rainbutterfly/cve_corpus huggingface dataset:
CVE-2025-31690 Cache Utility - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2025-019
Cross-Site Request Forgery (CSRF) vulnerability in Drupal Cache Utility allows Cross Site Request Forgery.This issue affects Cache Utility: from 0.0.0 before 1.2.1.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Drupal
product: Cache Utility
default_status: unaffected
Credits: lang: en
value: Pierre Rudloff (prudloff)
lang: en
value: cyoun
lang: en
value: Greg Knaddison (greggles)
Published: 2025-03-31T21:49:18.300Z
CVE-2025-31691 OAuth2 Server - Moderately critical - Access bypass - SA-CONTRIB-2025-020
Missing Authorization vulnerability in Drupal OAuth2 Server allows Forceful Browsing.This issue affects OAuth2 Server: from 0.0.0 before 2.1.0.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: Drupal
product: OAuth2 Server
default_status: unaffected
Credits: lang: en
value: Pierre Rudloff (prudloff)
lang: en
value: cafuego
lang: en
value: Lee Rowlands (larowlan)
lang: en
value: Greg Knaddison (greggles)
Published: 2025-03-31T21:49:42.796Z
CVE-2025-31692 AI (Artificial Intelligence) - Critical - Remote Code Execution - SA-CONTRIB-2025-021
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Drupal AI (Artificial Intelligence) allows OS Command Injection.This issue affects AI (Artificial Intelligence): from 0.0.0 before 1.0.5.
Problem types: cwe_id: CWE-78
description: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: Drupal
product: AI (Artificial Intelligence)
default_status: unaffected
Credits: lang: en
value: Drew Webber (mcdruid)
lang: en
value: Marcus Johansson (marcus_johansson)
lang: en
value: Drew Webber (mcdruid)
lang: en
value: Michal Gow (seogow)
lang: en
value: Drew Webber (mcdruid)
Published: 2025-03-31T21:50:34.673Z
CVE-2025-31693 AI (Artificial Intelligence) - Moderately critical - Gadget Chain - SA-CONTRIB-2025-022
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Drupal AI (Artificial Intelligence) allows OS Command Injection.This issue affects AI (Artificial Intelligence): from 0.0.0 before 1.0.5.
Problem types: cwe_id: CWE-78
description: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: Drupal
product: AI (Artificial Intelligence)
default_status: unaffected
Credits: lang: en
value: Drew Webber (mcdruid)
lang: en
value: Marcus Johansson (marcus_johansson)
lang: en
value: Drew Webber (mcdruid)
lang: en
value: Drew Webber (mcdruid)
Published: 2025-03-31T21:51:17.459Z
CVE-2025-31694 Two-factor Authentication (TFA) - Moderately critical - Access bypass - SA-CONTRIB-2025-023
Incorrect Authorization vulnerability in Drupal Two-factor Authentication (TFA) allows Forceful Browsing.This issue affects Two-factor Authentication (TFA): from 0.0.0 before 1.10.0.
Problem types: cwe_id: CWE-288
description: CWE-288 Authentication Bypass Using an Alternate Path or Channel
Affected products: vendor: Drupal
product: Two-factor Authentication (TFA)
default_status: unaffected
Credits: lang: en
value: Conrad Lara (cmlara)
lang: en
value: Elaman Imashov (elaman)
lang: en
value: Conrad Lara (cmlara)
lang: en
value: Greg Knaddison (greggles)
Published: 2025-03-31T21:51:40.451Z
CVE-2025-31695 Link field display mode formatter - Moderately critical - Cross site scripting - SA-CONTRIB-2025-024
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Link field display mode formatter allows Cross-Site Scripting (XSS).This issue affects Link field display mode formatter: from 0.0.0 before 1.6.0.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Drupal
product: Link field display mode formatter
default_status: unaffected
Credits: lang: en
value: Daniel Wehner (dawehner)
lang: en
value: Joseph Zhao (pandaski)
lang: en
value: Benji Fisher (benjifisher)
lang: en
value: Joseph Zhao (pandaski)
lang: en
value: Rodrigo  Aguilera (rodrigoaguilera)
lang: en
value: Bram Driesen (bramdriesen)
lang: en
value: Greg Knaddison (greggles)
lang: en
value: Drew Webber (mcdruid)
lang: en
value: Juraj Nemec (poker10)
Published: 2025-03-31T21:52:55.173Z
CVE-2025-31696 RapiDoc OAS Field Formatter - Moderately critical - Cross site scripting - SA-CONTRIB-2025-025
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal RapiDoc OAS Field Formatter allows Cross-Site Scripting (XSS).This issue affects RapiDoc OAS Field Formatter: from 0.0.0 before 1.0.1.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Drupal
product: RapiDoc OAS Field Formatter
default_status: unaffected
Credits: lang: en
value: Joseph Zhao (pandaski)
lang: en
value: Arlina Espinoza Rhoton (arlina)
lang: en
value: Benji Fisher (benjifisher)
lang: en
value: Lee Rowlands (larowlan)
lang: en
value: Bram Driesen (bramdriesen)
lang: en
value: Greg Knaddison (greggles)
lang: en
value: Drew Webber (mcdruid)
lang: en
value: Juraj Nemec (poker10)
Published: 2025-03-31T21:55:01.951Z
CVE-2025-31697 Formatter Suite - Moderately critical - Cross site scripting - SA-CONTRIB-2025-026
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Formatter Suite allows Cross-Site Scripting (XSS).This issue affects Formatter Suite: from 0.0.0 before 2.1.0.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Drupal
product: Formatter Suite
default_status: unaffected
Credits: lang: en
value: Daniel Wehner (dawehner)
lang: en
value: Joseph Zhao (pandaski)
lang: en
value: Benji Fisher (benjifisher)
lang: en
value: Bram Driesen (bramdriesen)
lang: en
value: cyoun
lang: en
value: Lee Rowlands (larowlan)
lang: en
value: Joseph Zhao (pandaski)
lang: en
value: Greg Knaddison (greggles)
lang: en
value: Drew Webber (mcdruid)
lang: en
value: Juraj Nemec (poker10)
Published: 2025-03-31T21:55:59.521Z
CVE-2025-31698 Apache Traffic Server: Client IP address from PROXY protocol is not used for ACL
ACL configured in ip_allow.config or remap.config does not use IP addresses that are provided by PROXY protocol.

Users can use a new setting (proxy.config.acl.subjects) to choose which IP addresses to use for the ACL if Apache Traffic Server is configured to accept PROXY protocol. 
This issue affects undefined: from 10.0.0 through 10.0.6, from 9.0.0 through 9.2.10.

Users are recommended to upgrade to version 9.2.11 or 10.0.6, which fixes the issue.
Problem types: cwe_id: CWE-284
description: CWE-284 Improper Access Control
Affected products: vendor: Apache Software Foundation
product: Apache Traffic Server
default_status: unaffected
Published: 2025-06-19T10:07:46.733Z
CVE-2025-31700 
A vulnerability has been found in Dahua products.

Attackers could exploit a buffer overflow vulnerability by sending specially crafted malicious packets, potentially causing service disruption (e.g., crashes) or remote code execution (RCE). Some devices may have deployed protection mechanisms such as Address Space Layout Randomization (ASLR), which reduces the likelihood of successful RCE exploitation. However, denial-of-service (DoS) attacks remain a concern.
Affected products: vendor: Dahua
product: IPC
default_status: unaffected
vendor: Dahua
product: SD
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.1
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2025-07-23T06:54:37.996Z
CVE-2025-31701 
A vulnerability has been found in Dahua products.

Attackers could exploit a buffer overflow vulnerability by sending specially crafted malicious packets, potentially causing service disruption (e.g., crashes) or remote code execution (RCE). Some devices may have deployed protection mechanisms such as Address Space Layout Randomization (ASLR), which reduces the likelihood of successful RCE exploitation. However, denial-of-service (DoS) attacks remain a concern.
Affected products: vendor: Dahua
product: IPC
default_status: unaffected
vendor: Dahua
product: SD
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.1
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2025-07-23T06:55:20.001Z
CVE-2025-31702 
A vulnerability exists in certain Dahua embedded products. Third-party malicious attacker with obtained normal user credentials could exploit the vulnerability to access certain data which are restricted to admin privileges, such as system-sensitive files through specific HTTP request. This may cause tampering with admin password, leading to privilege escalation. Systems with only admin account are not affected.
Problem types: cwe_id: CWE-732
description: CWE-732 Incorrect Permission Assignment for Critical Resource
Affected products: vendor: Dahua
product: IPC
default_status: unaffected
vendor: Dahua
product: SD
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.8
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
version: 3.1
Published: 2025-10-15T05:53:35.664Z
CVE-2025-31703 
A vulnerability found in Dahua NVR/XVR device. A third-party malicious attacker with physical access to the device may gain access to a restricted shell via the serial port, and bypasses the shell's authentication mechanism to escalate privileges.
Problem types: cwe_id: CWE-305
description: CWE-305 Authentication bypass by primary weakness
Affected products: vendor: dahua
product: NVR2-4KS3
default_status: unaffected
vendor: dahua
product: XVR4232AN-I/T
default_status: unaffected
vendor: dahua
product: XVR1B16H-I/T
default_status: unaffected
Published: 2026-03-18T07:13:21.911Z
CVE-2025-31710 
In engineermode service, there is a possible command injection due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed.
Problem types: description: cwe-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')
Affected products: vendor: Unisoc (Shanghai) Technologies Co., Ltd.
product: SC9863A/T606/T612/T616/T750/T765/T760/T770/T820/S8000/T8300/T9300
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 5.9
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Published: 2025-06-03T05:50:51.239Z
CVE-2025-31711 
In cplog service, there is a possible system crash due to null pointer dereference. This could lead to local denial of service with no additional execution privileges needed.
Problem types: description: cwe-476 NULL Pointer Dereference
Affected products: vendor: Unisoc (Shanghai) Technologies Co., Ltd.
product: SC7731E/SC9832E/SC9863A/T310/T606/T612/T616/T610/T618/T750/T765/T760/T770/T820/S8000/T8300/T9300
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 5.1
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Published: 2025-06-03T05:50:52.353Z
CVE-2025-31712 
In cplog service, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with no additional execution privileges needed.
Problem types: description: cwe-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Affected products: vendor: Unisoc (Shanghai) Technologies Co., Ltd.
product: SC7731E/SC9832E/SC9863A/T310/T606/T612/T616/T610/T618/T750/T765/T760/T770/T820/S8000/T8300/T9300
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 5.1
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Published: 2025-06-03T05:50:53.405Z
CVE-2025-31713 
In engineer mode service, there is a possible command injection due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed.
Problem types: description: CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')
Affected products: vendor: Unisoc (Shanghai) Technologies Co., Ltd.
product: SL8521E/SL8521ET/ SL8541E/UIS8141E/UWS6137/UWS6137E/UWS6151(E)/UWS6152
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 8.4
baseSeverity: HIGH
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Published: 2025-08-18T00:34:28.435Z
CVE-2025-31714 
In Developer Tools, there is a possible missing verification incorrect input. This could lead to local escalation of privilege with no additional execution privileges needed.
Problem types: description: CWE-20 Improper Input Validation
Affected products: vendor: Unisoc (Shanghai) Technologies Co., Ltd.
product: SL8521E/SL8521ET/ SL8541E/UIS8141E/UWS6137/UWS6137E/UWS6151(E)/UWS6152
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 6.8
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Published: 2025-08-18T00:34:29.399Z
CVE-2025-31715 
In vowifi service, there is a possible command injection due to improper input validation. This could lead to remote escalation of privilege with no additional execution privileges needed.
Problem types: description: CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')
Affected products: vendor: Unisoc (Shanghai) Technologies Co., Ltd.
product: SL8521E/SL8521ET/ SL8541E/UIS8141E/UWS6137/UWS6137E/UWS6151(E)/UWS6152
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 9.8
baseSeverity: CRITICAL
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Published: 2025-08-18T00:34:30.378Z
CVE-2025-31716 
In bootloader, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with no additional execution privileges needed.
Problem types: description: cwe-121 Stack-based Buffer Overflow
Affected products: vendor: Unisoc (Shanghai) Technologies Co., Ltd.
product: SC7731E/SC9832E/SC9863A/T310/T606/T612/T616/T610/T618/T750/T765/T760/T770/T820/S8000
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 5.1
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Published: 2025-08-01T05:55:00.365Z
CVE-2025-31717 
In modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no additional execution privileges needed.
Problem types: description: CWE-20 Improper Input Validation
Affected products: vendor: Unisoc (Shanghai) Technologies Co., Ltd.
product: T750/T765/T760/T770/T820/S8000/T8300/T9300
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 7.5
baseSeverity: HIGH
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Published: 2025-10-11T00:26:51.490Z
CVE-2025-31718 
In modem, there is a possible system crash due to improper input validation. This could lead to remote escalation of privilege with no additional execution privileges needed.
Problem types: description: CWE-20 Improper Input Validation
Affected products: vendor: Unisoc (Shanghai) Technologies Co., Ltd.
product: T606/T612/T616/T750/T765/T760/T770/T820/S8000/T8300/T9300
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 7.5
baseSeverity: HIGH
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Published: 2025-10-11T00:26:52.570Z
CVE-2025-31719 
In TEE EcDSA algorithm, there is a possible memory consistency issue. This could lead to generated incorrect signature results with low probability.
Problem types: description: cwe-665 Improper Initialization
Affected products: vendor: Unisoc (Shanghai) Technologies Co., Ltd.
product: SC7731E/SC9832E/SC9863A/T310/T606/T612/T616/T610/T618/T750/T765/T760/T770/T820/S8000/T8300/T9300
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 5.1
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Published: 2025-11-11T00:33:24.431Z
CVE-2025-31720 
A missing permission check in Jenkins 2.503 and earlier, LTS 2.492.2 and earlier allows attackers with Computer/Create permission but without Computer/Extended Read permission to copy an agent, gaining access to its configuration.
Affected products: vendor: Jenkins Project
product: Jenkins
default_status: affected
Published: 2025-04-02T14:59:49.570Z
CVE-2025-31721 
A missing permission check in Jenkins 2.503 and earlier, LTS 2.492.2 and earlier allows attackers with Computer/Create permission but without Computer/Configure permission to copy an agent, gaining access to encrypted secrets in its configuration.
Affected products: vendor: Jenkins Project
product: Jenkins
default_status: affected
Published: 2025-04-02T14:59:50.144Z
CVE-2025-31722 
In Jenkins Templating Engine Plugin 2.5.3 and earlier, libraries defined in folders are not subject to sandbox protection, allowing attackers with Item/Configure permission to execute arbitrary code in the context of the Jenkins controller JVM.
Affected products: vendor: Jenkins Project
product: Jenkins Templating Engine Plugin
default_status: unaffected
Published: 2025-04-02T14:59:50.726Z
CVE-2025-31723 
A cross-site request forgery (CSRF) vulnerability in Jenkins Simple Queue Plugin 1.4.6 and earlier allows attackers to change and reset the build queue order.
Affected products: vendor: Jenkins Project
product: Jenkins Simple Queue Plugin
default_status: unaffected
Published: 2025-04-02T14:59:51.305Z
CVE-2025-31724 
Jenkins Cadence vManager Plugin 4.0.0-282.v5096a_c2db_275 and earlier stores Verisium Manager vAPI keys unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Extended Read permission, or access to the Jenkins controller file system.
Affected products: vendor: Jenkins Project
product: Jenkins Cadence vManager Plugin
default_status: unaffected
Published: 2025-04-02T14:59:51.859Z
CVE-2025-31725 
Jenkins monitor-remote-job Plugin 1.0 stores passwords unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Extended Read permission, or access to the Jenkins controller file system.
Affected products: vendor: Jenkins Project
product: Jenkins monitor-remote-job Plugin
default_status: unknown
Published: 2025-04-02T14:59:52.475Z
CVE-2025-31726 
Jenkins Stack Hammer Plugin 1.0.6 and earlier stores Stack Hammer API keys unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Extended Read permission, or access to the Jenkins controller file system.
Affected products: vendor: Jenkins Project
product: Jenkins Stack Hammer Plugin
default_status: unknown
Published: 2025-04-02T14:59:53.108Z
CVE-2025-31727 
Jenkins AsakusaSatellite Plugin 0.1.1 and earlier stores AsakusaSatellite API keys unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.
Affected products: vendor: Jenkins Project
product: Jenkins AsakusaSatellite Plugin
default_status: unknown
Published: 2025-04-02T14:59:53.687Z
CVE-2025-31728 
Jenkins AsakusaSatellite Plugin 0.1.1 and earlier does not mask AsakusaSatellite API keys displayed on the job configuration form, increasing the potential for attackers to observe and capture them.
Affected products: vendor: Jenkins Project
product: Jenkins AsakusaSatellite Plugin
default_status: unknown
Published: 2025-04-02T14:59:54.247Z
CVE-2025-31729 WordPress WooTumblog plugin <= 2.1.4 - Content Injection vulnerability
Missing Authorization vulnerability in jeffikus WooTumblog woo-tumblog allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooTumblog: from n/a through <= 2.1.4.
Problem types: cwe_id: CWE-862
description: Missing Authorization
Affected products: vendor: jeffikus
product: WooTumblog
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
version: 3.1
Credits: lang: en
value: Mika | Patchstack Bug Bounty Program
Published: 2025-04-03T13:27:12.479Z
CVE-2025-31730 WordPress Marketer Addons Plugin <= 1.0.1 - Stored Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DigitalCourt Marketer Addons marketer-addons allows Stored XSS.This issue affects Marketer Addons: from n/a through <= 1.0.1.
Problem types: cwe_id: CWE-79
description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: DigitalCourt
product: Marketer Addons
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: 0xd4rk5id3 | Patchstack Bug Bounty Program
Published: 2025-04-01T14:51:01.189Z
CVE-2025-31731 WordPress Author Bio Shortcode Plugin <= 2.5.3 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Philip John Author Bio Shortcode author-bio-shortcode allows Stored XSS.This issue affects Author Bio Shortcode: from n/a through <= 2.5.3.
Problem types: cwe_id: CWE-79
description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Philip John
product: Author Bio Shortcode
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: 0xd4rk5id3 | Patchstack Bug Bounty Program
Published: 2025-04-01T14:51:01.844Z
CVE-2025-31732 WordPress GB Gallery Slideshow plugin <= 1.3 - Broken Access Control vulnerability
Missing Authorization vulnerability in gb-plugins GB Gallery Slideshow gb-gallery-slideshow allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GB Gallery Slideshow: from n/a through <= 1.3.
Problem types: cwe_id: CWE-862
description: Missing Authorization
Affected products: vendor: gb-plugins
product: GB Gallery Slideshow
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
version: 3.1
Credits: lang: en
value: Mika | Patchstack Bug Bounty Program
Published: 2025-04-01T14:51:02.397Z