rainbutterfly/cve_corpus huggingface dataset:
CVE-2025-14016 macrozheng mall-swarm delete improper authorization
A security vulnerability has been detected in macrozheng mall-swarm up to 1.0.3. Affected is the function delete of the file /member/readHistory/delete. Such manipulation of the argument ids leads to improper authorization. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Problem types: cwe_id: CWE-285
description: Improper Authorization
cwe_id: CWE-266
description: Incorrect Privilege Assignment
Affected products: vendor: macrozheng
product: mall-swarm
CVSS v3.1: version: 3.1
baseScore: 5.4
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:R
baseSeverity: MEDIUM
Credits: lang: en
value: huangweigang (VulDB User)
Published: 2025-12-04T18:32:07.910Z
CVE-2025-14017 broken TLS options for threaded LDAPS
When doing multi-threaded LDAPS transfers (LDAP over TLS) with libcurl,
changing TLS options in one thread would inadvertently change them globally
and therefore possibly also affect other concurrently setup transfers.

Disabling certificate verification for a specific transfer could
unintentionally disable the feature for other threads as well.
Problem types: description: CWE-567 Unsynchronized Access to Shared Data in a Multi-threaded Context
Affected products: vendor: curl
product: curl
default_status: unaffected
Credits: lang: en
value: Stanislav Fort (Aisle Research)
lang: en
value: Daniel Stenberg
Published: 2026-01-08T10:07:05.554Z
CVE-2025-14018 Unquoted Service Path in NetBT Consultancy's e-Fatura
Unquoted Search Path or Element vulnerability in NetBT Consulting Services Inc. E-Fatura allows Leveraging/Manipulating Configuration File Search Paths, Redirect Access to Libraries.

This issue affects e-Fatura: before 1.2.15.
Problem types: cwe_id: CWE-428
description: CWE-428 Unquoted Search Path or Element
Affected products: vendor: NetBT Consulting Services Inc.
product: e-Fatura
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: LOW
baseSeverity: HIGH
baseScore: 7.3
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
Credits: lang: en
value: İsmail SAYGILI
lang: en
value: Levent SÜNGÜ
lang: en
value: Seccops Cyber Security Technologies
Published: 2025-12-22T13:46:12.154Z
CVE-2025-14019 
LINE client for Android versions from 13.8 to 15.5 is vulnerable to UI spoofing in the in-app browser where a specific layout could obscure the full-screen warning prompt, potentially allowing attackers to conduct phishing attacks.
Problem types: description: na
Affected products: vendor: LINE Corporation
product: LINE client for Android
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:N
attackVector: NETWORK
attackComplexity: HIGH
privilegesRequired: NONE
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: NONE
integrityImpact: LOW
availabilityImpact: NONE
baseScore: 3.4
baseSeverity: LOW
exploitCodeMaturity: NOT_DEFINED
remediationLevel: NOT_DEFINED
reportConfidence: NOT_DEFINED
temporalScore: 3.4
temporalSeverity: LOW
confidentialityRequirement: NOT_DEFINED
integrityRequirement: NOT_DEFINED
availabilityRequirement: NOT_DEFINED
modifiedAttackVector: NETWORK
modifiedAttackComplexity: HIGH
modifiedPrivilegesRequired: NONE
modifiedUserInteraction: REQUIRED
modifiedScope: CHANGED
modifiedConfidentialityImpact: NONE
modifiedIntegrityImpact: LOW
modifiedAvailabilityImpact: NONE
environmentalScore: 3.4
environmentalSeverity: LOW
Published: 2025-12-15T06:38:05.914Z
CVE-2025-14020 
LINE client for Android versions prior to 14.20 contains a UI spoofing vulnerability in the in-app browser where the full-screen security Toast notification is not properly re-displayed when users return from another application, potentially allowing attackers to conduct phishing attacks by impersonating legitimate interfaces.
Problem types: description: na
Affected products: vendor: LINE Corporation
product: LINE client for Android
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: NONE
baseScore: 5.4
baseSeverity: MEDIUM
exploitCodeMaturity: NOT_DEFINED
remediationLevel: NOT_DEFINED
reportConfidence: NOT_DEFINED
temporalScore: 5.4
temporalSeverity: MEDIUM
confidentialityRequirement: NOT_DEFINED
integrityRequirement: NOT_DEFINED
availabilityRequirement: NOT_DEFINED
modifiedAttackVector: NETWORK
modifiedAttackComplexity: LOW
modifiedPrivilegesRequired: NONE
modifiedUserInteraction: REQUIRED
modifiedScope: UNCHANGED
modifiedConfidentialityImpact: LOW
modifiedIntegrityImpact: LOW
modifiedAvailabilityImpact: NONE
environmentalScore: 5.4
environmentalSeverity: MEDIUM
Published: 2025-12-15T06:39:51.980Z
CVE-2025-14021 
The in-app browser in LINE client for iOS versions prior to 14.14 is vulnerable to address bar spoofing, which could allow attackers to execute malicious JavaScript within iframes while displaying trusted URLs, enabling phishing attacks through overlaid malicious content.
Problem types: description: na
Affected products: vendor: LINE Corporation
product: LINE client for iOS
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: LOW
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
exploitCodeMaturity: NOT_DEFINED
remediationLevel: NOT_DEFINED
reportConfidence: NOT_DEFINED
temporalScore: 4.3
temporalSeverity: MEDIUM
confidentialityRequirement: NOT_DEFINED
integrityRequirement: NOT_DEFINED
availabilityRequirement: NOT_DEFINED
modifiedAttackVector: NETWORK
modifiedAttackComplexity: LOW
modifiedPrivilegesRequired: NONE
modifiedUserInteraction: REQUIRED
modifiedScope: UNCHANGED
modifiedConfidentialityImpact: NONE
modifiedIntegrityImpact: LOW
modifiedAvailabilityImpact: NONE
environmentalScore: 4.3
environmentalSeverity: MEDIUM
Published: 2025-12-15T06:41:37.992Z
CVE-2025-14022 
LINE client for iOS prior to 15.4 allows man-in-the-middle attacks due to improper SSL/TLS certificate validation in an integrated financial SDK. The SDK interfered with the application's network processing, causing server certificate verification to be disabled for a significant portion of network traffic, which could allow a network-adjacent attacker to intercept or modify encrypted communications.
Problem types: description: na
Affected products: vendor: LINE Corporation
product: LINE client for iOS
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L
attackVector: NETWORK
attackComplexity: HIGH
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: LOW
baseScore: 7.7
baseSeverity: HIGH
exploitCodeMaturity: NOT_DEFINED
remediationLevel: NOT_DEFINED
reportConfidence: NOT_DEFINED
temporalScore: 7.7
temporalSeverity: HIGH
confidentialityRequirement: NOT_DEFINED
integrityRequirement: NOT_DEFINED
availabilityRequirement: NOT_DEFINED
modifiedAttackVector: NETWORK
modifiedAttackComplexity: HIGH
modifiedPrivilegesRequired: NONE
modifiedUserInteraction: NONE
modifiedScope: UNCHANGED
modifiedConfidentialityImpact: HIGH
modifiedIntegrityImpact: HIGH
modifiedAvailabilityImpact: LOW
environmentalScore: 7.7
environmentalSeverity: HIGH
Published: 2025-12-15T06:43:47.276Z
CVE-2025-14023 
LINE client for iOS prior to 15.19 allows UI spoofing due to inconsistencies between the navigation state and the in-app browser's user interface, which could create confusion about the trust context of displayed pages or interactive elements under specific conditions.
Problem types: description: na
Affected products: vendor: LINE Corporation
product: LINE client for iOS
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N
attackVector: NETWORK
attackComplexity: HIGH
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: LOW
availabilityImpact: NONE
baseScore: 3.1
baseSeverity: LOW
exploitCodeMaturity: NOT_DEFINED
remediationLevel: NOT_DEFINED
reportConfidence: NOT_DEFINED
temporalScore: 3.1
temporalSeverity: LOW
confidentialityRequirement: NOT_DEFINED
integrityRequirement: NOT_DEFINED
availabilityRequirement: NOT_DEFINED
modifiedAttackVector: NETWORK
modifiedAttackComplexity: HIGH
modifiedPrivilegesRequired: NONE
modifiedUserInteraction: REQUIRED
modifiedScope: UNCHANGED
modifiedConfidentialityImpact: NONE
modifiedIntegrityImpact: LOW
modifiedAvailabilityImpact: NONE
environmentalScore: 3.1
environmentalSeverity: LOW
Published: 2025-12-15T06:45:23.025Z
CVE-2025-14025 Ansible-automation-platform/aap-gateway: aap-gateway: read-only personal access token (pat) bypasses write restrictions
A flaw was found in Ansible Automation Platform (AAP). Read-only scoped OAuth2 API Tokens in AAP, are enforced at the Gateway level for Gateway-specific operations. However, this vulnerability allows read-only tokens to perform write operations on backend services (e.g., Controller, Hub, EDA). If this flaw were exploited, an attacker‘s capabilities would only be limited by role based access controls (RBAC).
Problem types: cwe_id: CWE-279
description: Incorrect Execution-Assigned Permissions
Affected products: vendor: Red Hat
product: Red Hat Ansible Automation Platform 2.5 for RHEL 8
cpes: cpe:/a:redhat:ansible_automation_platform:2.5::el8
cpe:/a:redhat:ansible_automation_platform:2.5::el9
default_status: affected
vendor: Red Hat
product: Red Hat Ansible Automation Platform 2.5 for RHEL 9
cpes: cpe:/a:redhat:ansible_automation_platform:2.5::el8
cpe:/a:redhat:ansible_automation_platform:2.5::el9
default_status: affected
vendor: Red Hat
product: Red Hat Ansible Automation Platform 2.6 for RHEL 9
cpes: cpe:/a:redhat:ansible_automation_platform:2.6::el9
default_status: affected
vendor: Red Hat
product: Red Hat Ansible Automation Platform 2.5
cpes: cpe:/a:redhat:ansible_automation_platform:2.5::el8
default_status: affected
vendor: Red Hat
product: Red Hat Ansible Automation Platform 2.6
cpes: cpe:/a:redhat:ansible_automation_platform:2.6::el9
default_status: affected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
version: 3.1
Published: 2026-01-08T13:44:04.764Z
CVE-2025-14026 Vulnerable Python version used in Forcepoint One DLP Client
Forcepoint One DLP Client, version 23.04.5642 (and possibly newer versions), includes a restricted version of Python 2.5.4 that prevents use of the ctypes library. ctypes is a foreign function interface (FFI) for Python, enabling calls to DLLs/shared libraries, memory allocation, and direct code execution. It was demonstrated that these restrictions could be bypassed.
Problem types: description: CWE-1104 Use of Unmaintained Third-Party Components
description: CWE-1395 Dependency on a Vulnerable Third-Party Component
description: CWE-676 Use of Potentially Dangerous Function
Affected products: vendor: Forcepoint
product: Forcepoint One Endpoint (F1E)
Published: 2026-01-06T14:45:29.207Z
CVE-2025-14027 Rockwell Automation Recommends Upgrading From 1756-RM2 XT To 1756-RM3 XT
Multiple denial-of-service vulnerabilities exist in the affected product. These issues can be triggered through various crafted inputs, including malformed Class 3 messages, memory leak conditions, and other resource exhaustion scenarios. Exploitation may cause the device to become unresponsive and, in some cases, result in a major nonrecoverable fault. Recovery may require a restart.
Problem types: cwe_id: CWE-401
description: CWE-401 Missing Release of Memory after Effective Lifetime
Affected products: vendor: Rockwell Automation
product: ControlLogix® Redundancy Enhanced Module
default_status: unaffected
Published: 2026-01-20T13:56:43.694Z
CVE-2025-14028 Contact Us Simple Form <= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Settings
The Contact Us Simple Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: bruterdregz
product: Contact Us Simple Form
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N
baseScore: 4.4
baseSeverity: MEDIUM
Credits: lang: en
value: Bhumividh Treloges
Published: 2026-01-07T09:20:53.714Z
CVE-2025-14029 Community Events <= 1.5.6 - Missing Authorization to Unauthenticated Arbitrary Event Approval via 'eventlist' Parameter
The Community Events plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajax_admin_event_approval() function in all versions up to, and including, 1.5.6. This makes it possible for unauthenticated attackers to approve arbitrary events via the 'eventlist' parameter.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: jackdewey
product: Community Events
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
baseScore: 5.3
baseSeverity: MEDIUM
Credits: lang: en
value: Itthidej Aramsri
Published: 2026-01-17T04:34:00.530Z
CVE-2025-14030 AI Feeds <= 1.0.22 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'aife_post_meta' Shortcode
The AI Feeds plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'aife_post_meta' shortcode in all versions up to, and including, 1.0.22 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: soportecibeles
product: AI Feeds
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
baseScore: 6.4
baseSeverity: MEDIUM
Credits: lang: en
value: Athiwat Tiprasaharn
Published: 2025-12-12T11:15:51.633Z
CVE-2025-14031 IBM Sterling B2B Integrator and IBM Sterling File Gateway Denial of Service
IBM Sterling B2B Integrator and and IBM Sterling File Gateway 6.1.0.0 through 6.1.2.7_2, 6.2.0.0 through 6.2.0.5_1, 6.2.1.0 through 6.2.1.1_1, and 6.2.2.0 could allow an unauthenticated attacker to send a specially crafted request that causes the application to crash.
Problem types: cwe_id: CWE-77
description: CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')
Affected products: vendor: IBM
product: Sterling B2B Integrator
cpes: cpe:2.3:a:ibm:sterling_b2b_integrator:6.1.0.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:sterling_b2b_integrator:6.1.2.7_2:*:*:*:*:*:*:*
cpe:2.3:a:ibm:sterling_b2b_integrator:6.2.0.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:sterling_b2b_integrator:6.2.0.5_1:*:*:*:*:*:*:*
cpe:2.3:a:ibm:sterling_b2b_integrator:6.2.1.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:sterling_b2b_integrator:6.2.1.1_1:*:*:*:*:*:*:*
cpe:2.3:a:ibm:sterling_b2b_integrator:6.2.2.0:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
baseSeverity: HIGH
baseScore: 7.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Published: 2026-03-17T22:41:41.536Z
CVE-2025-14032 Bold Timeline Lite <= 1.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'title' Parameter in 'bold_timeline_group' Shortcode
The Bold Timeline Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'title' parameter in the 'bold_timeline_group' shortcode in all versions up to, and including, 1.2.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: boldthemes
product: Bold Timeline Lite
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
baseScore: 6.4
baseSeverity: MEDIUM
Credits: lang: en
value: Djaidja Moundjid
Published: 2025-12-12T03:20:49.986Z
CVE-2025-14033 ilGhera Support System for WooCommerce <= 1.3.0 - Missing Authorization to Unauthenticated Sensitive Information Exposure
The ilGhera Support System for WooCommerce plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'get_ticket_content_callback' function in all versions up to, and including, 1.3.0. This makes it possible for unauthenticated attackers to view any support ticket content, including sensitive customer information and private communications, by providing a ticket ID.
Problem types: cwe_id: CWE-639
description: CWE-639 Authorization Bypass Through User-Controlled Key
Affected products: vendor: ghera74
product: ilGhera Support System for WooCommerce
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
baseScore: 5.3
baseSeverity: MEDIUM
Credits: lang: en
value: Md. Moniruzzaman Prodhan
Published: 2026-05-13T05:29:36.689Z
CVE-2025-14034 ilGhera Support System for WooCommerce <= 1.2.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Ticket Deletion
The ilGhera Support System for WooCommerce plugin for WordPress is vulnerable to unauthorized modification and loss of data due to a missing capability check on the 'delete_single_ticket_callback' and 'change_ticket_status_callback' functions in all versions up to, and including, 1.2.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary support tickets and modify their status.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: ghera74
product: ilGhera Support System for WooCommerce
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
baseScore: 5.3
baseSeverity: MEDIUM
Credits: lang: en
value: Md. Moniruzzaman Prodhan
Published: 2026-01-06T03:21:40.731Z
CVE-2025-14035 DebateMaster <= 1.0.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via Color Options via 'debate' Shortcode
The DebateMaster plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the color options in the plugin settings in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses a page with the debate shortcode. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: jeremybmerrill
product: DebateMaster
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N
baseScore: 4.4
baseSeverity: MEDIUM
Credits: lang: en
value: Camilla Flocco
Published: 2025-12-12T03:20:52.347Z
CVE-2025-14037 Invelity Products Feeds <= 1.2.6 - Cross-Site Request Forgery to Arbitrary File Deletion
The Invelity Product Feeds plugin for WordPress is vulnerable to arbitrary file deletion via path traversal in all versions up to, and including, 1.2.6. This is due to missing validation and sanitization in the 'createManageFeedPage' function. This makes it possible for authenticated administrator-level attackers to delete arbitrary files on the server via specially crafted requests that include path traversal sequences, granted they can trick an admin into clicking a malicious link.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: invelity
product: Invelity Product Feeds
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:N/I:H/A:H
baseScore: 8.1
baseSeverity: HIGH
Credits: lang: en
value: Muhammad Yudha - DJ
Published: 2026-03-21T03:26:55.620Z
CVE-2025-14038 
EDB Hybrid Manager contains a flaw that allows an unauthenticated attacker to directly access certain gRPC endpoints. This could allow an attacker to read potentially sensitive data or possibly cause a denial-of-service by writing malformed data to certain gRPC endpoints. This flaw has been remediated in EDB Hybrid Manager 1.3.3, and customers should consider upgrading to 1.3.3 as soon as possible.
The flaw is due to a misconfiguration in the Istio Gateway, which manages authentication and authorization for the affected endpoints. The security policy relies on an explicit definition of required permissions in the Istio Gateway configuration, and the affected endpoints were not defined in the configuration. This allowed requests to bypass both authentication and authorization within a Hybrid Manager service.
All versions of Hybrid Manager - LTS should be upgraded to 1.3.3, and all versions of Hybrid Manager - Innovation should be upgraded to 2025.12.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
cwe_id: CWE-306
description: CWE-306 Missing Authentication for Critical Function
Affected products: vendor: EnterpriseDB
product: Hybrid Manager - LTS
default_status: affected
vendor: EnterpriseDB
product: Hybrid Manager - Innovation
default_status: affected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: HIGH
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: HIGH
baseScore: 7
baseSeverity: HIGH
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H
Published: 2025-12-15T18:02:01.294Z
CVE-2025-14039 Simple Folio <= 1.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'Client name' and 'Link' Meta Fields
The Simple Folio plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '_simple_folio_item_client_name' and '_simple_folio_item_link' meta fields in all versions up to, and including, 1.1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: presstigers
product: Simple Folio
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
baseScore: 6.4
baseSeverity: MEDIUM
Credits: lang: en
value: Athiwat Tiprasaharn
Published: 2026-01-28T06:43:44.697Z