rainbutterfly/cve_corpus huggingface dataset:
CVE-2025-28168 
The Multiple File Upload add-on component 3.1.0 for OutSystems is vulnerable to Unrestricted File Upload. This occurs because file extension and size validations are enforced solely on the client side. An attacker can intercept the upload request and modify a parameter to bypass extension restrictions and upload arbitrary files. NOTE: this is a third-party component that is not supplied or supported by OutSystems.
Problem types: cwe_id: CWE-602
description: CWE-602 Client-Side Enforcement of Server-Side Security
Affected products: vendor: Multi Uploaders
product: Multiple File Upload
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 6.4
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Published: 2025-05-05T00:00:00.000Z
CVE-2025-28169 
BYD QIN PLUS DM-i Dilink OS v3.0_13.1.7.2204050.1 to v3.0_13.1.7.2312290.1_0 was discovered to cend broadcasts to the manufacturer's cloud server unencrypted, allowing attackers to execute a man-in-the-middle attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-04-23T00:00:00.000Z
CVE-2025-28170 
Grandstream Networks GXP1628 <=1.0.4.130 is vulnerable to Incorrect Access Control. The device is configured with directory listing enabled, allowing unauthorized access to sensitive directories and files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-07-29T00:00:00.000Z
CVE-2025-28171 
An issue in Grandstream UCM6510 v.1.0.20.52 and before allows a remote attacker to obtain sensitive information via the Login function at /cgi and /webrtccgi.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-07-29T00:00:00.000Z
CVE-2025-28172 
Grandstream Networks UCM6510 v1.0.20.52 and before is vulnerable to Improper Restriction of Excessive Authentication Attempts. An attacker can perform an arbitrary number of authentication attempts using different passwords and eventually gain access to the targeted account using a brute force attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-07-29T00:00:00.000Z
CVE-2025-28197 
Crawl4AI <=0.4.247 is vulnerable to SSRF in /crawl4ai/async_dispatcher.py.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-04-18T00:00:00.000Z
CVE-2025-28198 
A SQL injection vulnerability in Hitout car sale 1.0 allows a remote attacker to obtain sensitive information via the orderBy parameter of the StoreController.java component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-04-15T00:00:00.000Z
CVE-2025-28200 
Victure RX1800 EN_V1.0.0_r12_110933 was discovered to utilize a weak default password which includes the last 8 digits of the Mac address.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-05-09T00:00:00.000Z
CVE-2025-28201 
An issue in Victure RX1800 EN_V1.0.0_r12_110933 allows physically proximate attackers to execute arbitrary code or gain root access.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-05-09T00:00:00.000Z
CVE-2025-28202 
Incorrect access control in Victure RX1800 EN_V1.0.0_r12_110933 allows attackers to enable SSH and Telnet services without authentication.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-05-09T00:00:00.000Z
CVE-2025-28203 
Victure RX1800 EN_V1.0.0_r12_110933 was discovered to contain a command injection vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-05-09T00:00:00.000Z
CVE-2025-28219 
Netgear DC112A V1.0.0.64 has an OS command injection vulnerability in the usb_adv.cgi, which allows remote attackers to execute arbitrary commands via parameter "deviceName" passed to the binary through a POST request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-28T00:00:00.000Z
CVE-2025-28220 
Tenda W6_S v1.0.0.4_510 has a Buffer Overflow vulnerability in the setcfm function, which allows remote attackers to cause web server crash via parameter funcpara1 passed to the binary through a POST request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-28T00:00:00.000Z
CVE-2025-28221 
Tenda W6_S v1.0.0.4_510 has a Buffer Overflow vulnerability in the set_local_time function, which allows remote attackers to cause web server crash via parameter time passed to the binary through a POST request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-28T00:00:00.000Z
CVE-2025-28228 
A credential exposure vulnerability in Electrolink 500W, 1kW, 2kW Medium DAB Transmitter Web v01.09, v01.08, v01.07, and Display v1.4, v1.2 allows unauthorized attackers to access credentials in plaintext.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-04-18T00:00:00.000Z
CVE-2025-28229 
Incorrect access control in Orban OPTIMOD 5950 Firmware v1.0.0.2 and System v2.2.15 allows attackers to bypass authentication and gain Administrator privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-04-18T00:00:00.000Z
CVE-2025-28230 
Incorrect access control in JMBroadcast JMB0150 Firmware v1.0 allows attackers to access hardcoded administrator credentials.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-04-18T00:00:00.000Z
CVE-2025-28231 
Incorrect access control in Itel Electronics IP Stream v1.7.0.6 allows unauthorized attackers to execute arbitrary commands with Administrator privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-04-18T00:00:00.000Z
CVE-2025-28232 
Incorrect access control in the HOME.php endpoint of JMBroadcast JMB0150 Firmware v1.0 allows attackers to access the Admin panel without authentication.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-04-18T00:00:00.000Z
CVE-2025-28233 
Incorrect access control in BW Broadcast TX600 (14980), TX300 (32990) (31448), TX150, TX1000, TX30, and TX50 Hardware Version: 2, Software Version: 1.6.0, Control Version: 1.0, AIO Firmware Version: 1.7 allows attackers to access log files and extract session identifiers to execute a session hijacking attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-04-18T00:00:00.000Z
CVE-2025-28235 
An information disclosure vulnerability in the component /socket.io/1/websocket/ of Soundcraft Ui Series Model(s) Ui12 and Ui16 Firmware v1.0.7x and v1.0.5x allows attackers to access Administrator credentials in plaintext.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-04-18T00:00:00.000Z
CVE-2025-28236 
Nautel VX Series transmitters VX SW v6.4.0 and below was discovered to contain a remote code execution (RCE) vulnerability in the firmware update process. This vulnerability allows attackers to execute arbitrary code via supplying a crafted update package to the /#/software/upgrades endpoint.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-04-18T00:00:00.000Z
CVE-2025-28237 
An issue in WorldCast Systems ECRESO FM/DAB/TV Transmitter v1.10.1 allows authenticated attackers to escalate privileges via a crafted JSON payload.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-04-18T00:00:00.000Z
CVE-2025-28238 
Improper session management in Elber REBLE310 Firmware v5.5.1.R , Equipment Model: REBLE310/RX10/4ASI allows attackers to execute a session hijacking attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-04-18T00:00:00.000Z
CVE-2025-28242 
Improper session management in the /login_ok.htm endpoint of DAEnetIP4 METO v1.25 allows attackers to execute a session hijacking attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-04-18T00:00:00.000Z
CVE-2025-28243 
An issue in Alteryx Server v.2023.1.1.460 allows HTML injection via a crafted script to the pages component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-07-10T00:00:00.000Z
CVE-2025-28244 
Insecure Permissions vulnerability in the Local Storage in Alteryx Server 2023.1.1.460 allows remote attackers to obtain valid user session tokens from localStorage, leading to account takeover
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-07-10T00:00:00.000Z
CVE-2025-28245 
Cross-site scripting (XSS) vulnerability in Alteryx Server 2023.1.1.460 allows remote attackers to inject arbitrary web script or HTML via the notification body.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-07-10T00:00:00.000Z
CVE-2025-28254 
Cross Site Scripting vulnerability in Leantime v3.2.1 and before allows an authenticated attacker to execute arbitrary code and obtain sensitive information via the first name field in processMentions().
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-28T00:00:00.000Z
CVE-2025-28256 
An issue in TOTOLINK A3100R V4.1.2cu.5247_B20211129 allows a remote attacker to execute arbitrary code via the setWebWlanIdx of the file /lib/cste_modules/wireless.so.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-28T00:00:00.000Z
CVE-2025-28343 
striso-control-firmware 54c9722 is vulnerable to Buffer Overflow in function ThreadReadButtons.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-05-13T00:00:00.000Z
CVE-2025-28344 
striso-control-firmware 54c9722 is vulnerable to Buffer Overflow in function AuxJack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-05-13T00:00:00.000Z
CVE-2025-28354 
An issue in the Printer Manager Systm of Entrust Corp Printer Manager D3.18.4-3 and below allows attackers to execute a directory traversal via a crafted POST request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-04-25T00:00:00.000Z
CVE-2025-28355 
Volmarg Personal Management System 1.4.65 is vulnerable to Cross Site Request Forgery (CSRF) allowing attackers to execute arbitrary code and obtain sensitive information via the SameSite cookie attribute defaults value set to none
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-04-18T00:00:00.000Z
CVE-2025-28357 
A CRLF injection vulnerability in Neto CMS v6.313.0 through v6.314.0 allows attackers to execute arbitrary code via supplying a crafted HTTP request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-10-01T00:00:00.000Z
CVE-2025-28361 
Unauthorized stack overflow vulnerability in Telesquare TLR-2005KSH v.1.1.4 allows a remote attacker to obtain sensitive information via the systemutil.cgi component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-26T00:00:00.000Z
CVE-2025-28367 
mojoPortal <=2.9.0.1 is vulnerable to Directory Traversal via BetterImageGallery API Controller - ImageHandler Action. An attacker can exploit this vulnerability to access the Web.Config file and obtain the MachineKey.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-04-21T00:00:00.000Z
CVE-2025-28371 
EnGenius ENH500 AP 2T2R V3.0 FW3.7.22 is vulnerable to Incorrect Access Control via the password change function. The device fails to validate the current password, allowing an attacker to submit a password change request with an invalid current password and set a new password.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-05-19T00:00:00.000Z
CVE-2025-28380 
A cross-site scripting (XSS) vulnerability in OpenC3 COSMOS before v6.0.2 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the URL parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-06-13T00:00:00.000Z
CVE-2025-28381 
A credential leak in OpenC3 COSMOS before v6.0.2 allows attackers to access service credentials as environment variables stored in all containers.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-06-13T00:00:00.000Z
CVE-2025-28382 
An issue in the openc3-api/tables endpoint of OpenC3 COSMOS before 6.1.0 allows attackers to execute a directory traversal.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-06-13T00:00:00.000Z
CVE-2025-28384 
An issue in the /script-api/scripts/ endpoint of OpenC3 COSMOS before 6.1.0 allows attackers to execute a directory traversal.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-06-13T00:00:00.000Z
CVE-2025-28386 
A remote code execution (RCE) vulnerability in the Plugin Management component of OpenC3 COSMOS v6.0.0 allows attackers to execute arbitrary code via uploading a crafted .txt file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-06-13T00:00:00.000Z
CVE-2025-28388 
OpenC3 COSMOS before v6.0.2 was discovered to contain hardcoded credentials for the Service Account.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-06-13T00:00:00.000Z
CVE-2025-28389 
Weak password requirements in OpenC3 COSMOS v6.0.0 allow attackers to bypass authentication via a brute force attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-06-13T00:00:00.000Z
CVE-2025-28395 
D-LINK DI-8100 16.07.26A1 is vulnerable to Buffer Overflow in the ipsec_road_asp function via the host_ip parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-04-01T00:00:00.000Z
CVE-2025-28398 
D-LINK DI-8100 16.07.26A1 is vulnerable to Buffer Overflow in the ipsec_net_asp function via the remot_ip parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-04-01T00:00:00.000Z
CVE-2025-28399 
An issue in Erick xmall v.1.1 and before allows a remote attacker to escalate privileges via the updateAddress method of the Address Controller class.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-04-15T00:00:00.000Z
CVE-2025-28400 
An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the postID parameter in the edit method
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-04-07T00:00:00.000Z
CVE-2025-28401 
An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the menuId parameter
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-04-07T00:00:00.000Z
CVE-2025-28402 
An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the jobId parameter
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-04-07T00:00:00.000Z
CVE-2025-28403 
An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the editSave method does not properly validate whether the requesting user has administrative privileges before allowing modifications to system configuration settings
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-04-07T00:00:00.000Z
CVE-2025-28405 
An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the changeStatus method
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-04-07T00:00:00.000Z
CVE-2025-28406 
An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the jobLogId parameter
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-04-07T00:00:00.000Z
CVE-2025-28407 
An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the edit method of the /edit/{dictId} endpoint does not properly validate whether the requesting user has permission to modify the specified dictId
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-04-07T00:00:00.000Z
CVE-2025-28408 
An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the selectDeptTree method of the /selectDeptTree/{deptId} endpoint does not properly validate the deptId parameter
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-04-07T00:00:00.000Z
CVE-2025-28409 
An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the add method of the /add/{parentId} endpoint does not properly validate whether the requesting user has permission to add a menu item under the specified parentId
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-04-07T00:00:00.000Z
CVE-2025-28410 
An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the cancelAuthUserAll method does not properly validate whether the requesting user has administrative privileges
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-04-07T00:00:00.000Z
CVE-2025-28411 
An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the editSave method in /tool/gen/editSave
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-04-07T00:00:00.000Z
CVE-2025-28412 
An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the /editSave method in SysNoticeController
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-04-07T00:00:00.000Z
CVE-2025-28413 
An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the SysDictTypeController component
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-04-07T00:00:00.000Z
CVE-2025-28855 WordPress Teleport plugin <= 1.2.4 - Reflected Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in srcoley Teleport teleport allows Reflected XSS.This issue affects Teleport: from n/a through <= 1.2.4.
Problem types: cwe_id: CWE-79
description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: srcoley
product: Teleport
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 7.1
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: Abdi Pranata | Patchstack Bug Bounty Program
Published: 2025-03-26T14:24:21.408Z
CVE-2025-28856 WordPress W3Counter Free Real-Time Web Stats plugin <= 4.1 - Cross Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in dangrossman W3Counter Free Real-Time Web Stats blog-stats-by-w3counter allows Cross Site Request Forgery.This issue affects W3Counter Free Real-Time Web Stats: from n/a through <= 4.1.
Problem types: cwe_id: CWE-352
description: Cross-Site Request Forgery (CSRF)
Affected products: vendor: dangrossman
product: W3Counter Free Real-Time Web Stats
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
version: 3.1
Credits: lang: en
value: Skalucy | Patchstack Bug Bounty Program
Published: 2025-03-11T21:00:30.006Z
CVE-2025-28857 WordPress Rankchecker.io Integration plugin <= 1.0.9 - CSRF to Stored Cross Site Scripting (XSS) vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in rankchecker Rankchecker.io Integration rankchecker-io-integration allows Stored XSS.This issue affects Rankchecker.io Integration: from n/a through <= 1.0.9.
Problem types: cwe_id: CWE-352
description: Cross-Site Request Forgery (CSRF)
Affected products: vendor: rankchecker
product: Rankchecker.io Integration
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 7.1
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: Skalucy | Patchstack Bug Bounty Program
Published: 2025-03-11T21:00:30.828Z
CVE-2025-28858 WordPress Arrow Maps plugin <= 1.0.9 - Reflected Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Arrow Plugins Arrow Maps ap-google-maps allows Reflected XSS.This issue affects Arrow Maps: from n/a through <= 1.0.9.
Problem types: cwe_id: CWE-79
description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Arrow Plugins
product: Arrow Maps
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 7.1
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: Abdi Pranata | Patchstack Bug Bounty Program
Published: 2025-03-26T14:24:21.625Z
CVE-2025-28859 WordPress Maintenance Notice plugin <= 1.0.6 - Cross Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in CodeVibrant Maintenance Notice maintenance-notice allows Cross Site Request Forgery.This issue affects Maintenance Notice: from n/a through <= 1.0.6.
Problem types: cwe_id: CWE-352
description: Cross-Site Request Forgery (CSRF)
Affected products: vendor: CodeVibrant
product: Maintenance Notice
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
version: 3.1
Credits: lang: en
value: Skalucy | Patchstack Bug Bounty Program
Published: 2025-03-11T21:00:31.578Z
CVE-2025-28860 WordPress Google News Editors Picks Feed Generator plugin <= 2.1 - CSRF to Stored XSS vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in PPDPurveyor Google News Editors Picks Feed Generator google-news-editors-picks-news-feeds allows Stored XSS.This issue affects Google News Editors Picks Feed Generator: from n/a through <= 2.1.
Problem types: cwe_id: CWE-352
description: Cross-Site Request Forgery (CSRF)
Affected products: vendor: PPDPurveyor
product: Google News Editors Picks Feed Generator
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 7.1
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: Abdi Pranata | Patchstack Bug Bounty Program
Published: 2025-03-11T21:00:32.290Z