing Authorization vulnerability in andy_moyle Church Admin church-admin.This issue affects Church Admin: from n/a through <= 5.0.9.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/church-admin/vulnerability/wordpress-church-admin-plugin-5-0-9-sensitive-data-exposure-vulnerability?_s_id=cve
CVE: CVE-2025-47437
Published: 2025-09-09
Description: Server-Side Request Forgery (SSRF) vulnerability in LiteSpeed Technologies LiteSpeed Cache litespeed-cache.This issue affects LiteSpeed Cache: from n/a through <= 7.0.1.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-918
References: https://patchstack.com/database/Wordpress/Plugin/litespeed-cache/vulnerability/wordpress-litespeed-cache-plugin-7-0-1-server-side-request-forgery-ssrf-vulnerability?_s_id=cve
CVE: CVE-2025-47569
Published: 2025-09-09
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPSwings WooCommerce Ultimate Gift Card woocommerce-ultimate-gift-card allows Blind SQL Injection.This issue affects WooCommerce Ultimate Gift Card: from n/a through <= 2.9.6.
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/woocommerce-ultimate-gift-card/vulnerability/wordpress-woocommerce-ultimate-gift-card-plugin-2-8-10-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-47570
Published: 2025-09-09
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in villatheme WooCommerce Photo Reviews woocommerce-photo-reviews.This issue affects WooCommerce Photo Reviews: from n/a through <= 1.3.13.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/woocommerce-photo-reviews/vulnerability/wordpress-woocommerce-photo-reviews-plugin-1-3-13-cross-site-scripting-xss-vulnerability?_s_id=cve