rainbutterfly/cve_corpus huggingface dataset:
CVE-2025-11147 Reflected Cross-site scripting (XSS) vulnerability in Apt-Cacher-NG
Reflected cross-site scripting (XSS) in Apt-Cacher-NG v3.2.1. The vulnerability allows malicious scripts (XSS) to be executed in “/html/<filename>.html”.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: Apt-Cacher-NG
product: Apt-Cacher-NG
default_status: unaffected
Credits: lang: en
value: Pablo Lago Romaní
Published: 2025-09-29T09:26:48.244Z
CVE-2025-11148 
All versions of the package check-branches are vulnerable to Command Injection check-branches is a command-line tool that is interacted with locally, or via CI, to confirm no conflicts exist in git branches.However, the library follows these conventions which can be abused:1. It trusts branch names as they are (plain text)2. It spawns git commands by concatenating user inputSince a branch name is potentially a user input - as users can create branches remotely via pull requests, or simply due to privileged access to a repository - it can effectively be abused to run any command.
Problem types: cwe_id: CWE-78
description: Command Injection
Affected products: vendor: n/a
product: check-branches
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
exploitCodeMaturity: NOT_DEFINED
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Credits: lang: en
value: Liran Tal
Published: 2025-09-30T05:00:06.332Z
CVE-2025-11149 
This affects all versions of the package node-static; all versions of the package @nubosoftware/node-static. The package fails to catch an exception when user input includes null bytes. This allows attackers to access http://host/%00 and crash the server.
Problem types: cwe_id: CWE-400
description: Denial of Service (DoS)
Affected products: vendor: n/a
product: node-static
vendor: n/a
product: @nubosoftware/node-static
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
exploitCodeMaturity: PROOF_OF_CONCEPT
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:R
Credits: lang: en
value: Unknown
Published: 2025-09-30T05:00:07.700Z
CVE-2025-11151 Information Disclosure in Beyaz Computer's CityPLus
Exposure of Sensitive Information to an Unauthorized Actor, Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Beyaz Bilgisayar Software Design Industry and Trade Ltd. Co. CityPLus allows Detect Unpublicized Web Pages.

This issue affects CityPLus: before V24.29500.1.0.
Problem types: cwe_id: CWE-200
description: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
cwe_id: CWE-497
description: CWE-497 Exposure of Sensitive System Information to an Unauthorized Control Sphere
Affected products: vendor: Beyaz Bilgisayar Software Design Industry and Trade Ltd. Co.
product: CityPLus
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: LOW
availabilityImpact: NONE
baseSeverity: HIGH
baseScore: 8.2
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Credits: lang: en
value: Aleyna KABAL
Published: 2025-10-21T13:15:39.524Z
CVE-2025-11152 Sandbox escape due to integer overflow in the Graphics: Canvas2D component
Sandbox escape due to integer overflow in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 143.0.3.
Affected products: vendor: Mozilla
product: Firefox
Credits: lang: en
value: Oskar L
Published: 2025-09-30T12:49:05.895Z
CVE-2025-11153 JIT miscompilation in the JavaScript Engine: JIT component
JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 143.0.3.
Affected products: vendor: Mozilla
product: Firefox
Credits: lang: en
value: Nan Wang
Published: 2025-09-30T12:49:06.524Z
CVE-2025-11154 IDonate < 2.1.13 - Unauthenticated User Deletion
The IDonate  WordPress plugin before 2.1.13 does not have authorisation and CSRF when deleting users via an action handler, allowing unauthenticated attackers to delete arbitrary users.
Problem types: description: CWE-862 Missing Authorization
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Unknown
product: IDonate
default_status: unaffected
Credits: lang: en
value: Khaled Alenazi (Nxploited)
lang: en
value: WPScan
Published: 2025-10-27T06:00:01.632Z
CVE-2025-11155 WEAK ENCODING FOR PASSWORD IN DEVICE SERVER CONFIGURATION
The credentials required to access the device's web server are sent in base64 within the HTTP headers. Since base64 is not considered a strong cipher, an attacker could intercept the web request handling the login and obtain the credentials.
Problem types: cwe_id: CWE-261
description: CWE-261: Weak Encoding for Password
Affected products: vendor: SATO
product: S86-ex 203dpi
default_status: unknown
Credits: lang: en
value: Víctor Bello Cuevas
lang: en
value: Aarón Flecha Menéndez
lang: en
value: Iván Alonso Álvarez
Published: 2025-09-29T15:14:39.779Z
CVE-2025-11156 Improper Service Loading Vulnerability in Netskope Endpoint DLP Driver
Netskope was notified about a potential gap in its agent (NS Client) on Windows systems.  If this gap is successfully exploited, a local, authenticated user with Administrator privileges can improperly load the driver as a generic kernel service. This triggers the flaw, causing a system crash (Blue-Screen-of-Death) and resulting in a Denial of Service (DoS) for the affected machine.
Problem types: cwe_id: CWE-476
description: CWE-476 NULL Pointer Dereference
Affected products: vendor: Netskope
product: Netskope Client
default_status: unaffected
Credits: lang: en
value: Ahmad Abdillah bin Zaini
Published: 2025-11-28T14:26:08.235Z
CVE-2025-11157 Arbitrary Code Execution in feast-dev/feast
A high-severity remote code execution vulnerability exists in feast-dev/feast version 0.53.0, specifically in the Kubernetes materializer job located at `feast/sdk/python/feast/infra/compute_engines/kubernetes/main.py`. The vulnerability arises from the use of `yaml.load(..., Loader=yaml.Loader)` to deserialize `/var/feast/feature_store.yaml` and `/var/feast/materialization_config.yaml`. This method allows for the instantiation of arbitrary Python objects, enabling an attacker with the ability to modify these YAML files to execute OS commands on the worker pod. This vulnerability can be exploited before the configuration is validated, potentially leading to cluster takeover, data poisoning, and supply-chain sabotage.
Problem types: cwe_id: CWE-502
description: CWE-502 Deserialization of Untrusted Data
Affected products: vendor: feast-dev
product: feast-dev/feast
Published: 2026-01-01T07:03:57.277Z
CVE-2025-11158 Hitachi Vantara Pentaho Data Integration & Analytics - Missing Authorization
Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.2.0.6, including 9.3.x and 8.3.x, do not restrict Groovy scripts in new PRPT reports published by users, allowing insertion of arbitrary scripts and leading to a RCE.
Problem types: cwe_id: CWE-862
description: CWE-862: Missing Authorization
Affected products: vendor: Hitachi Vantara
product: Pentaho Data Integration and Analytics
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseSeverity: CRITICAL
baseScore: 9.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Credits: lang: en
value: Nir Zadok (nirza) and Moshe Siman Tov Bustan from OX Security
Published: 2026-03-09T22:12:51.587Z
CVE-2025-11159 Hitachi Vantara Pentaho Data Integration & Analytics - Dependency on Vulnerable Third-Party  Component
Hitachi Vantara Pentaho Data Integration & Analytics of all versions contain a JDBC driver for H2 databases which is vulnerable to external script execution when a new connection is created by a data source administrator.
Problem types: cwe_id: CWE-1395
description: CWE-1395: Dependency on Vulnerable Third-Party Component
Affected products: vendor: Hitachi Vantara
product: Pentaho Data Integration and Analytics
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseSeverity: CRITICAL
baseScore: 9.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Credits: lang: en
value: Nir Zadok (nirza) and Moshe Siman Tov Bustan  from OX Security
Published: 2026-05-13T05:36:43.720Z
CVE-2025-11160 WPBakery Page Builder <= 8.6.1 - Stored Cross-Site Scripting via Custom JS Module
The WPBakery Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Custom JS module in all versions up to, and including, 8.6.1. This is due to insufficient input sanitization and output escaping of user-supplied JavaScript code in the Custom JS module. This makes it possible for authenticated attackers with contributor-level access or higher to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page via the WPBakery Page Builder Custom JS module granted they have access to the WPBakery editor for post types.
Problem types: cwe_id: CWE-80
description: CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
Affected products: vendor: wpbakery
product: WPBakery Page Builder
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
baseScore: 6.4
baseSeverity: MEDIUM
Credits: lang: en
value: Muhammad Yudha - DJ
Published: 2025-10-15T06:43:56.953Z
CVE-2025-11161 WPBakery Page Builder <= 8.6.1 - Stored Cross-Site Scripting via vc_custom_heading Shortcode
The WPBakery Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the vc_custom_heading shortcode in all versions up to, and including, 8.6.1. This is due to insufficient restriction of allowed HTML tags and improper sanitization of user-supplied attributes in the font_container parameter. This makes it possible for authenticated attackers with contributor-level access or higher to inject arbitrary web scripts in posts that will execute whenever a user accesses an injected page via the vc_custom_heading shortcode with malicious tag and text attributes granted they have access to use WPBakery shortcodes.
Problem types: cwe_id: CWE-80
description: CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
Affected products: vendor: wpbakery
product: WPBakery Page Builder
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
baseScore: 6.4
baseSeverity: MEDIUM
Credits: lang: en
value: Muhammad Yudha - DJ
Published: 2025-10-15T06:43:56.365Z
CVE-2025-11162 Spectra <= 2.19.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom CSS
The Spectra Gutenberg Blocks – Website Builder for the Block Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Custom CSS in all versions up to, and including, 2.19.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: brainstormforce
product: Spectra Gutenberg Blocks – Website Builder for the Block Editor
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
baseScore: 6.4
baseSeverity: MEDIUM
Credits: lang: en
value: Muhammad Yudha - DJ
Published: 2025-11-05T04:36:58.130Z
CVE-2025-11163 SmartCrawl SEO checker, analyzer & optimizer <= 3.14.3 - Missing Authorization to Plugin Settings Update
The SmartCrawl SEO checker, analyzer & optimizer plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the update_submodule() function in all versions up to, and including, 3.14.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update the plugin's setttings.
Problem types: cwe_id: CWE-284
description: CWE-284 Improper Access Control
Affected products: vendor: wpmudev
product: SmartCrawl SEO checker, analyzer & optimizer
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
baseScore: 4.3
baseSeverity: MEDIUM
Credits: lang: en
value: Rafshanzani Suhada
Published: 2025-09-30T05:28:53.152Z
CVE-2025-11164 Mavix Education <= 1.0 - Missing Authorization to Authenticated (Subscriber+) 'Creativ Demo Importer' Plugin Activation
The Mavix Education theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'mavix_education_activate_plugin' AJAX action in all versions up to, and including, 1.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to activate the Creativ Demo Importer plugin.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: creativthemes
product: Mavix Education
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
baseScore: 4.3
baseSeverity: MEDIUM
Credits: lang: en
value: Jonas Benjamin Friedli
Published: 2025-12-13T04:31:30.999Z
CVE-2025-11165 
A sandbox escape vulnerability exists in dotCMS’s Velocity scripting engine (VTools) that allows authenticated users with scripting privileges to bypass class and package restrictions enforced by SecureUberspectorImpl.

By dynamically modifying the Velocity engine’s runtime configuration and reinitializing its Uberspect, a malicious actor can remove the introspector.restrict.classes and introspector.restrict.packages protections.

Once these restrictions are cleared, the attacker can access arbitrary Java classes, including java.lang.Runtime, and execute arbitrary system commands under the privileges of the application process (e.g. dotCMS or Tomcat user).
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: dotCMS
product: dotCMS
default_status: unaffected
Published: 2026-02-24T08:27:07.579Z
CVE-2025-11166 WP Go Maps (formerly WP Google Maps) <= 9.0.46 - Cross-Site Request Forgery to Plugin Settings Update
The WP Go Maps (formerly WP Google Maps) plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) in all versions up to, and including, 9.0.46. This is due to the plugin exposing state-changing REST actions through an AJAX bridge without proper CSRF token validation, and having destructive logic reachable via GET requests with no permission_callback. This makes it possible for unauthenticated attackers to force logged-in administrators to create, update, or delete markers and geometry features via CSRF attacks, and allows anonymous users to trigger mass deletion of markers via unsafe GET requests.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: wpgmaps
product: WP Go Maps (formerly WP Google Maps)
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
baseScore: 5.4
baseSeverity: MEDIUM
Credits: lang: en
value: Dmitrii Ignatyev
Published: 2025-10-09T01:48:48.168Z
CVE-2025-11167 CM Registration – Tailored tool for seamless login and invitation-based registrations <= 2.5.6 - Open Redirect
The CM Registration – Tailored tool for seamless login and invitation-based registrations plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 2.5.6. This is due to insufficient validation on the redirect url supplied via the 'redirect_url' parameter. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites if they can successfully trick them into performing an action.
Problem types: cwe_id: CWE-601
description: CWE-601 URL Redirection to Untrusted Site ('Open Redirect')
Affected products: vendor: creativemindssolutions
product: CM Registration – Tailored tool for seamless login and invitation-based registrations
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N
baseScore: 4.7
baseSeverity: MEDIUM
Credits: lang: en
value: Jonas Benjamin Friedli
Published: 2025-10-11T08:29:17.346Z
CVE-2025-11168 Mementor Core <= 2.2.5 - Authenticated (Subscriber+) Privilege Escalation
The Mementor Core plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.2.5. This is due to plugin not properly handling the user switch back function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to elevate their privileges by accessing an administrator account through the switch back functionality.
Problem types: cwe_id: CWE-269
description: CWE-269 Improper Privilege Management
Affected products: vendor: mvirik
product: Mementor Core
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
baseScore: 8.8
baseSeverity: HIGH
Credits: lang: en
value: Youcef Hamdani
Published: 2025-11-11T03:30:33.945Z
CVE-2025-11170 WP移行専用プラグイン for CPI <= 1.0.2 - Unauthenticated Arbitrary File Upload
The WP移行専用プラグイン for CPI plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the Cpiwm_Import_Controller::import function in all versions up to, and including, 1.0.2. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
Problem types: cwe_id: CWE-434
description: CWE-434 Unrestricted Upload of File with Dangerous Type
Affected products: vendor: kddiwebcommunications
product: WP移行専用プラグイン for CPI
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
baseScore: 9.8
baseSeverity: CRITICAL
Credits: lang: en
value: Kenneth Dunn
Published: 2025-11-11T03:30:44.250Z
CVE-2025-11171 Chartify – WordPress Chart Plugin <= 3.5.9 - Missing Authentication for Administrative Function
The Chartify – WordPress Chart Plugin for WordPress is vulnerable to Missing Authentication for Critical Function in all versions up to, and including, 3.5.9. This is due to the plugin registering an unauthenticated AJAX action that dispatches to admin-class methods based on a request parameter, without any nonce or capability checks. This makes it possible for unauthenticated attackers to execute administrative functions via the wp-admin/admin-ajax.php endpoint granted they can identify callable method names.
Problem types: cwe_id: CWE-306
description: CWE-306 Missing Authentication for Critical Function
Affected products: vendor: ays-pro
product: Chartify – WordPress Chart Plugin
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
baseScore: 5.3
baseSeverity: MEDIUM
Credits: lang: en
value: Avraham Shemesh
lang: en
value: Kai Aizen
Published: 2025-10-08T05:24:49.497Z
CVE-2025-11172 Check Plagiarism <= 2.0 - Missing Authorization to Authenticated (Subscriber+) Settings Update
The Check Plagiarism plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the chk_plag_mine_plugin_wpse10500_admin_action() function in all versions up to, and including, 2.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update the API key.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: plagiarismchecker
product: Check Plagiarism
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
baseScore: 4.3
baseSeverity: MEDIUM
Credits: lang: en
value: Jonas Benjamin Friedli
Published: 2025-10-24T08:24:03.767Z
CVE-2025-11173 Reauth for enabling 2FA can be bypassed by submitting a form
Vulnerability in Wikimedia Foundation OATHAuth. This vulnerability is associated with program files src/Special/OATHManage.Php.

This issue affects OATHAuth: from * before 1.39.14, 1.43.4, 1.44.1.
Affected products: vendor: Wikimedia Foundation
product: OATHAuth
default_status: unaffected
Published: 2026-02-03T00:27:45.487Z
CVE-2025-11174 Document Library Lite <= 1.1.6 - Missing Authorization to Sensitive Information Exposure
The Document Library Lite plugin for WordPress is vulnerable to Improper Authorization in all versions up to, and including, 1.1.6. This is due to the plugin exposing an unauthenticated AJAX action dll_load_posts which returns a JSON table of document data without performing nonce or capability checks. The handler accepts an attacker-controlled args array where the status option explicitly allows draft, pending, future, and any. This makes it possible for unauthenticated attackers to retrieve unpublished document titles and content via the AJAX endpoint.
Problem types: cwe_id: CWE-285
description: CWE-285 Improper Authorization
Affected products: vendor: barn2media
product: Document Library Lite
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
baseScore: 5.3
baseSeverity: MEDIUM
Credits: lang: en
value: Avraham Shemesh
lang: en
value: Kai Aizen
Published: 2025-11-01T01:47:40.902Z
CVE-2025-11175 DiscussionTools should use better regex
Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection') vulnerability in The Wikimedia Foundation Mediawiki - DiscussionTools Extension allows Regular Expression Exponential Blowup.This issue affects Mediawiki - DiscussionTools Extension: 1.44, 1.43.
Problem types: cwe_id: CWE-917
description: CWE-917 Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')
Affected products: vendor: The Wikimedia Foundation
product: Mediawiki - DiscussionTools Extension
default_status: unaffected
Credits: lang: en
value: Matmarex
lang: en
value: Bartosz
Published: 2026-01-30T19:12:06.648Z
CVE-2025-11176 Quick Featured Images <= 13.7.2 - Insecure Direct Object Reference to Image Manipulation
The Quick Featured Images plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 13.7.2 via the qfi_set_thumbnail and qfi_delete_thumbnail AJAX actions due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Author-level access and above, to change or remove featured images of other user's posts.
Problem types: cwe_id: CWE-639
description: CWE-639 Authorization Bypass Through User-Controlled Key
Affected products: vendor: kybernetikservices
product: Quick Featured Images
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
baseScore: 4.3
baseSeverity: MEDIUM
Credits: lang: en
value: Lucas Montes
Published: 2025-10-15T05:23:48.130Z