rainbutterfly/cve_corpus huggingface dataset:
CVE-2025-13807 orionsec orion-ops API MachineKeyController.java MachineKeyController improper authorization
A vulnerability was detected in orionsec orion-ops up to 5925824997a3109651bbde07460958a7be249ed1. Affected is the function MachineKeyController of the file orion-ops-api/orion-ops-web/src/main/java/cn/orionsec/ops/controller/MachineKeyController.java of the component API. The manipulation results in improper authorization. The attack can be executed remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Problem types: cwe_id: CWE-285
description: Improper Authorization
cwe_id: CWE-266
description: Incorrect Privilege Assignment
Affected products: vendor: orionsec
product: orion-ops
CVSS v3.1: version: 3.1
baseScore: 4.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R
baseSeverity: MEDIUM
Credits: lang: en
value: sh7err03 (VulDB User)
Published: 2025-12-01T04:32:06.185Z
CVE-2025-13808 orionsec orion-ops User Profile UserController.java update improper authorization
A flaw has been found in orionsec orion-ops up to 5925824997a3109651bbde07460958a7be249ed1. Affected by this vulnerability is the function update of the file orion-ops-api/orion-ops-web/src/main/java/cn/orionsec/ops/controller/UserController.java of the component User Profile Handler. This manipulation of the argument ID causes improper authorization. The attack is possible to be carried out remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Problem types: cwe_id: CWE-285
description: Improper Authorization
cwe_id: CWE-266
description: Incorrect Privilege Assignment
Affected products: vendor: orionsec
product: orion-ops
CVSS v3.1: version: 3.1
baseScore: 7.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
baseSeverity: HIGH
Credits: lang: en
value: sh7err03 (VulDB User)
Published: 2025-12-01T05:02:05.640Z
CVE-2025-13809 orionsec orion-ops SSH Connection MachineInfoController.java server-side request forgery
A vulnerability has been found in orionsec orion-ops up to 5925824997a3109651bbde07460958a7be249ed1. Affected by this issue is some unknown functionality of the file orion-ops-api/orion-ops-web/src/main/java/cn/orionsec/ops/controller/MachineInfoController.java of the component SSH Connection Handler. Such manipulation of the argument host/sshPort/username/password/authType leads to server-side request forgery. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. A patch should be applied to remediate this issue. The vendor was contacted early about this disclosure but did not respond in any way.
Problem types: cwe_id: CWE-918
description: Server-Side Request Forgery
Affected products: vendor: orionsec
product: orion-ops
CVSS v3.1: version: 3.1
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C
baseSeverity: MEDIUM
Credits: lang: en
value: sh7err04 (VulDB User)
Published: 2025-12-01T05:32:05.849Z
CVE-2025-13810 jsnjfz WebStack-Guns KaptchaController.java renderPicture path traversal
A vulnerability was found in jsnjfz WebStack-Guns 1.0. This affects the function renderPicture of the file src/main/java/com/jsnjfz/manage/modular/system/controller/KaptchaController.java. Performing a manipulation results in path traversal. It is possible to initiate the attack remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
Problem types: cwe_id: CWE-22
description: Path Traversal
Affected products: vendor: jsnjfz
product: WebStack-Guns
cpes: cpe:2.3:a:jsnjfz:webstack-guns:*:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseScore: 5.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R
baseSeverity: MEDIUM
Credits: lang: en
value: sh7err04 (VulDB User)
lang: en
value: VulDB
Published: 2025-12-01T06:02:06.025Z
CVE-2025-13811 jsnjfz WebStack-Guns PageFactory.java sql injection
A vulnerability was determined in jsnjfz WebStack-Guns 1.0. This vulnerability affects unknown code of the file src/main/java/com/jsnjfz/manage/core/common/constant/factory/PageFactory.java. Executing a manipulation of the argument sort can lead to sql injection. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Problem types: cwe_id: CWE-89
description: SQL Injection
cwe_id: CWE-74
description: Injection
Affected products: vendor: jsnjfz
product: WebStack-Guns
cpes: cpe:2.3:a:jsnjfz:webstack-guns:*:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
baseSeverity: MEDIUM
Credits: lang: en
value: sh7err04 (VulDB User)
lang: en
value: VulDB
Published: 2025-12-01T06:32:05.845Z
CVE-2025-13812 GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress <= 7.6.1 - Missing Authorization to Authenticated (Subscriber+) Information Exposure
The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the gamipress_ajax_get_posts and gamipress_ajax_get_users functions in all versions up to, and including, 7.6.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to enumerate users, including their email addresses and to retrieve titles of private posts.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: rubengc
product: GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
baseScore: 4.3
baseSeverity: MEDIUM
Credits: lang: en
value: Kenneth Dunn
Published: 2026-01-06T07:22:12.783Z
CVE-2025-13813 moxi159753 Mogu Blog v2 Storage Management Endpoint storage authorization
A vulnerability was identified in moxi159753 Mogu Blog v2 up to 5.2. This issue affects some unknown processing of the file /storage/ of the component Storage Management Endpoint. The manipulation leads to missing authorization. The attack can be initiated remotely. The attack's complexity is rated as high. The exploitability is assessed as difficult. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Problem types: cwe_id: CWE-862
description: Missing Authorization
cwe_id: CWE-863
description: Incorrect Authorization
Affected products: vendor: moxi159753
product: Mogu Blog v2
CVSS v3.1: version: 3.1
baseScore: 5.6
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
baseSeverity: MEDIUM
Credits: lang: en
value: sh7err04 (VulDB User)
Published: 2025-12-01T07:02:06.723Z
CVE-2025-13814 moxi159753 Mogu Blog v2 uploadPicsByUrl LocalFileServiceImpl.uploadPictureByUrl server-side request forgery
A security flaw has been discovered in moxi159753 Mogu Blog v2 up to 5.2. Impacted is the function LocalFileServiceImpl.uploadPictureByUrl of the file /file/uploadPicsByUrl. The manipulation results in server-side request forgery. The attack can be launched remotely. The exploit has been released to the public and may be exploited. The vendor was contacted early about this disclosure but did not respond in any way.
Problem types: cwe_id: CWE-918
description: Server-Side Request Forgery
Affected products: vendor: moxi159753
product: Mogu Blog v2
CVSS v3.1: version: 3.1
baseScore: 7.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
baseSeverity: HIGH
Credits: lang: en
value: sh7err04 (VulDB User)
Published: 2025-12-01T07:32:06.011Z
CVE-2025-13815 moxi159753 Mogu Blog v2 pictures unrestricted upload
A weakness has been identified in moxi159753 Mogu Blog v2 up to 5.2. The affected element is an unknown function of the file /file/pictures. This manipulation of the argument filedatas causes unrestricted upload. The attack may be initiated remotely. The exploit has been made available to the public and could be exploited. The vendor was contacted early about this disclosure but did not respond in any way.
Problem types: cwe_id: CWE-434
description: Unrestricted Upload
cwe_id: CWE-284
description: Improper Access Controls
Affected products: vendor: moxi159753
product: Mogu Blog v2
CVSS v3.1: version: 3.1
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
baseSeverity: MEDIUM
Credits: lang: en
value: sh7err04 (VulDB User)
Published: 2025-12-01T08:02:05.907Z
CVE-2025-13816 moxi159753 Mogu Blog v2 ZIP File unzipFile FileOperation.unzip path traversal
A security vulnerability has been detected in moxi159753 Mogu Blog v2 up to 5.2. The impacted element is the function FileOperation.unzip of the file /networkDisk/unzipFile of the component ZIP File Handler. Such manipulation of the argument fileUrl leads to path traversal. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Problem types: cwe_id: CWE-22
description: Path Traversal
Affected products: vendor: moxi159753
product: Mogu Blog v2
CVSS v3.1: version: 3.1
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
baseSeverity: MEDIUM
Credits: lang: en
value: sh7err05 (VulDB User)
Published: 2025-12-01T08:32:05.364Z
CVE-2025-13818 Local privilege escalation in ESET Management Agent for Windows
Local privilege escalation vulnerability via insecure temporary batch file execution in ESET Management Agent
Problem types: cwe_id: CWE-367
description: CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition
Affected products: vendor: ESET spol s.r.o.
product: ESET Management Agent
default_status: unaffected
Published: 2026-02-06T13:13:47.046Z
CVE-2025-13819 Open redirect in web server of MiR robots and MiR fleet
Open redirect in the web server component of MiR Robot and Fleet software allows a remote attacker to redirect users to arbitrary external websites via a crafted parameter, facilitating phishing or social engineering attacks.
Problem types: cwe_id: CWE-601
description: CWE-601 URL Redirection to Untrusted Site ('Open Redirect')
Affected products: vendor: MiR
product: Robot
default_status: unaffected
vendor: MiR
product: Fleet
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.1
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
version: 3.1
Published: 2025-12-01T09:41:08.376Z
CVE-2025-13820 Comments – wpDiscuz < 7.6.40 - Unauthenticated Account Takeover
The Comments  WordPress plugin before 7.6.40 does not properly validate user's identity when using the disqus.com provider, allowing an attacker to log in to any user (when knowing their email address) when such user does not have an account on disqus.com yet.
Problem types: description: CWE-269 Improper Privilege Management
Affected products: vendor: Unknown
product: Comments
default_status: unaffected
Credits: lang: en
value: wcraft
lang: en
value: WPScan
Published: 2026-01-01T06:00:03.091Z
CVE-2025-13821 User profile update exposes password hash and MFA secrets
Mattermost versions 11.1.x <= 11.1.2, 10.11.x <= 10.11.9, 11.2.x <= 11.2.1 fail to sanitize sensitive data in WebSocket messages which allows authenticated users to exfiltrate password hashes and MFA secrets via profile nickname updates or email verification events. Mattermost Advisory ID: MMSA-2025-00560
Problem types: cwe_id: CWE-200
description: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
Affected products: vendor: Mattermost
product: Mattermost
default_status: unaffected
CVSS v3.1: attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
baseSeverity: MEDIUM
baseScore: 5.7
Credits: lang: en
value: daw10
Published: 2026-02-16T11:57:25.588Z
CVE-2025-13822 Authentication bypass in MCPHub
MCPHub in versions below 0.11.0 is vulnerable to authentication bypass. Some endpoints are not protected by authentication middleware, allowing an unauthenticated attacker to perform actions in the name of other users and using their privileges.
Problem types: cwe_id: CWE-639
description: CWE-639 Authorization Bypass Through User-Controlled Key
Affected products: vendor: MCPHub
product: MCPHub
default_status: unaffected
Credits: lang: en
value: Eryk Winiarz
Published: 2026-04-14T10:23:49.910Z
CVE-2025-13823 Micro820®, Micro850®,  Micro870® – Specialized Fuzzing Vulnerabilities
A security issue was found in the IPv6 stack in the Micro850 and Micro870 controllers when the controllers received multiple malformed packets during fuzzing. The controllers will go into recoverable fault with fault code 0xFE60. To recover the controller, clear the fault.
Problem types: cwe_id: CWE-1395
description: CWE-1395: Dependency on Vulnerable Third-Party Component
Affected products: vendor: Rockwell Automation
product: Micro820®, Micro850®,  Micro870®
default_status: unaffected
Published: 2025-12-15T15:17:48.725Z
CVE-2025-13824 Micro820®, Micro850®,  Micro870® – Specialized Fuzzing Vulnerabilities
A security issue exists due to improper handling of malformed CIP packets during fuzzing. The controller enters a hard fault with solid red Fault LED and becomes unresponsive. Upon power cycle, the controller will enter recoverable fault where the MS LED and Fault LED become flashing red and reports fault code 0xF019. To recover, clear the fault.
Problem types: cwe_id: CWE-763
description: CWE-763: Release of Invalid Pointer or Reference
Affected products: vendor: Rockwell Automation
product: Micro820®, Micro850®,  Micro870®
default_status: unaffected
Published: 2025-12-15T15:20:52.952Z
CVE-2025-13826 Incorrect input validation on the Zervit portable HTTP/Web server
Zervit's portable HTTP/web server is vulnerable to remote DoS attacks when a configuration reset request is made. The vulnerability is caused by inadequate validation of user-supplied input. An attacker can exploit this vulnerability by sending malicious requests. If the vulnerability is successfully exploited, the application can be made to stop responding, resulting in a DoS condition. It is possible to manually restart the application.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper input validation
Affected products: vendor: Zervit
product: portable HTTP/Web server
default_status: unaffected
Credits: lang: en
value: Rafael Pedrero
Published: 2026-04-21T08:19:57.983Z
CVE-2025-13827 GrapesJsBuilder File Upload allows all file uploads
Summary
Arbitrary files can be uploaded via the GrapesJS Builder, as the types of files that can be uploaded are not restricted. 
ImpactIf the media folder is not restricted from running files this can lead to a remote code execution.
Problem types: cwe_id: CWE-434
description: CWE-434 Unrestricted Upload of File with Dangerous Type
Affected products: vendor: Mautic
product: Mautic
default_status: unaffected
Credits: lang: en
value: Jason Woods (driskell)
lang: en
value: Patryk Gruszka (patrykgruszka)
lang: en
value: Jan Linhart (escopecz)
lang: en
value: Jason Woods (driskell)
Published: 2025-12-02T16:54:39.986Z
CVE-2025-13828 Mautic user without privileged access to the Marketplace can install and uninstall composer packages
SummaryA non privileged user can install and remove arbitrary packages via composer for a composer based installed, even if the flag in update settings for enable composer based update is unticked.

ImpactA low-privileged user of the platform can install malicious code to obtain higher privileges.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: Mautic
product: Mautic
default_status: unaffected
Credits: lang: en
value: Jason Woods (driskell)
lang: en
value: Jason Woods (driskell)
lang: en
value: Jan Linhart (escopecz)
lang: en
value: Patryk Gruszka (patrykgruszka)
Published: 2025-12-02T16:54:58.898Z
CVE-2025-13829 
Incorrect Authorization vulnerability in Data Illusion Zumbrunn NGSurvey allows any logged-in user to obtain the private information of any other user.



 Critical information retrieved: 
  *  APIKEY (1 year user Session)
  *  RefreshToken (10 minutes user Session)
  *  Password hashed with bcrypt
  *  User IP
  *  Email
  *  Full Name
Problem types: cwe_id: CWE-863
description: CWE-863 Incorrect Authorization
Affected products: vendor: Data Illusion Zumbrunn
product: NGSurvey
default_status: unaffected
Credits: lang: en
value: Thomas CLAIR
Published: 2025-12-01T15:47:10.317Z
CVE-2025-13835 WordPress Arconix Shortcodes plugin <= 2.1.20 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tychesoftwares Arconix Shortcodes arconix-shortcodes allows Stored XSS.This issue affects Arconix Shortcodes: from n/a through <= 2.1.20.
Problem types: cwe_id: CWE-79
description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: tychesoftwares
product: Arconix Shortcodes
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: Rooting | Patchstack Bug Bounty Program
Published: 2025-12-01T17:57:41.794Z
CVE-2025-13836 Excessive read buffering DoS in http.client
When reading an HTTP response from a server, if no read amount is specified, the default behavior will be to use Content-Length. This allows a malicious server to cause the client to read large amounts of data into memory, potentially causing OOM or other DoS.
Affected products: vendor: Python Software Foundation
product: CPython
default_status: unaffected
Published: 2025-12-01T18:02:38.483Z
CVE-2025-13837 Out-of-memory when loading Plist
When loading a plist file, the plistlib module reads data in size specified by the file itself, meaning a malicious file can cause OOM and DoS issues
Affected products: vendor: Python Software Foundation
product: CPython
default_status: unaffected
Published: 2025-12-01T18:13:32.739Z
CVE-2025-13838 WishSuite <= 1.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'button_text' Shortcode Attribute
The WishSuite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'button_text' parameter of the 'wishsuite_button' shortcode in all versions up to, and including, 1.5.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: htplugins
product: WishSuite – Wishlist for WooCommerce
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
baseScore: 6.4
baseSeverity: MEDIUM
Credits: lang: en
value: Djaidja Moundjid
Published: 2025-12-21T02:20:31.615Z
CVE-2025-13839 LJUsers <= 1.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'name' Shortcode Attribute
The LJUsers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name' parameter of the 'ljuser' shortcode in all versions up to, and including, 1.2.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: jenyay
product: LJUsers
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
baseScore: 6.4
baseSeverity: MEDIUM
Credits: lang: en
value: Gilang Asra Bilhadi
Published: 2025-12-12T02:20:56.348Z
CVE-2025-13840 BUKAZU Search widget <= 3.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'shortcode' Shortcode Attribute
The BUKAZU Search widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'shortcode' parameter of the 'bukazu_search' shortcode in all versions up to, and including, 3.3.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: bobvanoorschot
product: Bukazu Search Widget
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
baseScore: 6.4
baseSeverity: MEDIUM
Credits: lang: en
value: Gilang Asra Bilhadi
Published: 2025-12-12T03:20:51.941Z
CVE-2025-13841 Smart App Banners <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'size' and 'verticalalign' Shortcode Attributes
The Smart App Banners plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'size' and 'verticalalign' parameters of the 'app-store-download' shortcode in all versions up to, and including, 1.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: clevelandwebdeveloper
product: Smart App Banners
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
baseScore: 6.4
baseSeverity: MEDIUM
Credits: lang: en
value: Gilang Asra Bilhadi
Published: 2026-01-07T09:21:02.608Z
CVE-2025-13842 Breadcrumb NavXT <= 7.5.0 - Missing Authorization to Sensitive Information Exposure
The Breadcrumb NavXT plugin for WordPress is vulnerable to authorization bypass through user-controlled key in versions up to and including 7.5.0. This is due to the Gutenberg block renderer trusting the $_REQUEST['post_id'] parameter without verification in the includes/blocks/build/breadcrumb-trail/render.php file. This makes it possible for unauthenticated attackers to enumerate and view breadcrumb trails for draft or private posts by manipulating the post_id parameter, revealing post titles and hierarchy that should remain hidden.
Problem types: cwe_id: CWE-639
description: CWE-639 Authorization Bypass Through User-Controlled Key
Affected products: vendor: mtekk
product: Breadcrumb NavXT
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
baseScore: 5.3
baseSeverity: MEDIUM
Credits: lang: en
value: NosleeP
Published: 2026-02-19T04:36:13.093Z