rainbutterfly/cve_corpus huggingface dataset:
CVE-2025-53471 Emerson ValveLink Products Improper Input Validation
Emerson ValveLink products 
receive input or data, but does not validate or incorrectly 
validates that the input has the properties that are required to process
 the data safely and correctly.
Problem types: cwe_id: CWE-20
description: CWE-20
Affected products: vendor: Emerson
product: ValveLink SOLO
default_status: unaffected
vendor: Emerson
product: ValveLink DTM
default_status: unaffected
vendor: Emerson
product: ValveLink PRM
default_status: unaffected
vendor: Emerson
product: ValveLink SNAP-ON
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: LOCAL
attackComplexity: HIGH
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: HIGH
availabilityImpact: NONE
baseSeverity: MEDIUM
baseScore: 5.1
vectorString: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Credits: lang: en
value: Emerson reported these vulnerabilities to CISA.
Published: 2025-07-10T23:45:39.592Z
CVE-2025-53472 
WRC-BE36QS-B and WRC-W701-B contain an improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in WebGUI. If exploited, an arbitrary OS command may be executed by a remote attacker who can log in to WebGUI.
Problem types: cwe_id: CWE-78
description: Improper neutralization of special elements used in an OS command ('OS Command Injection')
Affected products: vendor: ELECOM CO.,LTD.
product: WRC-BE36QS-B
vendor: ELECOM CO.,LTD.
product: WRC-W701-B
CVSS v3.1: version: 3.1
baseSeverity: HIGH
baseScore: 7.2
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Published: 2025-07-22T09:30:01.735Z
CVE-2025-53473 
Server-side request forgery (SSRF) vulnerability exists n multiple versions of Nimesa Backup and Recovery, If this vulnerability is exploited, unintended requests may be sent to internal servers.
Problem types: cwe_id: CWE-918
description: Server-side request forgery (SSRF)
Affected products: vendor: Nimesa
product: Nimesa Backup and Recovery
vendor: Nimesa
product: Nimesa Backup and Recovery
vendor: Nimesa
product: Nimesa Backup and Recovery
Published: 2025-07-07T04:52:00.334Z
CVE-2025-53474 BIG-IP iRules vulnerability
When an iRule using an ILX::call command is configured on a virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Problem types: cwe_id: CWE-120
description: CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Affected products: vendor: F5
product: BIG-IP
default_status: unknown
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Credits: lang: en
value: F5
Published: 2025-10-15T13:55:41.723Z
CVE-2025-53475 Advantech iView SQL Injection
A vulnerability exists in Advantech iView that could allow for SQL 
injection and remote code execution through 
NetworkServlet.getNextTrapPage(). This issue requires an authenticated 
attacker with at least user-level privileges. Certain parameters in this
 function are not properly sanitized, allowing an attacker to perform 
SQL injection and potentially execute code in the context of the 'nt 
authority\local service' account.
Problem types: cwe_id: CWE-89
description: CWE-89
Affected products: vendor: Advantech
product: iView
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Alex Williams of Converge Technology Solutions reported these vulnerabilities to CISA.
Published: 2025-07-10T23:23:38.421Z
CVE-2025-53476 
A denial of service vulnerability exists in the ModbusTCP server functionality of OpenPLC _v3 a931181e8b81e36fadf7b74d5cba99b73c3f6d58. A specially crafted series of network connections can lead to the server not processing subsequent Modbus requests. An attacker can open a series of TCP connections to trigger this vulnerability.
Problem types: cwe_id: CWE-775
description: CWE-775: Missing Release of File Descriptor or Handle after Effective Lifetime
Affected products: vendor: OpenPLC
product: OpenPLC_v3
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: LOW
baseScore: 5.3
baseSeverity: MEDIUM
Credits: lang: en
value: Discovered by a member of Cisco Talos.
Published: 2025-10-07T13:49:56.656Z
CVE-2025-53477 Apache Mynewt NimBLE: NULL Pointer Dereference in NimBLE host HCI layer
NULL Pointer Dereference vulnerability in Apache Nimble.

Missing validation of HCI connection complete or HCI command TX buffer could lead to NULL pointer dereference.
This issue requires disabled asserts and broken or bogus Bluetooth controller and thus severity is considered low.

This issue affects Apache NimBLE: through 1.8.0.

Users are recommended to upgrade to version 1.9.0, which fixes the issue.
Problem types: cwe_id: CWE-476
description: CWE-476 NULL Pointer Dereference
Affected products: vendor: Apache Software Foundation
product: Apache Mynewt NimBLE
default_status: unaffected
Credits: lang: en
value: 雷重庆 <leicq@seu.edu.cn>
Published: 2026-01-10T09:45:27.630Z
CVE-2025-53478 CheckUser: Reflected Cross-Site Scripting (XSS) in Special:Investigate via unsanitized i18n messages
The CheckUser extension’s Special:Investigate interface is vulnerable to reflected XSS due to improper escaping of certain internationalized system messages rendered on the “IPs and User agents” tab.




This issue affects Mediawiki - CheckUser extension: from 1.39.X before 1.39.13, from 1.42.X before 1.42.7, from 1.43.X before 1.43.2.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: Wikimedia Foundation
product: Mediawiki - CheckUser extension
default_status: unaffected
Published: 2025-07-07T18:16:33.919Z
CVE-2025-53479 CheckUser: Reflected Cross-Site Scripting (XSS) in Special:CheckUser via unsanitized internationalized message
The CheckUser extension’s Special:CheckUser interface is vulnerable to reflected XSS via the rev-deleted-user message. This message is rendered without proper escaping, making it possible to inject JavaScript through the uselang=x-xss language override mechanism.




This issue affects Mediawiki - CheckUser extension: from 1.42.X before 1.42.7, from 1.43.X before 1.43.2.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: Wikimedia Foundation
product: Mediawiki - CheckUser extension
default_status: unaffected
Published: 2025-07-08T17:16:36.081Z
CVE-2025-53480 CheckUser: Reflected Cross-Site Scripting (XSS) in Special:Investigate (Account information tab) via unsanitized i18n messages
The CheckUser extension’s Special:Investigate page has a vulnerability in the Account information tab, where specific internationalized messages are rendered without proper escaping. Attackers can exploit this by appending ?uselang=x-xss to the URL, causing reflected XSS when the UI renders affected message keys.




This issue affects Mediawiki - CheckUser extension: from 1.39.X before 1.39.13, from 1.42.X before 1.42.7, from 1.43.X before 1.43.2.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: Wikimedia Foundation
product: Mediawiki - CheckUser extension
default_status: unaffected
Published: 2025-07-08T14:58:37.544Z
CVE-2025-53481 Denial of service vector on ipinfo/v0/norevision
Uncontrolled Resource Consumption vulnerability in Wikimedia Foundation Mediawiki - IPInfo Extension allows Excessive Allocation.This issue affects Mediawiki - IPInfo Extension: from 1.39.X before 1.39.13, from 1.42.X before 1.42.7, from 1.43.X before 1.43.2.
Problem types: cwe_id: CWE-400
description: CWE-400 Uncontrolled Resource Consumption
Affected products: vendor: Wikimedia Foundation
product: Mediawiki - IPInfo Extension
default_status: unaffected
Published: 2025-07-04T15:47:46.299Z
CVE-2025-53482 IPInfo: Message key XSS through several IPInfo messages in infobox and popup
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - IPInfo Extension allows Cross-Site Scripting (XSS).This issue affects Mediawiki - IPInfo Extension: from 1.39.X before 1.39.13, from 1.42.X before 1.42.7, from 1.43.X before 1.43.2.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: Wikimedia Foundation
product: Mediawiki - IPInfo Extension
default_status: unaffected
Published: 2025-07-04T16:01:46.252Z
CVE-2025-53483 SecurePoll: Multiple admin actions vulnerable to Cross-Site Request Forgery
ArchivePage.php, UnarchivePage.php, and VoterEligibilityPage#executeClear() do not validate request methods or CSRF tokens, allowing attackers to trigger sensitive actions if an admin visits a malicious site.




This issue affects Mediawiki - SecurePoll extension: from 1.39.X before 1.39.13, from 1.42.X before 1.42.7, from 1.43.X before 1.43.2.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Wikimedia Foundation
product: Mediawiki - SecurePoll extension
default_status: unaffected
Published: 2025-07-04T17:28:40.374Z
CVE-2025-53484 SecurePoll: Multiple locations vulnerable to Cross-Site Scripting (XSS) via unescaped input
User-controlled inputs are improperly escaped in:




  *  
VotePage.php (poll option input)



  *  
ResultPage::getPagesTab() and getErrorsTab() (user-controllable page names)












This allows attackers to inject JavaScript and compromise user sessions under certain conditions.




This issue affects Mediawiki - SecurePoll extension: from 1.39.X before 1.39.13, from 1.42.X before 1.42.7, from 1.43.X before 1.43.2.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: Wikimedia Foundation
product: Mediawiki - SecurePoll extension
default_status: unaffected
Published: 2025-07-04T17:34:24.470Z
CVE-2025-53485 SecurePoll: Unauthorized access to SetTranslationHandler allows arbitrary text changes
SetTranslationHandler.php does not validate that the user is an election admin, allowing any (even unauthenticated) user to change election-related translation text. While partially broken in newer MediaWiki versions, the check is still missing.




This issue affects Mediawiki - SecurePoll extension: from 1.39.X before 1.39.13, from 1.42.X before 1.42.7, from 1.43.X before 1.43.2.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: Wikimedia Foundation
product: Mediawiki - SecurePoll extension
default_status: unaffected
Published: 2025-07-04T17:39:36.272Z
CVE-2025-53486 WikiCategoryTagCloud: Reflected Cross-Site Scripting (XSS) via linkstyle attribute in parser function
The WikiCategoryTagCloud extension is vulnerable to reflected XSS via the linkstyle attribute, which is improperly concatenated into inline HTML without escaping. An attacker can inject JavaScript event handlers such as onmouseenter using carefully crafted input via the {{#tag:tagcloud}} parser function, resulting in arbitrary JavaScript execution when a victim hovers over a link in the category cloud.




The vulnerability exists because the linkstyle parameter is only passed through Sanitizer::checkCss() (which does not escape HTML) and is then directly inserted into a style attribute using string concatenation instead of Html::element or Html::openElement.




This issue affects Mediawiki - WikiCategoryTagCloud extension: from 1.39.X before 1.39.13, from 1.42.X before 1.42.7, from 1.43.X before 1.43.2.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: Wikimedia Foundation
product: Mediawiki - WikiCategoryTagCloud extension
default_status: unaffected
Published: 2025-07-07T15:07:44.875Z
CVE-2025-53487 ApprovedRevs: Stored Cross-Site Scripting (XSS) via unsanitized system messages
The ApprovedRevs extension for MediaWiki is vulnerable to stored XSS in multiple locations where system messages are inserted into raw HTML without proper escaping. Attackers can exploit this by injecting JavaScript payloads via the uselang=x-xss language override, which causes crafted message keys to be rendered unescaped.




This issue affects Mediawiki - ApprovedRevs extension: from 1.39.X before 1.39.13, from 1.42.X before 1.42.7, from 1.43.X before 1.43.2.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: Wikimedia Foundation
product: Mediawiki - ApprovedRevs extension
default_status: unaffected
Published: 2025-07-07T15:13:38.574Z
CVE-2025-53488 Stored XSS in WikiHiero
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - WikiHiero Extension allows Stored XSS.This issue affects Mediawiki - WikiHiero Extension: from 1.43.X before 1.43.2.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: Wikimedia Foundation
product: Mediawiki - WikiHiero Extension
default_status: unaffected
Credits: lang: en
value: SomeRandomDeveloper
Published: 2025-07-07T18:44:40.031Z
CVE-2025-53489 XSS in GoogleDocs4MW
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - GoogleDocs4MW Extension allows Cross-Site Scripting (XSS).This issue affects Mediawiki - GoogleDocs4MW Extension: from 1.42.X before 1.42.7, from 1.43.X before 1.43.2.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: Wikimedia Foundation
product: Mediawiki - GoogleDocs4MW Extension
default_status: unaffected
Credits: lang: en
value: SomeRandomDeveloper
Published: 2025-07-03T16:06:46.491Z
CVE-2025-53490 Multiple XSS in CampaignEvents
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - CampaignEvents Extension allows Cross-Site Scripting (XSS).This issue affects Mediawiki - CampaignEvents Extension: from 1.43.X before 1.43.2.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: Wikimedia Foundation
product: Mediawiki - CampaignEvents Extension
default_status: unaffected
Credits: lang: en
value: Daimona
Published: 2025-07-03T16:04:05.491Z
CVE-2025-53491 XSS in FlaggedRevs
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - FlaggedRevs Extension allows Cross-Site Scripting (XSS).This issue affects Mediawiki - FlaggedRevs Extension: from 1.43.X before 1.43.2.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: Wikimedia Foundation
product: Mediawiki - FlaggedRevs Extension
default_status: unaffected
Credits: lang: en
value: Dreamy_Jazz
Published: 2025-07-07T16:17:29.771Z
CVE-2025-53492 Stored XSS in MintyDocs
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - MintyDocs Extension allows Stored XSS.This issue affects Mediawiki - MintyDocs Extension: from 1.43.X before 1.43.2.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: Wikimedia Foundation
product: Mediawiki - MintyDocs Extension
default_status: unaffected
Credits: lang: en
value: SomeRandomDeveloper
Published: 2025-07-02T14:41:52.046Z
CVE-2025-53493 Stored XSS in MintyDocs
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - MintyDocs Extension allows Stored XSS.This issue affects Mediawiki - MintyDocs Extension: from 1.43.X before 1.43.2.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: Wikimedia Foundation
product: Mediawiki - MintyDocs Extension
default_status: unaffected
Credits: lang: en
value: SomeRandomDeveloper
Published: 2025-07-02T14:38:07.470Z
CVE-2025-53494 Stored XSS in TwoColConflict
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - TwoColConflict Extension allows Stored XSS.This issue affects Mediawiki - TwoColConflict Extension: from 1.39.X before 1.39.13, from 1.42.X before 1.42.7, from 1.43.X before 1.43.2.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: Wikimedia Foundation
product: Mediawiki - TwoColConflict Extension
default_status: unaffected
Credits: lang: en
value: SomeRandomDeveloper
Published: 2025-07-02T14:24:54.021Z
CVE-2025-53495 Unauthorized Disclosure of IP Reputation in AbuseFilter
Missing Authorization vulnerability in Wikimedia Foundation Mediawiki - AbuseFilter Extension allows Unauthorized Access.This issue affects Mediawiki - AbuseFilter Extension: from 1.43.X before 1.43.2.
Problem types: cwe_id: CWE-862
description: CWE-862: Missing Authorization
Affected products: vendor: Wikimedia Foundation
product: Mediawiki - AbuseFilter Extension
default_status: unaffected
Credits: lang: en
value: Dreamy Jazz
Published: 2025-07-07T18:30:31.465Z
CVE-2025-53496 Stored XSS in MediaSearch
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - MediaSearch Extension allows Stored XSS.This issue affects Mediawiki - MediaSearch Extension: from 1.42.X before 1.42.7, from 1.43.X before 1.43.2.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: Wikimedia Foundation
product: Mediawiki - MediaSearch Extension
default_status: unaffected
Credits: lang: en
value: SomeRandomDeveloper
Published: 2025-07-07T19:12:46.564Z
CVE-2025-53497 Stored XSS in RelatedArticles
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - RelatedArticles Extension allows Stored XSS.This issue affects Mediawiki - RelatedArticles Extension: from 1.43.X before 1.43.2.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: Wikimedia Foundation
product: Mediawiki - RelatedArticles Extension
default_status: unaffected
Credits: lang: en
value: SomeRandomDeveloper
Published: 2025-07-07T16:28:49.827Z
CVE-2025-53498 Lack of Audit Logging in AbuseFilter
Insufficient Logging vulnerability in Wikimedia Foundation Mediawiki - AbuseFilter Extension allows Data Leakage Attacks.This issue affects Mediawiki - AbuseFilter Extension: from 1.43.X before 1.43.2.
Problem types: cwe_id: CWE-778
description: CWE-778: Insufficient Logging
Affected products: vendor: Wikimedia Foundation
product: Mediawiki - AbuseFilter Extension
default_status: unaffected
Credits: lang: en
value: Dreamy Jazz
Published: 2025-07-07T18:35:48.826Z
CVE-2025-53499 Unauthorized Inspection of Protected Variables in AbuseFilter
Missing Authorization vulnerability in Wikimedia Foundation Mediawiki - AbuseFilter Extension allows Unauthorized Access.This issue affects Mediawiki - AbuseFilter Extension: from 1.43.X before 1.43.2.
Problem types: cwe_id: CWE-862
description: CWE-862: Missing Authorization
Affected products: vendor: Wikimedia Foundation
product: Mediawiki - AbuseFilter Extension
default_status: affected
Credits: lang: en
value: Dreamy_Jazz
Published: 2025-07-07T18:33:12.173Z
CVE-2025-53500 Stored XSS in MassEditRegex
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - MassEditRegex Extension allows Stored XSS.This issue affects Mediawiki - MassEditRegex Extension: from 1.39.X before 1.39.12, from 1.42.X before 1.42.7, from 1.43.X before 1.43.2.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: Wikimedia Foundation
product: Mediawiki - MassEditRegex Extension
default_status: unaffected
Credits: lang: en
value: SomeRandomDeveloper
Published: 2025-07-03T16:17:38.293Z
CVE-2025-53501 Content Access Bypass in Scribunto
Improper Access Control vulnerability in Wikimedia Foundation Mediawiki - Scribunto Extension allows : Accessing Functionality Not Properly Constrained by Authorization.This issue affects Mediawiki - Scribunto Extension: from 1.39.X before 1.39.12, from 1.42.X before 1.42.7, from 1.43.X before 1.43.2.
Problem types: cwe_id: CWE-284
description: CWE-284: Improper Access Control
Affected products: vendor: Wikimedia Foundation
product: Mediawiki - Scribunto Extension
default_status: unaffected
Credits: lang: en
value: Leo768
Published: 2025-07-03T16:15:52.588Z
CVE-2025-53502 HTML injection in FeaturedFeeds
Improper Input Validation vulnerability in Wikimedia Foundation Mediawiki - FeaturedFeeds Extension allows Cross-Site Scripting (XSS).This issue affects Mediawiki - FeaturedFeeds Extension: 1.39.X, 1.42.X, 1.43.X.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: Wikimedia Foundation
product: Mediawiki - FeaturedFeeds Extension
default_status: unaffected
Credits: lang: en
value: Legoktm
Published: 2025-07-03T16:11:07.054Z
CVE-2025-53503 
Trend Micro Cleaner One Pro is vulnerable to a Privilege Escalation vulnerability that could allow a local attacker to unintentionally delete privileged Trend Micro files including its own.
Problem types: cwe_id: CWE-64
description: CWE-64: Windows Shortcut Following (.LNK)
Affected products: vendor: Trend Micro, Inc.
product: Trend Micro Cleaner One Pro
cpes: cpe:2.3:a:trendmicro:cleaner_pro_one:6.8.333:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Published: 2025-07-10T18:59:17.266Z
CVE-2025-53504 
Group-Office versions prior to 6.8.119 and prior to 25.0.20 provided by Intermesh BV contain a cross-site scripting vulnerability. If this vulnerability is exploited, an arbitrary script may be executed in the user's web browser.
Problem types: cwe_id: CWE-79
description: Cross-site scripting (XSS)
Affected products: vendor: Intermesh BV
product: Group-Office
vendor: Intermesh BV
product: Group-Office
Published: 2025-08-21T04:29:14.292Z