rainbutterfly/cve_corpus huggingface dataset:
CVE-2025-13062 Supreme Modules Lite <= 2.5.62 - Authenticated (Author+) Arbitrary File Upload via JSON Upload Bypass
The Supreme Modules Lite plugin for WordPress is vulnerable to arbitrary file upload in all versions up to, and including, 2.5.62. This is due to insufficient file type validation detecting JSON files, allowing double extension files to bypass sanitization while being accepted as a valid JSON file. This makes it possible for authenticated attackers, with author-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Problem types: cwe_id: CWE-434
description: CWE-434 Unrestricted Upload of File with Dangerous Type
Affected products: vendor: divisupreme
product: Supreme Modules Lite – Divi Theme, Extra Theme and Divi Builder
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
baseScore: 8.8
baseSeverity: HIGH
Credits: lang: en
value: Michael Mazzolini
Published: 2026-01-15T13:23:24.756Z
CVE-2025-13063 DinukaNavaratna Dee Store authorization
A flaw has been found in DinukaNavaratna Dee Store 1.0. Affected is an unknown function. Executing manipulation can lead to missing authorization. The attack may be performed from remote. The exploit has been published and may be used. Multiple endpoints are affected.
Problem types: cwe_id: CWE-862
description: Missing Authorization
cwe_id: CWE-863
description: Incorrect Authorization
Affected products: vendor: DinukaNavaratna
product: Dee Store
CVSS v3.1: version: 3.1
baseScore: 7.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
baseSeverity: HIGH
Credits: lang: en
value: ixpqxi (VulDB User)
Published: 2025-11-12T21:02:07.581Z
CVE-2025-13064 
A server-side injection was possible for a malicious admin to manipulate the application to include a malicious script which is executed by the server. This attack is only possible if the admin uses a client that have been tampered with.
Problem types: cwe_id: CWE-248
description: CWE-248: Uncaught Exception
Affected products: vendor: Axis Communications AB
product: AXIS Camera Station Pro
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: HIGH
baseScore: 4.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Credits: lang: en
value: Seth Fogie
Published: 2026-02-10T05:40:34.374Z
CVE-2025-13065 Starter Templates <= 4.4.41 - Authenticated (Author+) Arbitrary File Upload via WXR Upload Bypass
The Starter Templates plugin for WordPress is vulnerable to arbitrary file upload in all versions up to, and including, 4.4.41. This is due to insufficient file type validation detecting WXR files, allowing double extension files to bypass sanitization while being accepted as a valid WXR file. This makes it possible for authenticated attackers, with author-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Problem types: cwe_id: CWE-434
description: CWE-434 Unrestricted Upload of File with Dangerous Type
Affected products: vendor: brainstormforce
product: Starter Templates – AI-Powered Templates for Elementor & Gutenberg
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
baseScore: 8.8
baseSeverity: HIGH
Credits: lang: en
value: Michael Mazzolini
Published: 2025-12-06T09:25:58.467Z
CVE-2025-13066 Demo Importer Plus <= 2.0.6 - Authenticated (Author+) Arbitrary File Upload via WXR Upload Bypass
The Demo Importer Plus plugin for WordPress is vulnerable to arbitrary file upload in all versions up to, and including, 2.0.6. This is due to insufficient file type validation detecting WXR files, allowing double extension files to bypass sanitization while being accepted as a valid WXR file. This makes it possible for authenticated attackers, with author-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Problem types: cwe_id: CWE-434
description: CWE-434 Unrestricted Upload of File with Dangerous Type
Affected products: vendor: kraftplugins
product: Demo Importer Plus
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
baseScore: 8.8
baseSeverity: HIGH
Credits: lang: en
value: Michael Mazzolini
Published: 2025-12-05T03:28:36.875Z
CVE-2025-13067 Royal Addons for Elementor <= 1.7.1049 - Authenticated (Author+) Arbitrary File Upload via main.php Upload Bypass
The Royal Addons for Elementor plugin for WordPress is vulnerable to arbitrary file upload in all versions up to, and including, 1.7.1049. This is due to insufficient file type validation detecting files named main.php, allowing a file with such a name to bypass sanitization. This makes it possible for authenticated attackers, with author-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Problem types: cwe_id: CWE-434
description: CWE-434 Unrestricted Upload of File with Dangerous Type
Affected products: vendor: wproyal
product: Royal Addons for Elementor – Addons and Templates Kit for Elementor
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
baseScore: 8.8
baseSeverity: HIGH
Credits: lang: en
value: Michael Mazzolini
Published: 2026-03-11T04:25:47.029Z
CVE-2025-13068 Telegram Bot & Channel <= 4.1 - Unauthenticated Stored Cross-Site Scripting via Telegram Username
The Telegram Bot & Channel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Telegram username in all versions up to, and including, 4.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: milmor
product: Telegram Bot & Channel
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
baseScore: 7.2
baseSeverity: HIGH
Credits: lang: en
value: venom 5iix
Published: 2025-11-25T04:38:01.612Z
CVE-2025-13069 Enable SVG, WebP, and ICO Upload <= 1.1.3 - Authenticated (Author+) Arbitrary File Upload via ICO Upload Bypass
The Enable SVG, WebP, and ICO Upload plugin for WordPress is vulnerable to arbitrary file upload in all versions up to, and including, 1.1.3. This is due to insufficient file type validation detecting ICO files, allowing double extension files with the appropriate magic bytes to bypass sanitization while being accepted as a valid ICO file. This makes it possible for authenticated attackers, with author-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Problem types: cwe_id: CWE-434
description: CWE-434 Unrestricted Upload of File with Dangerous Type
Affected products: vendor: ideastocode
product: Enable SVG, WebP, and ICO Upload
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
baseScore: 8.8
baseSeverity: HIGH
Credits: lang: en
value: Michael Mazzolini
Published: 2025-11-18T09:27:37.930Z
CVE-2025-13070 CSV to SortTable <= 4.2 - Contributor+ LFI
The CSV to SortTable WordPress plugin through 4.2 does not validate some shortcode attributes before using them to generate paths passed to include function/s, allowing any authenticated users such as contributor to perform LFI attacks.
Problem types: description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: Unknown
product: CSV to SortTable
default_status: unknown
Credits: lang: en
value: Ivan Cese
lang: en
value: WPScan
Published: 2025-12-09T06:00:08.117Z
CVE-2025-13071 Custom Admin Menu <= 1.0.0 - Reflected XSS
The Custom Admin Menu WordPress plugin through 1.0.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: Custom Admin Menu
default_status: unknown
Credits: lang: en
value: Yousof Nahya
lang: en
value: WPScan
Published: 2025-12-09T06:00:08.538Z
CVE-2025-13072 HandL UTM Grabber / Tracker < 2.8.1 - Reflected XSS via utm_source
The HandL UTM Grabber / Tracker WordPress plugin before 2.8.1 does not sanitize and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: HandL UTM Grabber / Tracker
default_status: unaffected
Credits: lang: en
value: Alex Tselevich (nos3curity)
lang: en
value: WPScan
Published: 2025-12-10T06:00:11.341Z
CVE-2025-13073 HandL UTM Grabber / Tracker < 2.8.1 - Reflected XSS via handl_landing_page
The HandL UTM Grabber / Tracker WordPress plugin before 2.8.1 does not sanitize and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: HandL UTM Grabber / Tracker
default_status: unaffected
Credits: lang: en
value: Alex Tselevich (nos3curity)
lang: en
value: WPScan
Published: 2025-12-10T06:00:12.738Z
CVE-2025-13075 code-projects Responsive Hotel Site usersettingdel.php sql injection
A vulnerability was detected in code-projects Responsive Hotel Site 1.0. Impacted is an unknown function of the file /admin/usersettingdel.php. Performing manipulation of the argument eid results in sql injection. Remote exploitation of the attack is possible. The exploit is now public and may be used.
Problem types: cwe_id: CWE-89
description: SQL Injection
cwe_id: CWE-74
description: Injection
Affected products: vendor: code-projects
product: Responsive Hotel Site
CVSS v3.1: version: 3.1
baseScore: 4.7
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
baseSeverity: MEDIUM
Credits: lang: en
value: 647661917 (VulDB User)
Published: 2025-11-12T22:32:05.898Z
CVE-2025-13076 code-projects Responsive Hotel Site usersetting.php sql injection
A flaw has been found in code-projects Responsive Hotel Site 1.0. The affected element is an unknown function of the file /admin/usersetting.php. Executing manipulation of the argument usname can lead to sql injection. The attack can be executed remotely. The exploit has been published and may be used.
Problem types: cwe_id: CWE-89
description: SQL Injection
cwe_id: CWE-74
description: Injection
Affected products: vendor: code-projects
product: Responsive Hotel Site
CVSS v3.1: version: 3.1
baseScore: 4.7
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
baseSeverity: MEDIUM
Credits: lang: en
value: 647661917 (VulDB User)
Published: 2025-11-12T23:02:06.294Z
CVE-2025-13077 افزونه پیامک ووکامرس فوق حرفه ای (جدید) payamito sms woocommerce <= 1.3.5 - Unauthenticated Time-Based Blind SQL Injection
The افزونه پیامک ووکامرس فوق حرفه ای (جدید) payamito sms woocommerce plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'columns' parameter in all versions up to, and including, 1.3.5. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: payamito
product: افزونه پیامک ووکامرس فوق حرفه ای (جدید) payamito sms woocommerce
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
baseScore: 7.5
baseSeverity: HIGH
Credits: lang: en
value: lucky_buddy
Published: 2025-12-13T04:31:26.917Z
CVE-2025-13078 Improper Validation of Specified Quantity in Input in GitLab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.10 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 that could have allowed an authenticated user to cause a denial of service due to excessive resource consumption when processing certain webhook configuration inputs.
Problem types: cwe_id: CWE-1284
description: CWE-1284: Improper Validation of Specified Quantity in Input
Affected products: vendor: GitLab
product: GitLab
cpes: cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
baseScore: 6.5
baseSeverity: MEDIUM
Credits: lang: en
value: Thanks [lucky_luke](https://hackerone.com/lucky_luke) for reporting this vulnerability through our HackerOne bug bounty program
Published: 2026-03-25T16:35:03.858Z
CVE-2025-13079 Popup Builder - Create highly converting, mobile friendly marketing popups. <= 4.4.2 - Improper Authorization to Unauthenticated Subscriber Removal via Predictable Tokens
The Popup Builder – Create highly converting, mobile friendly marketing popups. plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.4.2. This is due to the plugin generating predictable unsubscribe tokens using deterministic data. This makes it possible for unauthenticated attackers to unsubscribe arbitrary subscribers from mailing lists via brute-forcing the unsubscribe token, granted they know the victim's email address
Problem types: cwe_id: CWE-1241
description: CWE-1241 Use of Predictable Algorithm in Random Number Generator
Affected products: vendor: popupbuilder
product: Popup Builder – Create highly converting, mobile friendly marketing popups.
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
baseScore: 5.3
baseSeverity: MEDIUM
Credits: lang: en
value: Rafshanzani Suhada
Published: 2026-02-19T03:25:14.826Z
CVE-2025-13080 Drupal core - Moderately critical - Denial of Service - SA-CORE-2025-005
Improper Check for Unusual or Exceptional Conditions vulnerability in Drupal Drupal core allows Forceful Browsing.This issue affects Drupal core: from 8.0.0 before 10.4.9, from 10.5.0 before 10.5.6, from 11.0.0 before 11.1.9, from 11.2.0 before 11.2.8.
Problem types: cwe_id: CWE-754
description: CWE-754 Improper Check for Unusual or Exceptional Conditions
Affected products: vendor: Drupal
product: Drupal core
default_status: unaffected
Credits: lang: en
value: Dragos Dumitrescu (dragos-dumi)
lang: en
value: yasser ALLAM (inzo_)
lang: en
value: Nils Destoop (nils.destoop)
lang: en
value: Sven Decabooter (svendecabooter)
lang: en
value: zhero
lang: en
value: Alex Pott (alexpott)
lang: en
value: catch (catch)
lang: en
value: cilefen  (cilefen)
lang: en
value: Jen Lampton (jenlampton)
lang: en
value: Lee Rowlands (larowlan)
lang: en
value: Dave Long (longwave)
lang: en
value: Drew Webber (mcdruid)
lang: en
value: Nils Destoop (nils.destoop)
lang: en
value: Juraj Nemec (poker10)
lang: en
value: Ra MÃ¤nd (ram4nd)
lang: en
value: Jess  (xjm)
lang: en
value: catch (catch)
lang: en
value: Greg Knaddison (greggles)
lang: en
value: Lee Rowlands (larowlan)
lang: en
value: Dave Long (longwave)
lang: en
value: Drew Webber (mcdruid)
lang: en
value: Juraj Nemec (poker10)
lang: en
value: Jess  (xjm)
Published: 2025-11-18T16:54:32.042Z
CVE-2025-13081 Drupal core - Moderately critical - Gadget chain - SA-CORE-2025-006
Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection.This issue affects Drupal core: from 8.0.0 before 10.4.9, from 10.5.0 before 10.5.6, from 11.0.0 before 11.1.9, from 11.2.0 before 11.2.8.
Problem types: cwe_id: CWE-915
description: CWE-915 Improperly Controlled Modification of Dynamically-Determined Object Attributes
Affected products: vendor: Drupal
product: Drupal core
default_status: unaffected
Credits: lang: en
value: anzuukino
lang: en
value: Anna Kalata (akalata)
lang: en
value: catch (catch)
lang: en
value: Neil Drumm (drumm)
lang: en
value: Greg Knaddison (greggles)
lang: en
value: Lee Rowlands (larowlan)
lang: en
value: Dave Long (longwave)
lang: en
value: Drew Webber (mcdruid)
lang: en
value: Juraj Nemec (poker10)
lang: en
value: Ra MÃ¤nd (ram4nd)
lang: en
value: Jess (xjm)
lang: en
value: catch (catch)
lang: en
value: Lee Rowlands (larowlan)
lang: en
value: Dave Long (longwave)
lang: en
value: Drew Webber (mcdruid)
lang: en
value: Juraj Nemec (poker10)
Published: 2025-11-18T16:54:56.214Z
CVE-2025-13082 Drupal core - Moderately critical - Defacement - SA-CORE-2025-007
User Interface (UI) Misrepresentation of Critical Information vulnerability in Drupal Drupal core allows Content Spoofing.This issue affects Drupal core: from 8.0.0 before 10.4.9, from 10.5.0 before 10.5.6, from 11.0.0 before 11.1.9, from 11.2.0 before 11.2.8.
Problem types: cwe_id: CWE-451
description: CWE-451 User Interface (UI) Misrepresentation of Critical Information
Affected products: vendor: Drupal
product: Drupal core
default_status: unaffected
Credits: lang: en
value: Kevin Quillen (kevinquillen)
lang: en
value: Benji Fisher (benjifisher)
lang: en
value: Neil Drumm (drumm)
lang: en
value: Greg Knaddison (greggles)
lang: en
value: Lee Rowlands (larowlan)
lang: en
value: Drew Webber (mcdruid)
lang: en
value: Mingsong  (mingsong)
lang: en
value: Juraj Nemec (poker10)
lang: en
value: Ra MÃ¤nd (ram4nd)
lang: en
value: Jess  (xjm)
lang: en
value: catch (catch)
lang: en
value: Lee Rowlands (larowlan)
lang: en
value: Dave Long (longwave)
lang: en
value: Juraj Nemec (poker10)
Published: 2025-11-18T16:55:16.062Z
CVE-2025-13083 Drupal core - Moderately critical - Information disclosure - SA-CORE-2025-008
Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Drupal core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Drupal core: from 8.0.0 before 10.4.9, from 10.5.0 before 10.5.6, from 11.0.0 before 11.1.9, from 11.2.0 before 11.2.8, from 7.0 before 7.103.
Problem types: cwe_id: CWE-525
description: CWE-525 Use of Web Browser Cache Containing Sensitive Information
Affected products: vendor: Drupal
product: Drupal core
default_status: unaffected
Credits: lang: en
value: Damien McKenna (damienmckenna)
lang: en
value: tame4tex
lang: en
value: Benji Fisher (benjifisher)
lang: en
value: catch (catch)
lang: en
value: Neil Drumm (drumm)
lang: en
value: Lee Rowlands (larowlan)
lang: en
value: Mingsong  (mingsong)
lang: en
value: Mohit Aghera (mohit_aghera)
lang: en
value: James Gilliland (neclimdul)
lang: en
value: Juraj Nemec (poker10)
lang: en
value: Jess  (xjm)
lang: en
value: catch (catch)
lang: en
value: Lee Rowlands (larowlan)
lang: en
value: Dave Long (longwave)
lang: en
value: Drew Webber (mcdruid)
lang: en
value: Juraj Nemec (poker10)
Published: 2025-11-18T16:55:37.269Z
CVE-2025-13084 Opto 22 groov View Exposure of Sensitive Information Through Metadata
The users endpoint in the groov View API returns a list of all users and
 associated metadata including their API keys. This endpoint requires an
 Editor role to access and will display API keys for all users, 
including Administrators.
Problem types: cwe_id: CWE-1230
description: CWE-1230
Affected products: vendor: Opto 22
product: groov View Server
default_status: unaffected
vendor: Opto 22
product: GRV-EPIC-PR1 Firmware
default_status: unaffected
vendor: Opto 22
product: GRV-EPIC-PR2 Firmware
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 7.6
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L
version: 3.1
Credits: lang: en
value: Nik Tsytsarkin, Ismail Aydemir, and Ryan Hall of Meta reported this vulnerability to CISA.
Published: 2025-11-26T17:39:37.931Z
CVE-2025-13085 SiteSEO – SEO Simplified <= 1.3.2 - Insecure Direct Object Reference to Sensitive Post Meta Disclosure
The SiteSEO – SEO Simplified plugin for WordPress is vulnerable to Improper Authorization leading to Sensitive Post Meta Disclosure in versions up to and including 1.3.2. This is due to missing object-level authorization checks in the resolve_variables() AJAX handler. This makes it possible for authenticated attackers with the siteseo_manage capability (e.g., Author-level users who have been granted SiteSEO access by an administrator) to read arbitrary post metadata from any post, page, attachment, or WooCommerce order they cannot edit, via the custom field variable resolution feature granted they have been given access to SiteSEO by an administrator and legacy storage is enabled. In affected WooCommerce installations, this exposes sensitive customer billing information including names, email addresses, phone numbers, physical addresses, and payment methods.
Problem types: cwe_id: CWE-285
description: CWE-285 Improper Authorization
Affected products: vendor: softaculous
product: SiteSEO – SEO Simplified
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
baseScore: 4.3
baseSeverity: MEDIUM
Credits: lang: en
value: Athiwat Tiprasaharn
Published: 2025-11-19T06:45:25.339Z
CVE-2025-13086 
Improper validation of source IP addresses in OpenVPN version 2.6.0 through 2.6.15 and 2.7_alpha1 through 2.7_rc1 allows an attacker to open a session from a different IP address which did not initiate the connection resulting in a denial of service for the originating client
Problem types: cwe_id: CWE-940
description: CWE-940: Improper Verification of Source of a Communication Channel
Affected products: vendor: OpenVPN
product: OpenVPN
default_status: unaffected
Published: 2025-12-03T19:54:10.737Z
CVE-2025-13087 Command Injection in Opto22 Groov REST API
A vulnerability exists in the Opto22 Groov Manage REST API on GRV-EPIC and groov RIO Products that allows remote code execution with root privileges. When a POST request is executed against the vulnerable endpoint, the application reads certain header details and unsafely uses these values to build commands, allowing an attacker with administrative privileges to inject arbitrary commands that execute as root.
Problem types: cwe_id: CWE-78
description: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: Opto22
product: GRV-EPIC-PR1
default_status: unaffected
vendor: Opto22
product: GRV-EPIC-PR2
default_status: unaffected
vendor: Opto22
product: groov RIO GRV-R7-MM1001-10
default_status: unaffected
vendor: Opto22
product: groov RIO GRV-R7-MM2001-10
default_status: unaffected
vendor: Opto22
product: groov RIO GRV-R7-I1VAPM-3
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 6.2
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:L
version: 3.1
Credits: lang: en
value: Nik Tsytsarkin of Meta reported this vulnerability to CISA.
lang: en
value: Ismail Aydemir of Meta reported this vulnerability to CISA.
lang: en
value: Ryan Hall of Meta reported this vulnerability to CISA.
Published: 2025-11-20T21:32:37.510Z