rainbutterfly/cve_corpus huggingface dataset:
CVE-2025-14091 TrippWasTaken PHP-Guitar-Shop Product Details product.php sql injection
A weakness has been identified in TrippWasTaken PHP-Guitar-Shop up to 6ce0868889617c1975982aae6df8e49555d0d555. This vulnerability affects unknown code of the file /product.php of the component Product Details Page. Executing manipulation of the argument ID can lead to sql injection. It is possible to launch the attack remotely. The exploit has been made available to the public and could be exploited. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The vendor was contacted early about this disclosure but did not respond in any way.
Problem types: cwe_id: CWE-89
description: SQL Injection
cwe_id: CWE-74
description: Injection
Affected products: vendor: TrippWasTaken
product: PHP-Guitar-Shop
CVSS v3.1: version: 3.1
baseScore: 7.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
baseSeverity: HIGH
Credits: lang: en
value: shijia (VulDB User)
Published: 2025-12-05T16:02:06.123Z
CVE-2025-14092 Edimax BR-6478AC V3 formDebugDiagnosticRun sub_416898 os command injection
A security vulnerability has been detected in Edimax BR-6478AC V3 1.0.15. This issue affects the function sub_416898 of the file /boafrm/formDebugDiagnosticRun. The manipulation of the argument host leads to os command injection. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Problem types: cwe_id: CWE-78
description: OS Command Injection
cwe_id: CWE-77
description: Command Injection
Affected products: vendor: Edimax
product: BR-6478AC V3
cpes: cpe:2.3:o:edimax:br-6478ac_v3_firmware:*:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseScore: 4.7
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
baseSeverity: MEDIUM
Credits: lang: en
value: KrisW (VulDB User)
Published: 2025-12-05T16:02:08.289Z
CVE-2025-14093 Edimax BR-6478AC V3 formTracerouteDiagnosticRun sub_416990 os command injection
A vulnerability was detected in Edimax BR-6478AC V3 1.0.15. Impacted is the function sub_416990 of the file /boafrm/formTracerouteDiagnosticRun. The manipulation of the argument host results in os command injection. The attack can be launched remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Problem types: cwe_id: CWE-78
description: OS Command Injection
cwe_id: CWE-77
description: Command Injection
Affected products: vendor: Edimax
product: BR-6478AC V3
cpes: cpe:2.3:o:edimax:br-6478ac_v3_firmware:*:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseScore: 4.7
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
baseSeverity: MEDIUM
Credits: lang: en
value: KrisW (VulDB User)
Published: 2025-12-05T16:32:05.836Z
CVE-2025-14094 Edimax BR-6478AC V3 formSysCmd sub_44CCE4 os command injection
A flaw has been found in Edimax BR-6478AC V3 1.0.15. The affected element is the function sub_44CCE4 of the file /boafrm/formSysCmd. This manipulation of the argument sysCmd causes os command injection. The attack may be initiated remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Problem types: cwe_id: CWE-78
description: OS Command Injection
cwe_id: CWE-77
description: Command Injection
Affected products: vendor: Edimax
product: BR-6478AC V3
cpes: cpe:2.3:o:edimax:br-6478ac_v3_firmware:*:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseScore: 4.7
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
baseSeverity: MEDIUM
Credits: lang: en
value: KrisW (VulDB User)
Published: 2025-12-05T17:02:05.688Z
CVE-2025-14095 Privilege boundary violation in Radiometer Products
A "Privilege boundary violation" vulnerability is identified affecting multiple Radiometer Products. Exploitation of this vulnerability gives a user with physical access to the analyzer, the possibility to gain unauthorized access to functionalities outside the restricted environment. The vulnerability is due to weakness in the design of access control implementation in application software. 

Other related CVE's are CVE-2025-14096 & CVE-2025-14097.

Affected customers have been informed about this vulnerability. This CVE is being published to provide transparency.

Required configuration for Exposure:


Physical access to the analyzer is needed.

Temporary work Around:


Only authorized people can physically access the analyzer. 

Permanent solution:
Local Radiometer representatives will contact all affected customers to discuss a permanent solution.



Exploit Status:
Researchers have provided working proof-of-concept. Radiometer is not aware of any publicly available exploit at the time of publication.                                                                                                                                                                                        Note: 

CVSS score 6.8 when underlying OS is Windows 7 or Windows XP Operating systems and CVSS score 5.7 when underlying OS is Windows 8 or Windows 10 operating systems.
Problem types: cwe_id: CWE-284
description: CWE-284: Improper Access Control
cwe_id: CWE-693
description: CWE-693 — Protection Mechanism Failure
Affected products: vendor: Radiometer Medical Aps
product: ABL90 FLEX and ABL90 FLEX PLUS Analyzers
default_status: unaffected
vendor: Radiometer Medical Aps
product: AQT90 FLEX Analyzers
default_status: unaffected
vendor: Radiometer Medical Aps
product: ABL800 BASIC and ABL800 FLEX Analyzers
default_status: unaffected
vendor: Radiometer Medical Aps
product: ABL9 Analyzers
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: PHYSICAL
availabilityImpact: HIGH
baseScore: 5.7
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
version: 3.1
Credits: lang: en
value: Florian Hauser and Fabian Weber from CODE WHITE GmbH
Published: 2025-12-17T11:45:43.341Z
CVE-2025-14096 Credential Disclosure vulnerability in Radiometer Products
A vulnerability exists in multiple Radiometer products that allow an attacker with physical access to the analyzer possibility to extract credential information. The vulnerability is due to a weakness in the design and insufficient credential protection in operating system.

Other related CVE's are CVE-2025-14095 & CVE-2025-14097.



Affected customers have been informed about this vulnerability. This CVE is being published to provide transparency.





Required Configuration for Exposure:


Attacker requires physical access to the analyzer.



Temporary work Around:
Only authorized people can physically access the analyzer.

Permanent solution:
Local Radiometer representatives will contact all affected customers to discuss a permanent solution.

Exploit Status:


Researchers have provided a working proof-of-concept (PoC). Radiometer is not aware of any public exploit code at the time of this publication.
Problem types: cwe_id: CWE-798
description: CWE-798: Use of Hard-coded Credentials
cwe_id: CWE-250
description: CWE-250: Execution with Unnecessary Privileges
Affected products: vendor: Radiometer Medical Aps
product: ABL90 FLEX and ABL90 FLEX PLUS Analyzers
default_status: unaffected
vendor: Radiometer Medical Aps
product: AQT90 FLEX Analyzers
default_status: unaffected
vendor: Radiometer Medical Aps
product: ABL800 BASIC and ABL800 FLEX analyzers
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 8.4
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Florian Hauser and Fabian Weber from CODE WHITE GmbH
Published: 2025-12-17T12:19:27.489Z
CVE-2025-14097 Remote Code Execution Vulnerability in Radiometer Products
A vulnerability in the application software of multiple Radiometer products may allow remote code execution and unauthorized device management when specific internal conditions are met. Exploitation requires that a remote connection is established with additional information obtained through other means.  The issue is caused by a weakness in the analyzer’s application software.                                                                                                                                                                                                Other related CVE's are CVE-2025-14095 & CVE-2025-14096.                                                                                                      Affected customers have been informed about this vulnerability. This CVE is being published to provide transparency.



Required Configuration for Exposure: Affected application software version is in use and remote support feature is enabled in the analyzer.                                                                                                                                                                        Temporary work Around: If the network is not considered secure, please remove the analyzer from the network.                         Permanent solution:
Customers should ensure the following:
•  The network is secure, and access follows best practices.
Local Radiometer representatives will contact all affected customers to discuss a permanent solution.                                                     
Exploit Status:


Researchers have provided working proof-of-concept (PoC). Radiometer is not aware of any publicly available exploits at the time of this publication.
Problem types: cwe_id: CWE-287
description: CWE-287: Improper Authentication
Affected products: vendor: Radiometer Medical Aps
product: ABL90 FLEX and ABL90 FLEX PLUS Analyzers
default_status: unaffected
vendor: Radiometer Medical Aps
product: ABL800 BASIC and ABL800 FLEX Analyzers
default_status: unaffected
vendor: Radiometer Medical Aps
product: AQT90 FLEX Analyzers
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.2
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Florian Hauser and Fabian Weber from CODE WHITE GmbH
Published: 2025-12-17T12:36:03.779Z
CVE-2025-14101 IDOR in GG Soft's PaperWork
Authorization Bypass Through User-Controlled Key vulnerability in GG Soft Software Services Inc. PaperWork allows Exploitation of Trusted Identifiers.

This issue affects PaperWork: from 5.2.0.9427 before 6.0.
Problem types: cwe_id: CWE-639
description: CWE-639 Authorization Bypass Through User-Controlled Key
Affected products: vendor: GG Soft Software Services Inc.
product: PaperWork
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: LOW
availabilityImpact: NONE
baseSeverity: HIGH
baseScore: 7.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Credits: lang: en
value: Furkan YILDIZ
lang: en
value: Fatih KIRDAR
Published: 2025-12-17T09:11:33.139Z
CVE-2025-14103 Missing Authorization in GitLab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.7 before 18.7.5, 18.8 before 18.8.5, and 18.9 before 18.9.1 that could have allowed an unauthorized user with Developer-role permissions to set pipeline variables for manually triggered jobs under certain conditions.
Problem types: cwe_id: CWE-862
description: CWE-862: Missing Authorization
Affected products: vendor: GitLab
product: GitLab
cpes: cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: LOW
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
Credits: lang: en
value: Thanks [go7f0](https://hackerone.com/go7f0) for reporting this vulnerability through our HackerOne bug bounty program
Published: 2026-02-25T19:33:35.698Z
CVE-2025-14104 Util-linux: util-linux: heap buffer overread in setpwnam() when processing 256-byte usernames
A flaw was found in util-linux. This vulnerability allows a heap buffer overread when processing 256-byte usernames, specifically within the `setpwnam()` function, affecting SUID (Set User ID) login-utils utilities writing to the password database.
Problem types: cwe_id: CWE-125
description: Out-of-bounds Read
Affected products: vendor: util-linux
product: util-linux
default_status: unaffected
vendor: Red Hat
product: Red Hat Enterprise Linux 10
cpes: cpe:/o:redhat:enterprise_linux:10.1
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 8
cpes: cpe:/a:redhat:enterprise_linux:8::crb
cpe:/o:redhat:enterprise_linux:8::baseos
cpe:/a:redhat:enterprise_linux:8::appstream
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 8
cpes: cpe:/a:redhat:enterprise_linux:8::crb
cpe:/o:redhat:enterprise_linux:8::baseos
cpe:/a:redhat:enterprise_linux:8::appstream
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 9
cpes: cpe:/a:redhat:enterprise_linux:9::crb
cpe:/a:redhat:enterprise_linux:9::appstream
cpe:/o:redhat:enterprise_linux:9::baseos
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 9
cpes: cpe:/a:redhat:enterprise_linux:9::crb
cpe:/a:redhat:enterprise_linux:9::appstream
cpe:/o:redhat:enterprise_linux:9::baseos
default_status: affected
vendor: Red Hat
product: Red Hat Ceph Storage 7
cpes: cpe:/a:redhat:ceph_storage:7::el9
default_status: affected
vendor: Red Hat
product: Red Hat Ceph Storage 8
cpes: cpe:/a:redhat:ceph_storage:8::el9
default_status: affected
vendor: Red Hat
product: Red Hat Ceph Storage 9
cpes: cpe:/a:redhat:ceph_storage:9::el10
default_status: affected
vendor: Red Hat
product: Red Hat Hardened Images
cpes: cpe:/a:redhat:hummingbird:1
default_status: affected
vendor: Red Hat
product: Red Hat Insights proxy 1.5
cpes: cpe:/a:redhat:insights_proxy:1.5::el9
default_status: affected
vendor: Red Hat
product: Red Hat Update Infrastructure 5
cpes: cpe:/a:redhat:rhui:5::el9
default_status: affected
vendor: Red Hat
product: Red Hat Update Infrastructure 5
cpes: cpe:/a:redhat:rhui:5::el9
default_status: affected
vendor: Red Hat
product: Red Hat Update Infrastructure 5
cpes: cpe:/a:redhat:rhui:5::el9
default_status: affected
vendor: Red Hat
product: Red Hat Update Infrastructure 5
cpes: cpe:/a:redhat:rhui:5::el9
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 6
cpes: cpe:/o:redhat:enterprise_linux:6
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 7
cpes: cpe:/o:redhat:enterprise_linux:7
default_status: affected
vendor: Red Hat
product: Red Hat OpenShift Container Platform 4
cpes: cpe:/a:redhat:openshift:4
default_status: affected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 6.1
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H
version: 3.1
Published: 2025-12-05T16:22:09.283Z
CVE-2025-14105 TOZED ZLT M30S/ZLT M30S PRO Web proc_post denial of service
A vulnerability was determined in TOZED ZLT M30S and ZLT M30S PRO 1.47/3.09.06. This impacts an unknown function of the file /reqproc/proc_post of the component Web Interface. Executing manipulation of the argument goformId with the input REBOOT_DEVICE can lead to denial of service. The attack can only be done within the local network. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Problem types: cwe_id: CWE-404
description: Denial of Service
Affected products: vendor: TOZED
product: ZLT M30S
vendor: TOZED
product: ZLT M30S PRO
CVSS v3.1: version: 3.1
baseScore: 4.3
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R
baseSeverity: MEDIUM
Published: 2025-12-05T21:02:06.983Z
CVE-2025-14106 ZSPACE Q2C NAS HTTP POST Request close zfilev2_api.CloseSafe command injection
A vulnerability was identified in ZSPACE Q2C NAS up to 1.1.0210050. Affected is the function zfilev2_api.CloseSafe of the file /v2/file/safe/close of the component HTTP POST Request Handler. The manipulation of the argument safe_dir leads to command injection. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure and confirmed the existence of the vulnerability. A technical fix is planned to be released.
Problem types: cwe_id: CWE-77
description: Command Injection
cwe_id: CWE-74
description: Injection
Affected products: vendor: ZSPACE
product: Q2C NAS
CVSS v3.1: version: 3.1
baseScore: 8.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:C
baseSeverity: HIGH
Credits: lang: en
value: renguangyue (VulDB User)
Published: 2025-12-05T21:32:06.411Z
CVE-2025-14107 ZSPACE Q2C NAS HTTP POST Request status zfilev2_api.SafeStatus command injection
A security flaw has been discovered in ZSPACE Q2C NAS up to 1.1.0210050. Affected by this vulnerability is the function zfilev2_api.SafeStatus of the file /v2/file/safe/status of the component HTTP POST Request Handler. The manipulation of the argument safe_dir results in command injection. The attack may be performed from remote. The exploit has been released to the public and may be exploited. The vendor was contacted early about this disclosure and confirmed the existence of the vulnerability. A technical fix is planned to be released.
Problem types: cwe_id: CWE-77
description: Command Injection
cwe_id: CWE-74
description: Injection
Affected products: vendor: ZSPACE
product: Q2C NAS
CVSS v3.1: version: 3.1
baseScore: 8.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:C
baseSeverity: HIGH
Credits: lang: en
value: renguangyue (VulDB User)
Published: 2025-12-05T21:32:08.655Z
CVE-2025-14108 ZSPACE Q2C NAS HTTP POST Request open zfilev2_api.OpenSafe command injection
A weakness has been identified in ZSPACE Q2C NAS up to 1.1.0210050. Affected by this issue is the function zfilev2_api.OpenSafe of the file /v2/file/safe/open of the component HTTP POST Request Handler. This manipulation of the argument safe_dir causes command injection. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be exploited. The vendor was contacted early about this disclosure and confirmed the existence of the vulnerability. A technical fix is planned to be released.
Problem types: cwe_id: CWE-77
description: Command Injection
cwe_id: CWE-74
description: Injection
Affected products: vendor: ZSPACE
product: Q2C NAS
CVSS v3.1: version: 3.1
baseScore: 8.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:C
baseSeverity: HIGH
Credits: lang: en
value: renguangyue (VulDB User)
Published: 2025-12-05T22:02:05.032Z
CVE-2025-14109 AH Shortcodes <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'column' Shortcode Attribute
The AH Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'column' shortcode attribute in all versions up to, and including, 1.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: ahecht
product: AH Shortcodes
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
baseScore: 6.4
baseSeverity: MEDIUM
Credits: lang: en
value: zakaria
Published: 2026-01-07T09:20:51.814Z
CVE-2025-14110 WP Js List Pages Shortcodes <= 1.21 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'class' Shortcode Attribute
The WP Js List Pages Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'class' shortcode attribute in all versions up to, and including, 1.21 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: pichel
product: WP Js List Pages Shortcodes
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
baseScore: 6.4
baseSeverity: MEDIUM
Credits: lang: en
value: zakaria
Published: 2026-01-07T09:20:54.806Z
CVE-2025-14111 Rarlab RAR App com.rarlab.rar path traversal
A security vulnerability has been detected in Rarlab RAR App up to 7.11 Build 127 on Android. This affects an unknown part of the component com.rarlab.rar. Such manipulation leads to path traversal. It is possible to launch the attack remotely. Attacks of this nature are highly complex. It is indicated that the exploitability is difficult. The exploit has been disclosed publicly and may be used. Upgrading to version 7.20 build 128 is able to mitigate this issue. You should upgrade the affected component. The vendor responded very professional: "This is the real vulnerability affecting RAR for Android only. WinRAR and Unix RAR versions are not affected. We already fixed it in RAR for Android 7.20 build 128 and we publicly mentioned it in that version changelog. (...) To avoid confusion among users, it would be useful if such disclosure emphasizes that it is RAR for Android only issue and WinRAR isn't affected."
Problem types: cwe_id: CWE-22
description: Path Traversal
Affected products: vendor: Rarlab
product: RAR App
CVSS v3.1: version: 3.1
baseScore: 5
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C
baseSeverity: MEDIUM
Credits: lang: en
value: Lu1u (VulDB User)
Published: 2025-12-05T22:32:05.019Z
CVE-2025-14112 Snillrik Restaurant <= 2.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'menu_style' Shortcode Attribute
The Snillrik Restaurant plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'menu_style' shortcode attribute in all versions up to, and including, 2.3.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: mattiaspkallio
product: Snillrik Restaurant Menu
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
baseScore: 6.4
baseSeverity: MEDIUM
Credits: lang: en
value: zakaria
Published: 2026-01-07T09:20:57.838Z