diff --git a/2024/13xxx/CVE-2024-13791.json b/2024/13xxx/CVE-2024-13791.json
index 26a4ad67c94..bec1b053094 100644
--- a/2024/13xxx/CVE-2024-13791.json
+++ b/2024/13xxx/CVE-2024-13791.json
@@ -1,17 +1,95 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2024-13791",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@wordfence.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "Bit Assist plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.5.2 via the downloadResponseFile() function. This makes it possible for authenticated attackers, with Administrator-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-23 Relative Path Traversal",
+ "cweId": "CWE-23"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "bitpressadmin",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Chat Widget: Customer Support Button with SMS Call Button, Click to Chat Messenger, Live Chat Support Chat Button \u2013 Bit Assist",
+ "version": {
+ "version_data": [
+ {
+ "version_affected": "<=",
+ "version_name": "*",
+ "version_value": "1.5.2"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/17fd14e7-503a-49e4-9344-5f8d51801eb3?source=cve",
+ "refsource": "MISC",
+ "name": "https://www.wordfence.com/threat-intel/vulnerabilities/id/17fd14e7-503a-49e4-9344-5f8d51801eb3?source=cve"
+ },
+ {
+ "url": "https://github.com/WordPressBugBounty/plugins-bit-assist/blob/main/bit-assist/backend/app/HTTP/Controllers/DownloadController.php",
+ "refsource": "MISC",
+ "name": "https://github.com/WordPressBugBounty/plugins-bit-assist/blob/main/bit-assist/backend/app/HTTP/Controllers/DownloadController.php"
+ },
+ {
+ "url": "https://wordpress.org/plugins/bit-assist/#developers",
+ "refsource": "MISC",
+ "name": "https://wordpress.org/plugins/bit-assist/#developers"
+ },
+ {
+ "url": "https://plugins.trac.wordpress.org/changeset/3239816/#file3",
+ "refsource": "MISC",
+ "name": "https://plugins.trac.wordpress.org/changeset/3239816/#file3"
+ }
+ ]
+ },
+ "credits": [
+ {
+ "lang": "en",
+ "value": "marco jacobs"
+ }
+ ],
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.1",
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
+ "baseScore": 4.9,
+ "baseSeverity": "MEDIUM"
}
]
}
diff --git a/2025/0xxx/CVE-2025-0821.json b/2025/0xxx/CVE-2025-0821.json
index 6a00e83c6d4..742301fdb00 100644
--- a/2025/0xxx/CVE-2025-0821.json
+++ b/2025/0xxx/CVE-2025-0821.json
@@ -1,17 +1,95 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2025-0821",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@wordfence.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "Bit Assist plugin for WordPress is vulnerable to time-based SQL Injection via the \u2018id\u2019 parameter in all versions up to, and including, 1.5.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')",
+ "cweId": "CWE-89"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "bitpressadmin",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Chat Widget: Customer Support Button with SMS Call Button, Click to Chat Messenger, Live Chat Support Chat Button \u2013 Bit Assist",
+ "version": {
+ "version_data": [
+ {
+ "version_affected": "<=",
+ "version_name": "*",
+ "version_value": "1.5.2"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/b64fc9d8-ea02-49e7-add1-8d83f0f41431?source=cve",
+ "refsource": "MISC",
+ "name": "https://www.wordfence.com/threat-intel/vulnerabilities/id/b64fc9d8-ea02-49e7-add1-8d83f0f41431?source=cve"
+ },
+ {
+ "url": "https://plugins.trac.wordpress.org/browser/bit-assist/tags/1.5.2/backend/app/HTTP/Controllers/WidgetChannelController.php#L89",
+ "refsource": "MISC",
+ "name": "https://plugins.trac.wordpress.org/browser/bit-assist/tags/1.5.2/backend/app/HTTP/Controllers/WidgetChannelController.php#L89"
+ },
+ {
+ "url": "https://wordpress.org/plugins/bit-assist/#developers",
+ "refsource": "MISC",
+ "name": "https://wordpress.org/plugins/bit-assist/#developers"
+ },
+ {
+ "url": "https://plugins.trac.wordpress.org/changeset/3239816/#file5",
+ "refsource": "MISC",
+ "name": "https://plugins.trac.wordpress.org/changeset/3239816/#file5"
+ }
+ ]
+ },
+ "credits": [
+ {
+ "lang": "en",
+ "value": "Arkadiusz Hydzik"
+ }
+ ],
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.1",
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
+ "baseScore": 6.5,
+ "baseSeverity": "MEDIUM"
}
]
}
diff --git a/2025/1xxx/CVE-2025-1099.json b/2025/1xxx/CVE-2025-1099.json
index 4f81d410d0a..eed324f7ae4 100644
--- a/2025/1xxx/CVE-2025-1099.json
+++ b/2025/1xxx/CVE-2025-1099.json
@@ -11,7 +11,7 @@
"description_data": [
{
"lang": "eng",
- "value": "The TP-Link Tapo C500 V1 and V2 are a pan-and-tilt outdoor Wi-Fi security cameras designed for comprehensive surveillance. \n\nThis vulnerability exists in Tapo C500 Wi-Fi camera due to hard-coded RSA private key embedded within the device firmware. An attacker with physical access could exploit this vulnerability to obtain cryptographic private keys which can then be used to perform impersonation, data decryption and man in the middle attacks on the targeted device."
+ "value": "This vulnerability exists in Tapo C500 Wi-Fi camera due to hard-coded RSA private key embedded within the device firmware. An attacker with physical access could exploit this vulnerability to obtain cryptographic private keys which can then be used to perform impersonation, data decryption and man in the middle attacks on the targeted device."
}
]
},
diff --git a/2025/26xxx/CVE-2025-26522.json b/2025/26xxx/CVE-2025-26522.json
index b7e6c60bbbe..df176818bb6 100644
--- a/2025/26xxx/CVE-2025-26522.json
+++ b/2025/26xxx/CVE-2025-26522.json
@@ -1,18 +1,89 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2025-26522",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "vdisclose@cert-in.org.in",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "This vulnerability exists in RupeeWeb trading platform due to improper implementation of OTP validation mechanism in certain API endpoints. A remote attacker with valid credentials could exploit this vulnerability by manipulating API responses. \n\nSuccessful exploitation of this vulnerability could allow the attacker to bypass Two-Factor Authentication (2FA) for other user accounts."
}
]
- }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-302: Authentication Bypass by Assumed-Immutable Data",
+ "cweId": "CWE-302"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "Rupeeseed Technology Ventures",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "RupeeWeb",
+ "version": {
+ "version_data": [
+ {
+ "version_affected": "=",
+ "version_value": "<66.9"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2025-0020",
+ "refsource": "MISC",
+ "name": "https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2025-0020"
+ }
+ ]
+ },
+ "generator": {
+ "engine": "Vulnogram 0.2.0"
+ },
+ "source": {
+ "discovery": "UNKNOWN"
+ },
+ "solution": [
+ {
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "base64": false,
+ "type": "text/html",
+ "value": "Upgrade RupeeWeb to version 66.9
"
+ }
+ ],
+ "value": "Upgrade RupeeWeb to version 66.9"
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "value": "This vulnerability is reported by Mohit Gadiya."
+ }
+ ]
}
\ No newline at end of file
diff --git a/2025/26xxx/CVE-2025-26523.json b/2025/26xxx/CVE-2025-26523.json
index 29fbe3af891..01f6810fffa 100644
--- a/2025/26xxx/CVE-2025-26523.json
+++ b/2025/26xxx/CVE-2025-26523.json
@@ -1,18 +1,89 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2025-26523",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "vdisclose@cert-in.org.in",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "This vulnerability exists in RupeeWeb trading platform due to insufficient authorization controls on certain API endpoints handling addition and deletion operations. Successful exploitation of this vulnerability could allow an authenticated remote attacker to modify information belonging to other user accounts."
}
]
- }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-266: Incorrect Privilege Assignment",
+ "cweId": "CWE-266"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "Rupeeseed Technology Ventures",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "RupeeWeb",
+ "version": {
+ "version_data": [
+ {
+ "version_affected": "=",
+ "version_value": "<66.9"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2025-0020",
+ "refsource": "MISC",
+ "name": "https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2025-0020"
+ }
+ ]
+ },
+ "generator": {
+ "engine": "Vulnogram 0.2.0"
+ },
+ "source": {
+ "discovery": "UNKNOWN"
+ },
+ "solution": [
+ {
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "base64": false,
+ "type": "text/html",
+ "value": "Upgrade RupeeWeb to version 66.9
"
+ }
+ ],
+ "value": "Upgrade RupeeWeb to version 66.9"
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "value": "This vulnerability is reported by Mohit Gadiya."
+ }
+ ]
}
\ No newline at end of file
diff --git a/2025/26xxx/CVE-2025-26524.json b/2025/26xxx/CVE-2025-26524.json
index e616d8aecd0..be8f37a78dc 100644
--- a/2025/26xxx/CVE-2025-26524.json
+++ b/2025/26xxx/CVE-2025-26524.json
@@ -1,18 +1,89 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2025-26524",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "vdisclose@cert-in.org.in",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "This vulnerability exists in RupeeWeb trading platform due to missing rate limiting on OTP requests in certain API endpoints. An authenticated remote attacker could exploit this vulnerability by sending multiple OTP request through vulnerable API endpoints which could lead to the OTP bombing/ flooding on the targeted system."
}
]
- }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-799: Improper Control of Interaction Frequency",
+ "cweId": "CWE-799"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "Rupeeseed Technology Ventures",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "RupeeWeb",
+ "version": {
+ "version_data": [
+ {
+ "version_affected": "=",
+ "version_value": "<66.9"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2025-0020",
+ "refsource": "MISC",
+ "name": "https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2025-0020"
+ }
+ ]
+ },
+ "generator": {
+ "engine": "Vulnogram 0.2.0"
+ },
+ "source": {
+ "discovery": "UNKNOWN"
+ },
+ "solution": [
+ {
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "base64": false,
+ "type": "text/html",
+ "value": "Upgrade RupeeWeb to version 66.9
"
+ }
+ ],
+ "value": "Upgrade RupeeWeb to version 66.9"
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "value": "This vulnerability is reported by Mohit Gadiya."
+ }
+ ]
}
\ No newline at end of file