rainbutterfly/cve_corpus huggingface dataset:
CVE-2025-27247 Pasteboard has an improper preservation of permissions vulnerability
in OpenHarmony v5.0.3 and prior versions allow a local attacker cause information leak through get permission.
Problem types: cwe_id: CWE-281
description: CWE-281 Improper Preservation of Permissions
Affected products: vendor: OpenHarmony
product: OpenHarmony
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 5.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Published: 2025-06-08T11:47:25.245Z
CVE-2025-27248 ai_neural_network_runtime has a NULL pointer dereference vulnerability
in OpenHarmony v5.0.3 and prior versions allow a local attacker case DOS through NULL pointer dereference.
Problem types: cwe_id: CWE-476
description: CWE-476 NULL Pointer Dereference
Affected products: vendor: OpenHarmony
product: OpenHarmony
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: LOW
baseScore: 3.3
baseSeverity: LOW
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
version: 3.1
Published: 2025-05-06T09:03:26.206Z
CVE-2025-27249 
Uncontrolled resource consumption for some Gaudi software before version 1.21.0 within Ring 3: User Applications may allow a denial of service. System software adversary with an authenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (none) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.
Problem types: description: Denial of Service
cwe_id: CWE-400
description: Uncontrolled Resource Consumption
Affected products: vendor: n/a
product: Gaudi software
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 5.5
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
Published: 2025-11-11T16:50:20.767Z
CVE-2025-27250 
Uncontrolled resource consumption for some Edge Orchestrator software before version 24.11.1 for Intel(R) Tiber(TM) Edge Platform may allow an authenticated user to potentially enable denial of service via adjacent access.
Problem types: description: Denial of Service
cwe_id: CWE-400
description: Uncontrolled Resource Consumption
Affected products: vendor: n/a
product: Edge Orchestrator software
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 3.5
baseSeverity: LOW
vectorString: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
attackVector: ADJACENT_NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: LOW
Published: 2025-08-12T16:59:26.966Z
CVE-2025-27253 
A CWE-15 "External Control of System or Configuration Setting" in GE Vernova UR IED family devices from version 7.0 up to 8.60 allows an attacker to provide input that establishes a TCP connection through a port forwarding. The lack of the IP address and port validation may allow the attacker to bypass firewall rules or to send malicious traffic in the network.
Problem types: cwe_id: CWE-15
description: CWE-15 External Control of System or Configuration Setting
Affected products: vendor: GE Vernova
product: N60 multilin
default_status: unaffected
vendor: GE Vernova
product: B30 Multilin
default_status: unaffected
vendor: GE Vernova
product: B90 Multilin
default_status: unaffected
vendor: GE Vernova
product: C30 Multilin
default_status: unaffected
vendor: GE Vernova
product: C60 Multilin
default_status: unaffected
vendor: GE Vernova
product: C70 Multilin
default_status: unaffected
vendor: GE Vernova
product: C95 Multilin
default_status: unaffected
vendor: GE Vernova
product: D30 Multilin
default_status: unaffected
vendor: GE Vernova
product: D60 Multilin
default_status: unaffected
vendor: GE Vernova
product: F35 Multilin
default_status: unaffected
vendor: GE Vernova
product: F60 Multilin
default_status: unaffected
vendor: GE Vernova
product: G30 Multilin
default_status: unaffected
vendor: GE Vernova
product: G60 Multilin
default_status: unaffected
vendor: GE Vernova
product: L30 Multilin
default_status: unaffected
vendor: GE Vernova
product: L60 Multilin
default_status: unaffected
vendor: GE Vernova
product: L90 Multilin
default_status: unaffected
vendor: GE Vernova
product: M60 Multilin
default_status: unaffected
vendor: GE Vernova
product: T35 Multilin
default_status: unaffected
vendor: GE Vernova
product: T60 Multilin
default_status: unaffected
vendor: GE Vernova
product: M60 Multilin
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: LOW
baseScore: 6.1
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:L
version: 3.1
Published: 2025-03-10T09:04:34.413Z
CVE-2025-27254 
CWE-282 "Improper Ownership Management" in GE Vernova EnerVista UR Setup allows Authentication Bypass. 
The software's startup authentication can be disabled by altering a Windows registry setting that any user can modify.
Problem types: cwe_id: CWE-282
description: CWE-282 Improper Ownership Management
Affected products: vendor: GE Vernova
product: EnerVista UR Setup
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 8
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H
version: 3.1
Published: 2025-03-10T09:05:08.963Z
CVE-2025-27255 
Use of Hard-coded Credentials vulnerability in GE Vernova EnerVista UR Setup allows Privilege Escalation. The local user database is encrypted using an hardcoded password retrievable by an attacker analyzing the application code.
Problem types: cwe_id: CWE-798
description: CWE-798 Use of Hard-coded Credentials
Affected products: vendor: GE Vernova
product: EnerVista UR Setup
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 8
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H
version: 3.1
Published: 2025-03-10T09:05:17.222Z
CVE-2025-27256 
Missing Authentication for Critical Function vulnerability in GE Vernova Enervista UR Setup application allows Authentication Bypass due to a missing SSH server authentication. Since the client connection is not authenticated, an attacker may perform a man-in-the-middle attack on the network.
Problem types: cwe_id: CWE-306
description: CWE-306 Missing Authentication for Critical Function
Affected products: vendor: GE Vernova
product: EnerVista UR Setup
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: HIGH
baseScore: 8.3
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H
version: 3.1
Published: 2025-03-10T09:05:25.962Z
CVE-2025-27257 
Insufficient Verification of Data Authenticity vulnerability in GE Vernova UR IED family devices allows an authenticated user to install a modified firmware.
The firmware signature verification is enforced only on the client-side dedicated software Enervista UR Setup, allowing the integration check to be bypassed.
Problem types: cwe_id: CWE-345
description: CWE-345 Insufficient Verification of Data Authenticity
Affected products: vendor: GE Vernova
product: N60 multilin
default_status: unaffected
vendor: GE Vernova
product: B30 Multilin
default_status: unaffected
vendor: GE Vernova
product: B90 Multilin
default_status: unaffected
vendor: GE Vernova
product: C30 Multilin
default_status: unaffected
vendor: GE Vernova
product: C60 Multilin
default_status: unaffected
vendor: GE Vernova
product: C70 Multilin
default_status: unaffected
vendor: GE Vernova
product: C95 Multilin
default_status: unaffected
vendor: GE Vernova
product: D30 Multilin
default_status: unaffected
vendor: GE Vernova
product: D60 Multilin
default_status: unaffected
vendor: GE Vernova
product: F35 Multilin
default_status: unaffected
vendor: GE Vernova
product: F60 Multilin
default_status: unaffected
vendor: GE Vernova
product: G30 Multilin
default_status: unaffected
vendor: GE Vernova
product: G60 Multilin
default_status: unaffected
vendor: GE Vernova
product: L30 Multilin
default_status: unaffected
vendor: GE Vernova
product: L60 Multilin
default_status: unaffected
vendor: GE Vernova
product: L90 Multilin
default_status: unaffected
vendor: GE Vernova
product: M60 Multilin
default_status: unaffected
vendor: GE Vernova
product: T35 Multilin
default_status: unaffected
vendor: GE Vernova
product: T60 Multilin
default_status: unaffected
vendor: GE Vernova
product: M60 Multilin
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: HIGH
baseScore: 6.1
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
version: 3.1
Published: 2025-03-10T09:05:34.817Z
CVE-2025-27258 Ericsson Network Manager: escalation of privilege vulnerability
Ericsson Network Manager (ENM) versions prior to ENM 25.1 GA contain a vulnerability, if exploited, can result in an escalation of privilege.
Problem types: cwe_id: CWE-284
description: CWE-284: Improper Access Control
Affected products: vendor: Ericsson
product: Ericsson Network Manager(ENM)
default_status: unaffected
Credits: lang: en
value: Ericsson would like to thank the following personnel from TIM Security Red Team Research for reporting these issues to us: Andrea Carlo Maria Dattola, Cristina Coppola, Carlo Pannullo, Massimiliano Brolli
Published: 2025-10-13T06:25:32.326Z
CVE-2025-27259 Ericsson Network Manager: improper neutralization of user controlled input
Ericsson Network Manager versions prior to ENM 25.2 GA contain a vulnerability that, if exploited, can exfiltrate limited data or redirect victims to other sites or domains.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: Ericsson
product: Ericsson Network Manager(ENM)
default_status: unaffected
Credits: lang: en
value: Ericsson would like to thank the following personnel from TIM Security Red Team Research for reporting these issues to us: Andrea Carlo Maria Dattola, Cristina Coppola, Carlo Pannullo, Massimiliano Brolli
Published: 2025-10-13T06:16:37.104Z
CVE-2025-27260 Ericsson Indoor Connect 8855 - Improper Filtering of Special Elements Vulnerability
Ericsson
Indoor Connect 8855 versions prior to 2025.Q3 contains an Improper Filtering of Special
Elements vulnerability which, if exploited, can lead to unauthorized
modification of certain information
Problem types: cwe_id: CWE-790
description: CWE-790
Affected products: vendor: Ericsson
product: Indoor Connect 8855
default_status: affected
Credits: lang: en
value: Telstra
Published: 2026-03-25T12:54:46.406Z
CVE-2025-27261 Ericsson Indoor Connect 8855 - Improper Neutralization of Special Elements used in an SQL Command Vulnerability
Ericsson Indoor Connect 8855 contains an SQL injection vulnerability which if exploited can result in unauthorized disclosure or modification of data.
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: Ericsson
product: Indoor Connect 8855
default_status: affected
Credits: lang: en
value: Telstra
Published: 2025-09-25T13:47:06.233Z
CVE-2025-27262 Ericsson Indoor Connect 8855 -  Improper Neutralization of Special Elements used in an OS Command Vulnerability
Ericsson Indoor Connect 8855 contains a command injection vulnerability which if exploited can result in an escalation of privileges.
Problem types: cwe_id: CWE-78
description: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: Ericsson
product: Indoor Connect 8855
default_status: affected
Credits: lang: en
value: Telstra
Published: 2025-09-25T14:43:29.803Z
CVE-2025-27263 WordPress  Doctor Appointment Booking Plugin <= 1.0.0 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Creativeitem Doctor Appointment Booking doctor-appointment-booking allows SQL Injection.This issue affects Doctor Appointment Booking: from n/a through <= 1.0.0.
Problem types: cwe_id: CWE-89
description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: Creativeitem
product: Doctor Appointment Booking
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 8.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L
version: 3.1
Credits: lang: en
value: Phat RiO | Patchstack Bug Bounty Program
Published: 2025-03-03T13:30:29.450Z
CVE-2025-27264 WordPress Doctor Appointment Booking Plugin <= 1.0.0 - Local File Inclusion vulnerability
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Creativeitem Doctor Appointment Booking doctor-appointment-booking allows PHP Local File Inclusion.This issue affects Doctor Appointment Booking: from n/a through <= 1.0.0.
Problem types: cwe_id: CWE-98
description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')
Affected products: vendor: Creativeitem
product: Doctor Appointment Booking
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Phat RiO | Patchstack Bug Bounty Program
Published: 2025-03-03T13:30:29.638Z
CVE-2025-27265 WordPress Google Maps for WordPress plugin <= 1.0.3 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Aaron D. Campbell Google Maps for WordPress google-maps-for-wordpress allows DOM-Based XSS.This issue affects Google Maps for WordPress: from n/a through <= 1.0.3.
Problem types: cwe_id: CWE-79
description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Aaron D. Campbell
product: Google Maps for WordPress
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: Muhammad Yudha - DJ | Patchstack Bug Bounty Program
Published: 2025-02-24T14:48:44.590Z
CVE-2025-27266 WordPress Hover Image Button plugin <= 1.1.2 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ignacio Perez Hover Image Button hover-image-button allows DOM-Based XSS.This issue affects Hover Image Button: from n/a through <= 1.1.2.
Problem types: cwe_id: CWE-79
description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Ignacio Perez
product: Hover Image Button
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: Muhammad Yudha - DJ | Patchstack Bug Bounty Program
Published: 2025-02-24T14:48:45.446Z
CVE-2025-27267 WordPress Random Quotes Plugin <= 1.3 - Reflected Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in srcoley Random Quotes random-quotes allows Reflected XSS.This issue affects Random Quotes: from n/a through <= 1.3.
Problem types: cwe_id: CWE-79
description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: srcoley
product: Random Quotes
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 7.1
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: johska | Patchstack Bug Bounty Program
Published: 2025-03-26T14:24:21.196Z
CVE-2025-27268 WordPress Small Package Quotes – Worldwide Express Edition Plugin <= 5.2.18 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in enituretechnology Small Package Quotes – Worldwide Express Edition small-package-quotes-wwe-edition allows SQL Injection.This issue affects Small Package Quotes – Worldwide Express Edition: from n/a through <= 5.2.18.
Problem types: cwe_id: CWE-89
description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: enituretechnology
product: Small Package Quotes – Worldwide Express Edition
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 9.3
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
version: 3.1
Credits: lang: en
value: LVT-tholv2k | Patchstack Bug Bounty Program
Published: 2025-03-03T13:30:29.790Z
CVE-2025-27269 WordPress .htaccess Login block Plugin <= 0.9a - Reflected Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Anton Aleksandrov .htaccess Login block htaccess-login-block allows Reflected XSS.This issue affects .htaccess Login block: from n/a through <= 0.9a.
Problem types: cwe_id: CWE-79
description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Anton Aleksandrov
product: .htaccess Login block
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 7.1
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: 0xd4rk5id3 | Patchstack Bug Bounty Program
Published: 2025-03-03T13:30:30.040Z
CVE-2025-27270 WordPress Residential Address Detection Plugin <= 2.5.4 - Arbitrary Option Update to Privilege Escalation vulnerability
Missing Authorization vulnerability in enituretechnology Residential Address Detection residential-address-detection allows Privilege Escalation.This issue affects Residential Address Detection: from n/a through <= 2.5.4.
Problem types: cwe_id: CWE-862
description: Missing Authorization
Affected products: vendor: enituretechnology
product: Residential Address Detection
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: LVT-tholv2k | Patchstack Bug Bounty Program
Published: 2025-03-03T13:30:30.213Z
CVE-2025-27271 WordPress DB Tables Import/Export Plugin <= 1.0.1 - Reflected Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Alberto Cocchiara DB Tables Import/Export db-tables-importexport allows Reflected XSS.This issue affects DB Tables Import/Export: from n/a through <= 1.0.1.
Problem types: cwe_id: CWE-79
description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Alberto Cocchiara
product: DB Tables Import/Export
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 7.1
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: 0xd4rk5id3 | Patchstack Bug Bounty Program
Published: 2025-03-03T13:30:30.399Z
CVE-2025-27272 WordPress VG PostCarousel plugin <= 1.1 - Local File Inclusion vulnerability
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in vinagecko VG PostCarousel vg-postcarousel allows PHP Local File Inclusion.This issue affects VG PostCarousel: from n/a through <= 1.1.
Problem types: cwe_id: CWE-98
description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')
Affected products: vendor: vinagecko
product: VG PostCarousel
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Muhammad Yudha - DJ | Patchstack Bug Bounty Program
Published: 2025-02-24T14:48:46.146Z
CVE-2025-27273 WordPress Affiliate Links Manager Plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in winking Affiliate Links Manager affiliate-links-manager allows Reflected XSS.This issue affects Affiliate Links Manager: from n/a through <= 1.0.
Problem types: cwe_id: CWE-79
description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: winking
product: Affiliate Links Manager
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 5.8
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: johska | Patchstack Bug Bounty Program
Published: 2025-03-03T13:30:30.544Z