admin/nvd-json-data-feeds
1
0 Fork 0
mirror of https://github.com/fkie-cad/nvd-json-data-feeds.git synced 2026-10-29 04:40:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Auto-Update: 2025-08-28T14:00:11.048254+00:00

Browse Source
This commit is contained in:
cad-safe-bot committed 2025-08-28 14:03:51 +00:00
1 parent bd696741df
commit 93ea455aec
149 files changed
+8854 -235
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

CVE-2023/CVE-2023-49xx/CVE-2023-4957.json
+3 -3
View File
@@ -2,13 +2,13 @@
"id": "CVE-2023-4957",
"sourceIdentifier": "[email protected]",
"published": "2023-10-11T14:15:10.047",
"lastModified": "2024-11-21T08:36:20.357",
"lastModified": "2025-08-28T08:15:29.560",
"vulnStatus": "Modified",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": " A vulnerability of authentication bypass has been found on a Zebra Technologies ZTC ZT410-203dpi ZPL printer. This vulnerability allows an attacker that is in the same network as the printer, to change the username and password for the Web Page by sending a specially crafted POST request to the setvarsResults.cgi file. For this vulnerability to be exploitable, the printers protected mode must be disabled."
"value": "A vulnerability of authentication bypass has been found on a Zebra Technologies ZTC ZT410-203dpi ZPL printer. This vulnerability allows an attacker that is in the same network as the printer, to change the username and password for the Web Page by sending a specially crafted POST request to the setvarsResults.cgi file. For this vulnerability to be exploitable, the printers protected mode must be disabled."
},
{
"lang": "es",
@@ -62,7 +62,7 @@
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"type": "Secondary",
"description": [
{
"lang": "en",
CVE-2024/CVE-2024-132xx/CVE-2024-13273.json
+81 -3
View File
@@ -2,8 +2,8 @@
"id": "CVE-2024-13273",
"sourceIdentifier": "[email protected]",
"published": "2025-01-09T20:15:36.137",
"lastModified": "2025-01-09T21:15:25.913",
"vulnStatus": "Awaiting Analysis",
"lastModified": "2025-08-28T13:03:20.610",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
@@ -51,10 +51,88 @@
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:getopensocial:open_social:*:*:*:*:*:drupal:*:*",
"versionEndExcluding": "12.3.8",
"matchCriteriaId": "8D08CE2A-5BC9-4556-8127-6D55D17B3E48"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:getopensocial:open_social:*:*:*:*:*:drupal:*:*",
"versionStartIncluding": "12.4.0",
"versionEndExcluding": "12.4.5",
"matchCriteriaId": "F707194F-96F5-4A8F-9E83-792ED3CC8267"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:getopensocial:open_social:13.0.0:alpha1:*:*:*:drupal:*:*",
"matchCriteriaId": "83C94567-8F3B-4E0F-A6B9-B91B7867830A"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:getopensocial:open_social:13.0.0:alpha10:*:*:*:drupal:*:*",
"matchCriteriaId": "91C5BD21-7D0F-472F-9C9B-92F8A5843B90"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:getopensocial:open_social:13.0.0:alpha2:*:*:*:drupal:*:*",
"matchCriteriaId": "99C5EDBB-2605-4267-A4E9-5EF6D840E220"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:getopensocial:open_social:13.0.0:alpha3:*:*:*:drupal:*:*",
"matchCriteriaId": "90988BED-3337-4FA4-B7BE-9BC3CEEA7B15"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:getopensocial:open_social:13.0.0:alpha4:*:*:*:drupal:*:*",
"matchCriteriaId": "B3D9E2E6-DA96-4B21-9185-FD811F3EF851"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:getopensocial:open_social:13.0.0:alpha5:*:*:*:drupal:*:*",
"matchCriteriaId": "555AD849-3751-4A70-972E-D712638BE25F"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:getopensocial:open_social:13.0.0:alpha6:*:*:*:drupal:*:*",
"matchCriteriaId": "A70A48EA-2582-4923-AD38-00ACD697AEAE"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:getopensocial:open_social:13.0.0:alpha7:*:*:*:drupal:*:*",
"matchCriteriaId": "35C48202-C7CC-4B2D-9C0C-927BE0CE701A"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:getopensocial:open_social:13.0.0:alpha8:*:*:*:drupal:*:*",
"matchCriteriaId": "4EDCE73A-CF87-4BA6-91BD-1BC2294C0CAA"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:getopensocial:open_social:13.0.0:alpha9:*:*:*:drupal:*:*",
"matchCriteriaId": "0E4DF269-107D-4126-AC03-4A4F74794914"
}
]
}
]
}
],
"references": [
{
"url": "https://www.drupal.org/sa-contrib-2024-037",
"source": "[email protected]"
"source": "[email protected]",
"tags": [
"Third Party Advisory"
]
}
]
}
CVE-2024/CVE-2024-133xx/CVE-2024-13304.json
+24 -3
View File
@@ -2,8 +2,8 @@
"id": "CVE-2024-13304",
"sourceIdentifier": "[email protected]",
"published": "2025-01-09T21:15:28.387",
"lastModified": "2025-01-10T18:15:21.263",
"vulnStatus": "Awaiting Analysis",
"lastModified": "2025-08-28T11:34:37.383",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
@@ -51,10 +51,31 @@
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:matthiasmullie:minify_js:*:*:*:*:*:drupal:*:*",
"versionEndExcluding": "3.0.3",
"matchCriteriaId": "E062C729-C8EA-4C98-AA4A-3424E9552F6D"
}
]
}
]
}
],
"references": [
{
"url": "https://www.drupal.org/sa-contrib-2024-070",
"source": "[email protected]"
"source": "[email protected]",
"tags": [
"Third Party Advisory"
]
}
]
}
CVE-2024/CVE-2024-133xx/CVE-2024-13305.json
+24 -3
View File
@@ -2,8 +2,8 @@
"id": "CVE-2024-13305",
"sourceIdentifier": "[email protected]",
"published": "2025-01-09T21:15:28.500",
"lastModified": "2025-01-10T17:15:16.820",
"vulnStatus": "Awaiting Analysis",
"lastModified": "2025-08-28T11:32:30.983",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
@@ -51,10 +51,31 @@
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:imagexmedia:entity_form_steps:*:*:*:*:*:drupal:*:*",
"versionEndExcluding": "1.1.4",
"matchCriteriaId": "6567492A-89FA-454C-B1DB-C9D8F9E1F8B3"
}
]
}
]
}
],
"references": [
{
"url": "https://www.drupal.org/sa-contrib-2024-071",
"source": "[email protected]"
"source": "[email protected]",
"tags": [
"Third Party Advisory"
]
}
]
}
CVE-2024/CVE-2024-133xx/CVE-2024-13308.json
+25 -3
View File
@@ -2,8 +2,8 @@
"id": "CVE-2024-13308",
"sourceIdentifier": "[email protected]",
"published": "2025-01-09T21:15:28.623",
"lastModified": "2025-01-30T22:15:08.723",
"vulnStatus": "Awaiting Analysis",
"lastModified": "2025-08-28T11:28:52.290",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
@@ -51,10 +51,32 @@
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:other.media:browser_back_button:*:*:*:*:*:drupal:*:*",
"versionStartIncluding": "1.0.0",
"versionEndExcluding": "2.0.2",
"matchCriteriaId": "02DFB1DF-46E1-4739-A5D4-05E68B4B726C"
}
]
}
]
}
],
"references": [
{
"url": "https://www.drupal.org/sa-contrib-2024-072",
"source": "[email protected]"
"source": "[email protected]",
"tags": [
"Third Party Advisory"
]
}
]
}
CVE-2024/CVE-2024-133xx/CVE-2024-13309.json
+25 -3
View File
@@ -2,8 +2,8 @@
"id": "CVE-2024-13309",
"sourceIdentifier": "[email protected]",
"published": "2025-01-09T21:15:28.740",
"lastModified": "2025-01-30T22:15:08.880",
"vulnStatus": "Awaiting Analysis",
"lastModified": "2025-08-28T11:26:42.113",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
@@ -51,10 +51,32 @@
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:login_disable_project:login_disable:*:*:*:*:*:drupal:*:*",
"versionStartIncluding": "2.0.0",
"versionEndExcluding": "2.1.1",
"matchCriteriaId": "B0D50664-6710-46F7-8187-8460EE00C9B7"
}
]
}
]
}
],
"references": [
{
"url": "https://www.drupal.org/sa-contrib-2024-073",
"source": "[email protected]"
"source": "[email protected]",
"tags": [
"Third Party Advisory"
]
}
]
}
CVE-2024/CVE-2024-300xx/CVE-2024-30040.json
+2 -2
View File
@@ -2,8 +2,8 @@
"id": "CVE-2024-30040",
"sourceIdentifier": "[email protected]",
"published": "2024-05-14T17:17:12.410",
"lastModified": "2025-08-27T21:15:47.620",
"vulnStatus": "Modified",
"lastModified": "2025-08-28T12:55:50.997",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
CVE-2024/CVE-2024-582xx/CVE-2024-58240.json
+29
View File
@@ -0,0 +1,29 @@
{
"id": "CVE-2024-58240",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-08-28T10:15:31.780",
"lastModified": "2025-08-28T10:15:31.780",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntls: separate no-async decryption request handling from async\n\nIf we're not doing async, the handling is much simpler. There's no\nreference counting, we just need to wait for the completion to wake us\nup and return its result.\n\nWe should preferably also use a separate crypto_wait. I'm not seeing a\nUAF as I did in the past, I think aec7961916f3 (\"tls: fix race between\nasync notify and socket close\") took care of it.\n\nThis will make the next fix easier."
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/41532b785e9d79636b3815a64ddf6a096647d011",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/999115298017a675d8ddf61414fc7a85c89f1186",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/dec5b6e7b211e405d3bcb504562ab21aa7e5a64d",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2025/CVE-2025-04xx/CVE-2025-0461.json
+58 -6
View File
@@ -2,8 +2,8 @@
"id": "CVE-2025-0461",
"sourceIdentifier": "[email protected]",
"published": "2025-01-14T16:15:34.997",
"lastModified": "2025-01-14T16:15:34.997",
"vulnStatus": "Awaiting Analysis",
"lastModified": "2025-08-28T11:20:21.007",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
@@ -80,6 +80,26 @@
},
"exploitabilityScore": 2.8,
"impactScore": 1.4
},
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6
}
],
"cvssMetricV2": [
@@ -120,22 +140,54 @@
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:51mis:lingdang_crm:8.6.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "07F20E45-E81C-4FD7-A265-BD606E36DBB5"
}
]
}
]
}
],
"references": [
{
"url": "https://github.com/BxYQ/ld/blob/main/downloadSocialPromotionQrcode_fileread.doc",
"source": "[email protected]"
"source": "[email protected]",
"tags": [
"Broken Link"
]
},
{
"url": "https://vuldb.com/?ctiid.291478",
"source": "[email protected]"
"source": "[email protected]",
"tags": [
"Permissions Required",
"VDB Entry"
]
},
{
"url": "https://vuldb.com/?id.291478",
"source": "[email protected]"
"source": "[email protected]",
"tags": [
"Third Party Advisory",
"VDB Entry"
]
},
{
"url": "https://vuldb.com/?submit.474252",
"source": "[email protected]"
"source": "[email protected]",
"tags": [
"Third Party Advisory",
"VDB Entry"
]
}
]
}
CVE-2025/CVE-2025-04xx/CVE-2025-0462.json
+68 -6
View File
@@ -2,8 +2,8 @@
"id": "CVE-2025-0462",
"sourceIdentifier": "[email protected]",
"published": "2025-01-14T17:15:21.040",
"lastModified": "2025-01-14T17:15:21.040",
"vulnStatus": "Awaiting Analysis",
"lastModified": "2025-08-28T11:15:44.340",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
@@ -80,6 +80,26 @@
},
"exploitabilityScore": 2.8,
"impactScore": 3.4
},
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9
}
],
"cvssMetricV2": [
@@ -122,24 +142,66 @@
"value": "CWE-89"
}
]
},
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-89"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:51mis:lingdang_crm:8.6.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "07F20E45-E81C-4FD7-A265-BD606E36DBB5"
}
]
}
]
}
],
"references": [
{
"url": "https://github.com/BxYQ/ld/blob/main/ListView_SQL.doc",
"source": "[email protected]"
"source": "[email protected]",
"tags": [
"Broken Link"
]
},
{
"url": "https://vuldb.com/?ctiid.291479",
"source": "[email protected]"
"source": "[email protected]",
"tags": [
"Permissions Required",
"VDB Entry"
]
},
{
"url": "https://vuldb.com/?id.291479",
"source": "[email protected]"
"source": "[email protected]",
"tags": [
"Third Party Advisory",
"VDB Entry"
]
},
{
"url": "https://vuldb.com/?submit.474254",
"source": "[email protected]"
"source": "[email protected]",
"tags": [
"Third Party Advisory",
"VDB Entry"
]
}
]
}
CVE-2025/CVE-2025-04xx/CVE-2025-0463.json
+68 -6
View File
@@ -2,8 +2,8 @@
"id": "CVE-2025-0463",
"sourceIdentifier": "[email protected]",
"published": "2025-01-14T17:15:21.210",
"lastModified": "2025-01-14T17:15:21.210",
"vulnStatus": "Awaiting Analysis",
"lastModified": "2025-08-28T10:57:21.367",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
@@ -80,6 +80,26 @@
},
"exploitabilityScore": 2.8,
"impactScore": 3.4
},
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9
}
],
"cvssMetricV2": [
@@ -122,24 +142,66 @@
"value": "CWE-434"
}
]
},
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-434"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:51mis:lingdang_crm:8.6.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "07F20E45-E81C-4FD7-A265-BD606E36DBB5"
}
]
}
]
}
],
"references": [
{
"url": "https://github.com/BxYQ/ld/blob/main/File_Upload_vul.doc",
"source": "[email protected]"
"source": "[email protected]",
"tags": [
"Broken Link"
]
},
{
"url": "https://vuldb.com/?ctiid.291480",
"source": "[email protected]"
"source": "[email protected]",
"tags": [
"Permissions Required",
"VDB Entry"
]
},
{
"url": "https://vuldb.com/?id.291480",
"source": "[email protected]"
"source": "[email protected]",
"tags": [
"Third Party Advisory",
"VDB Entry"
]
},
{
"url": "https://vuldb.com/?submit.474255",
"source": "[email protected]"
"source": "[email protected]",
"tags": [
"Third Party Advisory",
"VDB Entry"
]
}
]
}
CVE-2025/CVE-2025-394xx/CVE-2025-39496.json
+56
View File
@@ -0,0 +1,56 @@
{
"id": "CVE-2025-39496",
"sourceIdentifier": "[email protected]",
"published": "2025-08-28T12:15:37.480",
"lastModified": "2025-08-28T12:15:37.480",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WBW WooBeWoo Product Filter Pro allows SQL Injection.This issue affects WooBeWoo Product Filter Pro: from n/a before 2.9.6."
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "CHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"availabilityImpact": "LOW"
},
"exploitabilityScore": 3.9,
"impactScore": 4.7
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-89"
}
]
}
],
"references": [
{
"url": "https://patchstack.com/database/wordpress/plugin/woofilter-pro/vulnerability/wordpress-woobewoo-product-filter-pro-plugin-2-7-6-sql-injection-vulnerability?_s_id=cve",
"source": "[email protected]"
}
]
}
CVE-2025/CVE-2025-409xx/CVE-2025-40920.json
+6 -6
View File
@@ -2,13 +2,13 @@
"id": "CVE-2025-40920",
"sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
"published": "2025-08-11T21:15:28.087",
"lastModified": "2025-08-12T14:25:33.177",
"lastModified": "2025-08-28T12:15:38.967",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Catalyst::Authentication::Credential::HTTP versions 1.018 and earlier for Perl generate nonces using the Perl Data::UUID library. * Data::UUID does not use a strong cryptographic source for generating UUIDs.\n * Data::UUID returns v3 UUIDs, which are generated from known information and are unsuitable for security, as per RFC 9562.\n * The nonces should be generated from a strong cryptographic source, as per RFC 7616."
"value": "Catalyst::Authentication::Credential::HTTP versions 1.018 and earlier for Perl generate nonces using the Perl Data::UUID library.\n * Data::UUID does not use a strong cryptographic source for generating UUIDs.\n * Data::UUID returns v3 UUIDs, which are generated from known information and are unsuitable for security, as per RFC 9562.\n * The nonces should be generated from a strong cryptographic source, as per RFC 7616."
},
{
"lang": "es",
@@ -64,10 +64,6 @@
"url": "https://datatracker.ietf.org/doc/html/rfc9562#name-security-considerations",
"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"
},
{
"url": "https://github.com/perl-catalyst/Catalyst-Authentication-Credential-HTTP/commit/ad2c03aad95406db4ce35dfb670664ebde004c18.patch",
"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"
},
{
"url": "https://github.com/perl-catalyst/Catalyst-Authentication-Credential-HTTP/pull/1",
"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"
@@ -75,6 +71,10 @@
{
"url": "https://metacpan.org/release/ETHER/Catalyst-Authentication-Credential-HTTP-1.018/source/lib/Catalyst/Authentication/Credential/HTTP.pm#L391",
"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"
},
{
"url": "https://security.metacpan.org/patches/C/Catalyst-Authentication-Credential-HTTP/1.018/CVE-2025-40920-r1.patch",
"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"
}
]
}
CVE-2025/CVE-2025-464xx/CVE-2025-46409.json
+104
View File
@@ -0,0 +1,104 @@
{
"id": "CVE-2025-46409",
"sourceIdentifier": "[email protected]",
"published": "2025-08-28T09:15:31.733",
"lastModified": "2025-08-28T09:15:31.733",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Inadequate encryption strength issue exists in SS1 Ver.16.0.0.10 and earlier (Media version:16.0.0a and earlier). If this vulnerability is exploited, a function that requires authentication may be accessed by a remote unauthenticated attacker."
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
],
"cvssMetricV30": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.0",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-326"
}
]
}
],
"references": [
{
"url": "https://jvn.jp/en/jp/JVN99577552/",
"source": "[email protected]"
},
{
"url": "https://www.dos-osaka.co.jp/news/2025/08/250827.html",
"source": "[email protected]"
}
]
}
CVE-2025/CVE-2025-481xx/CVE-2025-48100.json
+56
View File
@@ -0,0 +1,56 @@
{
"id": "CVE-2025-48100",
"sourceIdentifier": "[email protected]",
"published": "2025-08-28T13:15:36.830",
"lastModified": "2025-08-28T13:15:36.830",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Improper Control of Generation of Code ('Code Injection') vulnerability in extremeidea bidorbuy Store Integrator allows Remote Code Inclusion. This issue affects bidorbuy Store Integrator: from n/a through 2.12.0."
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "HIGH",
"userInteraction": "NONE",
"scope": "CHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 2.3,
"impactScore": 6.0
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-94"
}
]
}
],
"references": [
{
"url": "https://patchstack.com/database/wordpress/plugin/bidorbuystoreintegrator/vulnerability/wordpress-bidorbuy-store-integrator-plugin-2-10-0-remote-code-execution-rce-vulnerability?_s_id=cve",
"source": "[email protected]"
}
]
}
CVE-2025/CVE-2025-481xx/CVE-2025-48109.json
+56
View File
@@ -0,0 +1,56 @@
{
"id": "CVE-2025-48109",
"sourceIdentifier": "[email protected]",
"published": "2025-08-28T13:15:37.073",
"lastModified": "2025-08-28T13:15:37.073",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-Site Request Forgery (CSRF) vulnerability in Xavier Media XM-Backup allows Stored XSS. This issue affects XM-Backup: from n/a through 0.9.1."
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "REQUIRED",
"scope": "CHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "LOW"
},
"exploitabilityScore": 2.8,
"impactScore": 3.7
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-352"
}
]
}
],
"references": [
{
"url": "https://patchstack.com/database/wordpress/plugin/xm-backup/vulnerability/wordpress-xm-backup-plugin-0-9-1-csrf-to-stored-xss-vulnerability?_s_id=cve",
"source": "[email protected]"
}
]
}
CVE-2025/CVE-2025-481xx/CVE-2025-48110.json
+56
View File
@@ -0,0 +1,56 @@
{
"id": "CVE-2025-48110",
"sourceIdentifier": "[email protected]",
"published": "2025-08-28T13:15:37.280",
"lastModified": "2025-08-28T13:15:37.280",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mibuthu Link View allows Stored XSS. This issue affects Link View: from n/a through 0.8.0."
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "REQUIRED",
"scope": "CHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "LOW"
},
"exploitabilityScore": 2.3,
"impactScore": 3.7
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-79"
}
]
}
],
"references": [
{
"url": "https://patchstack.com/database/wordpress/plugin/link-view/vulnerability/wordpress-link-view-plugin-0-8-0-cross-site-scripting-xss-vulnerability-2?_s_id=cve",
"source": "[email protected]"
}
]
}
CVE-2025/CVE-2025-483xx/CVE-2025-48304.json
+56
View File
@@ -0,0 +1,56 @@
{
"id": "CVE-2025-48304",
"sourceIdentifier": "[email protected]",
"published": "2025-08-28T13:15:37.500",
"lastModified": "2025-08-28T13:15:37.500",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-Site Request Forgery (CSRF) vulnerability in Gary Illyes Google XML News Sitemap plugin allows Stored XSS. This issue affects Google XML News Sitemap plugin: from n/a through 0.02."
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "REQUIRED",
"scope": "CHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "LOW"
},
"exploitabilityScore": 2.8,
"impactScore": 3.7
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-352"
}
]
}
],
"references": [
{
"url": "https://patchstack.com/database/wordpress/plugin/gn-xml-sitemap/vulnerability/wordpress-google-xml-news-sitemap-plugin-plugin-0-02-cross-site-request-forgery-csrf-to-stored-xss-vulnerability?_s_id=cve",
"source": "[email protected]"
}
]
}
CVE-2025/CVE-2025-483xx/CVE-2025-48305.json
+56
View File
@@ -0,0 +1,56 @@
{
"id": "CVE-2025-48305",
"sourceIdentifier": "[email protected]",
"published": "2025-08-28T13:15:37.723",
"lastModified": "2025-08-28T13:15:37.723",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in vikingjs Goal Tracker for Patreon allows Stored XSS. This issue affects Goal Tracker for Patreon: from n/a through 0.4.6."
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "HIGH",
"userInteraction": "REQUIRED",
"scope": "CHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "LOW"
},
"exploitabilityScore": 1.7,
"impactScore": 3.7
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-79"
}
]
}
],
"references": [
{
"url": "https://patchstack.com/database/wordpress/plugin/goal-tracker-for-patreon/vulnerability/wordpress-goal-tracker-for-patreon-plugin-0-4-6-cross-site-scripting-xss-vulnerability?_s_id=cve",
"source": "[email protected]"
}
]
}
CVE-2025/CVE-2025-483xx/CVE-2025-48306.json
+56
View File
@@ -0,0 +1,56 @@
{
"id": "CVE-2025-48306",
"sourceIdentifier": "[email protected]",
"published": "2025-08-28T13:15:37.943",
"lastModified": "2025-08-28T13:15:37.943",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-Site Request Forgery (CSRF) vulnerability in developers savyour Savyour Affiliate Partner allows Stored XSS. This issue affects Savyour Affiliate Partner: from n/a through 2.1.4."
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "REQUIRED",
"scope": "CHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "LOW"
},
"exploitabilityScore": 2.8,
"impactScore": 3.7
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-352"
}
]
}
],
"references": [
{
"url": "https://patchstack.com/database/wordpress/plugin/savyour-affiliate-partner/vulnerability/wordpress-savyour-affiliate-partner-plugin-2-1-4-csrf-to-stored-xss-vulnerability?_s_id=cve",
"source": "[email protected]"
}
]
}
CVE-2025/CVE-2025-483xx/CVE-2025-48307.json
+56
View File
@@ -0,0 +1,56 @@
{
"id": "CVE-2025-48307",
"sourceIdentifier": "[email protected]",
"published": "2025-08-28T13:15:38.157",
"lastModified": "2025-08-28T13:15:38.157",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-Site Request Forgery (CSRF) vulnerability in kasonzhao SEO For Images allows Stored XSS. This issue affects SEO For Images: from n/a through 1.0.0."
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "REQUIRED",
"scope": "CHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "LOW"
},
"exploitabilityScore": 2.8,
"impactScore": 3.7
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-352"
}
]
}
],
"references": [
{
"url": "https://patchstack.com/database/wordpress/plugin/seo-for-images/vulnerability/wordpress-seo-for-images-plugin-1-0-0-cross-site-request-forgery-csrf-to-stored-xss-vulnerability?_s_id=cve",
"source": "[email protected]"
}
]
}
CVE-2025/CVE-2025-483xx/CVE-2025-48308.json
+56
View File
@@ -0,0 +1,56 @@
{
"id": "CVE-2025-48308",
"sourceIdentifier": "[email protected]",
"published": "2025-08-28T13:15:38.373",
"lastModified": "2025-08-28T13:15:38.373",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-Site Request Forgery (CSRF) vulnerability in nonletter Newsletter subscription optin module allows Stored XSS. This issue affects Newsletter subscription optin module: from n/a through 1.2.9."
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "REQUIRED",
"scope": "CHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "LOW"
},
"exploitabilityScore": 2.8,
"impactScore": 3.7
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-352"
}
]
}
],
"references": [
{
"url": "https://patchstack.com/database/wordpress/plugin/newsletter-subscription-widget-for-sendblaster/vulnerability/wordpress-newsletter-subscription-optin-module-plugin-1-2-9-cross-site-request-forgery-csrf-to-stored-xss-vulnerability?_s_id=cve",
"source": "[email protected]"
}
]
}
CVE-2025/CVE-2025-483xx/CVE-2025-48309.json
+56
View File
@@ -0,0 +1,56 @@
{
"id": "CVE-2025-48309",
"sourceIdentifier": "[email protected]",
"published": "2025-08-28T13:15:38.583",
"lastModified": "2025-08-28T13:15:38.583",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-Site Request Forgery (CSRF) vulnerability in web-able BetPress allows Stored XSS. This issue affects BetPress: from n/a through 1.0.1 Lite."
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "REQUIRED",
"scope": "CHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "LOW"
},
"exploitabilityScore": 2.8,
"impactScore": 3.7
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-352"
}
]
}
],
"references": [
{
"url": "https://patchstack.com/database/wordpress/plugin/betpress/vulnerability/wordpress-betpress-plugin-1-0-1-lite-csrf-to-stored-xss-vulnerability?_s_id=cve",
"source": "[email protected]"
}
]
}
CVE-2025/CVE-2025-483xx/CVE-2025-48310.json
+56
View File
@@ -0,0 +1,56 @@
{
"id": "CVE-2025-48310",
"sourceIdentifier": "[email protected]",
"published": "2025-08-28T13:15:39.653",
"lastModified": "2025-08-28T13:15:39.653",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-Site Request Forgery (CSRF) vulnerability in wptableeditor Table Editor allows Cross Site Request Forgery. This issue affects Table Editor: from n/a through 1.6.4."
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "REQUIRED",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 2.8,
"impactScore": 1.4
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-352"
}
]
}
],
"references": [
{
"url": "https://patchstack.com/database/wordpress/plugin/wp-table-editor/vulnerability/wordpress-table-editor-plugin-1-6-4-cross-site-request-forgery-csrf-vulnerability?_s_id=cve",
"source": "[email protected]"
}
]
}
CVE-2025/CVE-2025-483xx/CVE-2025-48311.json
+56
View File
@@ -0,0 +1,56 @@
{
"id": "CVE-2025-48311",
"sourceIdentifier": "[email protected]",
"published": "2025-08-28T13:15:40.380",
"lastModified": "2025-08-28T13:15:40.380",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-Site Request Forgery (CSRF) vulnerability in OffClicks Invisible Optin allows Stored XSS. This issue affects Invisible Optin: from n/a through 1.0."
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "REQUIRED",
"scope": "CHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "LOW"
},
"exploitabilityScore": 2.8,
"impactScore": 3.7
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-352"
}
]
}
],
"references": [
{
"url": "https://patchstack.com/database/wordpress/plugin/invisible-optin/vulnerability/wordpress-invisible-optin-plugin-1-0-cross-site-request-forgery-csrf-to-stored-xss-vulnerability?_s_id=cve",
"source": "[email protected]"
}
]
}
CVE-2025/CVE-2025-483xx/CVE-2025-48312.json
+56
View File
@@ -0,0 +1,56 @@
{
"id": "CVE-2025-48312",
"sourceIdentifier": "[email protected]",
"published": "2025-08-28T13:15:40.900",
"lastModified": "2025-08-28T13:15:40.900",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in \u6587\u6d3e\u7ffb\u8bd1\uff08WP Chinese Translation\uff09 WPAvatar allows Stored XSS. This issue affects WPAvatar: from n/a through 1.9.3."
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "REQUIRED",
"scope": "CHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "LOW"
},
"exploitabilityScore": 2.3,
"impactScore": 3.7
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-79"
}
]
}
],
"references": [
{
"url": "https://patchstack.com/database/wordpress/plugin/wpavatar/vulnerability/wordpress-wpavatar-plugin-1-9-3-cross-site-scripting-xss-vulnerability?_s_id=cve",
"source": "[email protected]"
}
]
}
CVE-2025/CVE-2025-483xx/CVE-2025-48313.json
+56
View File
@@ -0,0 +1,56 @@
{
"id": "CVE-2025-48313",
"sourceIdentifier": "[email protected]",
"published": "2025-08-28T13:15:41.197",
"lastModified": "2025-08-28T13:15:41.197",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in kevin heath Tripadvisor Shortcode allows Stored XSS. This issue affects Tripadvisor Shortcode: from n/a through 2.2."
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "HIGH",
"userInteraction": "REQUIRED",
"scope": "CHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "LOW"
},
"exploitabilityScore": 1.7,
"impactScore": 3.7
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-79"
}
]
}
],
"references": [
{
"url": "https://patchstack.com/database/wordpress/plugin/tripadvisor-shortcode/vulnerability/wordpress-tripadvisor-shortcode-plugin-2-2-cross-site-scripting-xss-vulnerability?_s_id=cve",
"source": "[email protected]"
}
]
}
CVE-2025/CVE-2025-483xx/CVE-2025-48314.json
+56
View File
@@ -0,0 +1,56 @@
{
"id": "CVE-2025-48314",
"sourceIdentifier": "[email protected]",
"published": "2025-08-28T13:15:41.413",
"lastModified": "2025-08-28T13:15:41.413",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in salubrio Add Code To Head allows Stored XSS. This issue affects Add Code To Head: from n/a through 1.17."
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "HIGH",
"userInteraction": "REQUIRED",
"scope": "CHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "LOW"
},
"exploitabilityScore": 1.7,
"impactScore": 3.7
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-79"
}
]
}
],
"references": [
{
"url": "https://patchstack.com/database/wordpress/plugin/add-code-to-head/vulnerability/wordpress-add-code-to-head-plugin-1-17-cross-site-scripting-xss-vulnerability?_s_id=cve",
"source": "[email protected]"
}
]
}
CVE-2025/CVE-2025-483xx/CVE-2025-48315.json
+56
View File
@@ -0,0 +1,56 @@
{
"id": "CVE-2025-48315",
"sourceIdentifier": "[email protected]",
"published": "2025-08-28T13:15:42.720",
"lastModified": "2025-08-28T13:15:42.720",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in stanton119 WordPress HTML allows Stored XSS. This issue affects WordPress HTML: from n/a through 0.51."
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "REQUIRED",
"scope": "CHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "LOW"
},
"exploitabilityScore": 2.3,
"impactScore": 3.7
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-79"
}
]
}
],
"references": [
{
"url": "https://patchstack.com/database/wordpress/plugin/custom-html-bodyhead/vulnerability/wordpress-wordpress-html-plugin-0-51-cross-site-scripting-xss-vulnerability?_s_id=cve",
"source": "[email protected]"
}
]
}
CVE-2025/CVE-2025-483xx/CVE-2025-48316.json
+56
View File
@@ -0,0 +1,56 @@
{
"id": "CVE-2025-48316",
"sourceIdentifier": "[email protected]",
"published": "2025-08-28T13:15:43.987",
"lastModified": "2025-08-28T13:15:43.987",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ItayXD Responsive Mobile-Friendly Tooltip allows Stored XSS. This issue affects Responsive Mobile-Friendly Tooltip: from n/a through 1.6.6."
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "REQUIRED",
"scope": "CHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "LOW"
},
"exploitabilityScore": 2.3,
"impactScore": 3.7
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-79"
}
]
}
],
"references": [
{
"url": "https://patchstack.com/database/wordpress/plugin/responsive-mobile-friendly-tooltip/vulnerability/wordpress-responsive-mobile-friendly-tooltip-plugin-1-6-6-cross-site-scripting-xss-vulnerability?_s_id=cve",
"source": "[email protected]"
}
]
}
CVE-2025/CVE-2025-483xx/CVE-2025-48318.json
+56
View File
@@ -0,0 +1,56 @@
{
"id": "CVE-2025-48318",
"sourceIdentifier": "[email protected]",
"published": "2025-08-28T13:15:45.243",
"lastModified": "2025-08-28T13:15:45.243",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-Site Request Forgery (CSRF) vulnerability in shen2 \u591a\u8bf4\u793e\u4f1a\u5316\u8bc4\u8bba\u6846 allows Cross Site Request Forgery. This issue affects \u591a\u8bf4\u793e\u4f1a\u5316\u8bc4\u8bba\u6846: from n/a through 1.2."
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "REQUIRED",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 2.8,
"impactScore": 1.4
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-352"
}
]
}
],
"references": [
{
"url": "https://patchstack.com/database/wordpress/plugin/duoshuo/vulnerability/wordpress-plugin-1-2-cross-site-request-forgery-csrf-to-settings-change-vulnerability?_s_id=cve",
"source": "[email protected]"
}
]
}
CVE-2025/CVE-2025-483xx/CVE-2025-48319.json
+56
View File
@@ -0,0 +1,56 @@
{
"id": "CVE-2025-48319",
"sourceIdentifier": "[email protected]",
"published": "2025-08-28T13:15:46.517",
"lastModified": "2025-08-28T13:15:46.517",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in gslauraspeck Mesa Mesa Reservation Widget allows Stored XSS. This issue affects Mesa Mesa Reservation Widget: from n/a through 1.0.0."
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "HIGH",
"userInteraction": "REQUIRED",
"scope": "CHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "LOW"
},
"exploitabilityScore": 1.7,
"impactScore": 3.7
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-79"
}
]
}
],
"references": [
{
"url": "https://patchstack.com/database/wordpress/plugin/mesa-mesa-reservation-widget/vulnerability/wordpress-mesa-mesa-reservation-widget-plugin-1-0-0-cross-site-scripting-xss-vulnerability?_s_id=cve",
"source": "[email protected]"
}
]
}
CVE-2025/CVE-2025-483xx/CVE-2025-48320.json
+56
View File
@@ -0,0 +1,56 @@
{
"id": "CVE-2025-48320",
"sourceIdentifier": "[email protected]",
"published": "2025-08-28T13:15:47.800",
"lastModified": "2025-08-28T13:15:47.800",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-Site Request Forgery (CSRF) vulnerability in cuckoohello \u767e\u5ea6\u5206\u4eab\u6309\u94ae allows Stored XSS. This issue affects \u767e\u5ea6\u5206\u4eab\u6309\u94ae: from n/a through 1.0.6."
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "REQUIRED",
"scope": "CHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "LOW"
},
"exploitabilityScore": 2.8,
"impactScore": 3.7
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-352"
}
]
}
],
"references": [
{
"url": "https://patchstack.com/database/wordpress/plugin/baidushare-wp/vulnerability/wordpress-plugin-1-0-6-csrf-to-stored-xss-vulnerability?_s_id=cve",
"source": "[email protected]"
}
]
}
CVE-2025/CVE-2025-483xx/CVE-2025-48321.json
+56
View File
@@ -0,0 +1,56 @@
{
"id": "CVE-2025-48321",
"sourceIdentifier": "[email protected]",
"published": "2025-08-28T13:15:49.027",
"lastModified": "2025-08-28T13:15:49.027",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-Site Request Forgery (CSRF) vulnerability in dyiosah Ultimate twitter profile widget allows Stored XSS. This issue affects Ultimate twitter profile widget: from n/a through 1.0."
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "REQUIRED",
"scope": "CHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "LOW"
},
"exploitabilityScore": 2.8,
"impactScore": 3.7
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-352"
}
]
}
],
"references": [
{
"url": "https://patchstack.com/database/wordpress/plugin/ultimate-twitter-profile-widget/vulnerability/wordpress-ultimate-twitter-profile-widget-plugin-1-0-csrf-to-stored-xss-vulnerability?_s_id=cve",
"source": "[email protected]"
}
]
}
CVE-2025/CVE-2025-483xx/CVE-2025-48322.json
+56
View File
@@ -0,0 +1,56 @@
{
"id": "CVE-2025-48322",
"sourceIdentifier": "[email protected]",
"published": "2025-08-28T13:15:50.280",
"lastModified": "2025-08-28T13:15:50.280",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Finn Dohrn Statify Widget allows Stored XSS. This issue affects Statify Widget: from n/a through 1.4.6."
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "REQUIRED",
"scope": "CHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "LOW"
},
"exploitabilityScore": 2.3,
"impactScore": 3.7
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-79"
}
]
}
],
"references": [
{
"url": "https://patchstack.com/database/wordpress/plugin/statify-widget/vulnerability/wordpress-statify-widget-plugin-1-4-6-cross-site-scripting-xss-vulnerability?_s_id=cve",
"source": "[email protected]"
}
]
}
CVE-2025/CVE-2025-483xx/CVE-2025-48323.json
+56
View File
@@ -0,0 +1,56 @@
{
"id": "CVE-2025-48323",
"sourceIdentifier": "[email protected]",
"published": "2025-08-28T13:15:51.543",
"lastModified": "2025-08-28T13:15:51.543",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Md Abunaser Khan Advance Food Menu allows Stored XSS. This issue affects Advance Food Menu: from n/a through 1.0."
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "HIGH",
"userInteraction": "REQUIRED",
"scope": "CHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "LOW"
},
"exploitabilityScore": 1.7,
"impactScore": 3.7
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-79"
}
]
}
],
"references": [
{
"url": "https://patchstack.com/database/wordpress/plugin/advance-food-menu/vulnerability/wordpress-advance-food-menu-plugin-1-0-cross-site-scripting-xss-vulnerability?_s_id=cve",
"source": "[email protected]"
}
]
}
CVE-2025/CVE-2025-483xx/CVE-2025-48324.json
+56
View File
@@ -0,0 +1,56 @@
{
"id": "CVE-2025-48324",
"sourceIdentifier": "[email protected]",
"published": "2025-08-28T13:15:52.833",
"lastModified": "2025-08-28T13:15:52.833",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in khashabawy tli.tl auto Twitter poster allows Stored XSS. This issue affects tli.tl auto Twitter poster: from n/a through 3.4."
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "HIGH",
"userInteraction": "REQUIRED",
"scope": "CHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "LOW"
},
"exploitabilityScore": 1.7,
"impactScore": 3.7
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-79"
}
]
}
],
"references": [
{
"url": "https://patchstack.com/database/wordpress/plugin/tlitl-auto-twitter-poster/vulnerability/wordpress-tli-tl-auto-twitter-poster-plugin-3-4-cross-site-scripting-xss-vulnerability?_s_id=cve",
"source": "[email protected]"
}
]
}
CVE-2025/CVE-2025-483xx/CVE-2025-48325.json
+56
View File
@@ -0,0 +1,56 @@
{
"id": "CVE-2025-48325",
"sourceIdentifier": "[email protected]",
"published": "2025-08-28T13:15:53.157",
"lastModified": "2025-08-28T13:15:53.157",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-Site Request Forgery (CSRF) vulnerability in shmish111 WP Admin Theme allows Stored XSS. This issue affects WP Admin Theme: from n/a through 1.0."
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "REQUIRED",
"scope": "CHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "LOW"
},
"exploitabilityScore": 2.8,
"impactScore": 3.7
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-352"
}
]
}
],
"references": [
{
"url": "https://patchstack.com/database/wordpress/plugin/wp-admin-theme/vulnerability/wordpress-wp-admin-theme-plugin-1-0-cross-site-request-forgery-csrf-to-stored-xss-vulnerability?_s_id=cve",
"source": "[email protected]"
}
]
}
CVE-2025/CVE-2025-483xx/CVE-2025-48327.json
+56
View File
@@ -0,0 +1,56 @@
{
"id": "CVE-2025-48327",
"sourceIdentifier": "[email protected]",
"published": "2025-08-28T13:15:53.367",
"lastModified": "2025-08-28T13:15:53.367",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Missing Authorization vulnerability in inkthemes WP Mailgun SMTP allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects WP Mailgun SMTP: from n/a through 1.0.7."
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 3.9,
"impactScore": 1.4
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-862"
}
]
}
],
"references": [
{
"url": "https://patchstack.com/database/wordpress/plugin/wp-mailgun-smtp/vulnerability/wordpress-wp-mailgun-smtp-plugin-1-0-7-broken-access-control-vulnerability?_s_id=cve",
"source": "[email protected]"
}
]
}
CVE-2025/CVE-2025-483xx/CVE-2025-48343.json
+56
View File
@@ -0,0 +1,56 @@
{
"id": "CVE-2025-48343",
"sourceIdentifier": "[email protected]",
"published": "2025-08-28T13:15:53.590",
"lastModified": "2025-08-28T13:15:53.590",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-Site Request Forgery (CSRF) vulnerability in Aaron Axelsen WPMU Ldap Authentication allows Stored XSS. This issue affects WPMU Ldap Authentication: from n/a through 5.0.1."
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "REQUIRED",
"scope": "CHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "LOW"
},
"exploitabilityScore": 2.8,
"impactScore": 3.7
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-352"
}
]
}
],
"references": [
{
"url": "https://patchstack.com/database/wordpress/plugin/wpmuldap/vulnerability/wordpress-wpmu-ldap-authentication-plugin-5-0-1-cross-site-request-forgery-csrf-to-stored-xss-vulnerability?_s_id=cve",
"source": "[email protected]"
}
]
}
CVE-2025/CVE-2025-483xx/CVE-2025-48347.json
+56
View File
@@ -0,0 +1,56 @@
{
"id": "CVE-2025-48347",
"sourceIdentifier": "[email protected]",
"published": "2025-08-28T13:15:53.783",
"lastModified": "2025-08-28T13:15:53.783",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vincent Mimoun-Prat bxSlider integration for WordPress allows Stored XSS. This issue affects bxSlider integration for WordPress: from n/a through 1.7.2."
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "REQUIRED",
"scope": "CHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "LOW"
},
"exploitabilityScore": 2.3,
"impactScore": 3.7
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-79"
}
]
}
],
"references": [
{
"url": "https://patchstack.com/database/wordpress/plugin/bxslider-integration/vulnerability/wordpress-bxslider-integration-for-wordpress-plugin-1-7-2-cross-site-scripting-xss-vulnerability?_s_id=cve",
"source": "[email protected]"
}
]
}
CVE-2025/CVE-2025-483xx/CVE-2025-48348.json
+56
View File
@@ -0,0 +1,56 @@
{
"id": "CVE-2025-48348",
"sourceIdentifier": "[email protected]",
"published": "2025-08-28T13:15:53.993",
"lastModified": "2025-08-28T13:15:53.993",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Incorrect Privilege Assignment vulnerability in chandrashekharsahu Site Offline allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Site Offline: from n/a through 1.5.7."
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 2.8,
"impactScore": 1.4
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-266"
}
]
}
],
"references": [
{
"url": "https://patchstack.com/database/wordpress/plugin/site-offline/vulnerability/wordpress-site-offline-plugin-1-5-7-broken-access-control-vulnerability?_s_id=cve",
"source": "[email protected]"
}
]
}
CVE-2025/CVE-2025-483xx/CVE-2025-48349.json
+56
View File
@@ -0,0 +1,56 @@
{
"id": "CVE-2025-48349",
"sourceIdentifier": "[email protected]",
"published": "2025-08-28T13:15:54.317",
"lastModified": "2025-08-28T13:15:54.317",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in origincode Video Gallery \u2013 Vimeo and YouTube Gallery allows Stored XSS. This issue affects Video Gallery \u2013 Vimeo and YouTube Gallery: from n/a through 1.1.7."
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "REQUIRED",
"scope": "CHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "LOW"
},
"exploitabilityScore": 2.3,
"impactScore": 3.7
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-79"
}
]
}
],
"references": [
{
"url": "https://patchstack.com/database/wordpress/plugin/smart-grid-gallery/vulnerability/wordpress-video-gallery-vimeo-and-youtube-gallery-plugin-1-1-7-cross-site-scripting-xss-vulnerability?_s_id=cve",
"source": "[email protected]"
}
]
}
CVE-2025/CVE-2025-483xx/CVE-2025-48350.json
+56
View File
@@ -0,0 +1,56 @@
{
"id": "CVE-2025-48350",
"sourceIdentifier": "[email protected]",
"published": "2025-08-28T13:15:54.540",
"lastModified": "2025-08-28T13:15:54.540",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Missing Authorization vulnerability in Neuralabz LTD AutoWP allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects AutoWP: from n/a through 2.2.2."
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 2.8,
"impactScore": 1.4
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-862"
}
]
}
],
"references": [
{
"url": "https://patchstack.com/database/wordpress/plugin/autowp-ai-content-writer-rewriter/vulnerability/wordpress-autowp-plugin-2-2-2-broken-access-control-vulnerability?_s_id=cve",
"source": "[email protected]"
}
]
}
CVE-2025/CVE-2025-483xx/CVE-2025-48351.json
+56
View File
@@ -0,0 +1,56 @@
{
"id": "CVE-2025-48351",
"sourceIdentifier": "[email protected]",
"published": "2025-08-28T13:15:54.733",
"lastModified": "2025-08-28T13:15:54.733",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-Site Request Forgery (CSRF) vulnerability in PluginsPoint Kento Splash Screen allows Stored XSS. This issue affects Kento Splash Screen: from n/a through 1.4."
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "REQUIRED",
"scope": "CHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "LOW"
},
"exploitabilityScore": 2.8,
"impactScore": 3.7
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-352"
}
]
}
],
"references": [
{
"url": "https://patchstack.com/database/wordpress/plugin/kento-splash-screen/vulnerability/wordpress-kento-splash-screen-plugin-1-4-cross-site-request-forgery-csrf-to-stored-xss-vulnerability?_s_id=cve",
"source": "[email protected]"
}
]
}
CVE-2025/CVE-2025-483xx/CVE-2025-48352.json
+56
View File
@@ -0,0 +1,56 @@
{
"id": "CVE-2025-48352",
"sourceIdentifier": "[email protected]",
"published": "2025-08-28T13:15:54.943",
"lastModified": "2025-08-28T13:15:54.943",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sitesearch-yandex Yandex Site search pinger allows Stored XSS. This issue affects Yandex Site search pinger: from n/a through 1.5."
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "HIGH",
"userInteraction": "REQUIRED",
"scope": "CHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "LOW"
},
"exploitabilityScore": 1.7,
"impactScore": 3.7
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-79"
}
]
}
],
"references": [
{
"url": "https://patchstack.com/database/wordpress/plugin/yandex-pinger/vulnerability/wordpress-yandex-site-search-pinger-plugin-1-5-cross-site-scripting-xss-vulnerability?_s_id=cve",
"source": "[email protected]"
}
]
}
CVE-2025/CVE-2025-483xx/CVE-2025-48353.json
+56
View File
@@ -0,0 +1,56 @@
{
"id": "CVE-2025-48353",
"sourceIdentifier": "[email protected]",
"published": "2025-08-28T13:15:55.157",
"lastModified": "2025-08-28T13:15:55.157",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-Site Request Forgery (CSRF) vulnerability in dactum Clickbank WordPress Plugin (Niche Storefront) allows Stored XSS. This issue affects Clickbank WordPress Plugin (Niche Storefront): from n/a through 1.3.5."
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "REQUIRED",
"scope": "CHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "LOW"
},
"exploitabilityScore": 2.8,
"impactScore": 3.7
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-352"
}
]
}
],
"references": [
{
"url": "https://patchstack.com/database/wordpress/plugin/clickbank-niche-storefronts/vulnerability/wordpress-clickbank-wordpress-plugin-niche-storefront-plugin-1-3-5-cross-site-request-forgery-csrf-to-stored-xss-vulnerability?_s_id=cve",
"source": "[email protected]"
}
]
}
CVE-2025/CVE-2025-483xx/CVE-2025-48354.json
+56
View File
@@ -0,0 +1,56 @@
{
"id": "CVE-2025-48354",
"sourceIdentifier": "[email protected]",
"published": "2025-08-28T13:15:55.377",
"lastModified": "2025-08-28T13:15:55.377",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Smart Widgets Better Post & Filter Widgets for Elementor allows Stored XSS. This issue affects Better Post & Filter Widgets for Elementor: from n/a through 1.6.0."
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "REQUIRED",
"scope": "CHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "LOW"
},
"exploitabilityScore": 2.3,
"impactScore": 3.7
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-79"
}
]
}
],
"references": [
{
"url": "https://patchstack.com/database/wordpress/plugin/better-post-filter-widgets-for-elementor/vulnerability/wordpress-better-post-filter-widgets-for-elementor-plugin-1-5-3-cross-site-scripting-xss-vulnerability?_s_id=cve",
"source": "[email protected]"
}
]
}
CVE-2025/CVE-2025-483xx/CVE-2025-48356.json
+56
View File
@@ -0,0 +1,56 @@
{
"id": "CVE-2025-48356",
"sourceIdentifier": "[email protected]",
"published": "2025-08-28T13:15:55.593",
"lastModified": "2025-08-28T13:15:55.593",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Isra Kanpress allows Stored XSS. This issue affects Kanpress: from n/a through 1.1."
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "REQUIRED",
"scope": "CHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "LOW"
},
"exploitabilityScore": 2.3,
"impactScore": 3.7
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-79"
}
]
}
],
"references": [
{
"url": "https://patchstack.com/database/wordpress/plugin/kanpress/vulnerability/wordpress-kanpress-plugin-1-1-cross-site-scripting-xss-vulnerability?_s_id=cve",
"source": "[email protected]"
}
]
}
CVE-2025/CVE-2025-483xx/CVE-2025-48357.json
+56
View File
@@ -0,0 +1,56 @@
{
"id": "CVE-2025-48357",
"sourceIdentifier": "[email protected]",
"published": "2025-08-28T13:15:55.813",
"lastModified": "2025-08-28T13:15:55.813",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-Site Request Forgery (CSRF) vulnerability in Theme Century Century ToolKit allows Cross Site Request Forgery. This issue affects Century ToolKit: from n/a through 1.2.1."
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "REQUIRED",
"scope": "UNCHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 2.8,
"impactScore": 2.5
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-352"
}
]
}
],
"references": [
{
"url": "https://patchstack.com/database/wordpress/plugin/century-toolkit/vulnerability/wordpress-century-toolkit-plugin-1-2-1-cross-site-request-forgery-csrf-to-arbitrary-plugin-activation-vulnerability?_s_id=cve",
"source": "[email protected]"
}
]
}
CVE-2025/CVE-2025-483xx/CVE-2025-48358.json
+56
View File
@@ -0,0 +1,56 @@
{
"id": "CVE-2025-48358",
"sourceIdentifier": "[email protected]",
"published": "2025-08-28T13:15:56.030",
"lastModified": "2025-08-28T13:15:56.030",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in everythingwp Risk Free Cash On Delivery (COD) – WooCommerce allows Stored XSS. This issue affects Risk Free Cash On Delivery (COD) – WooCommerce: from n/a through 1.0.4."
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "HIGH",
"userInteraction": "REQUIRED",
"scope": "CHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "LOW"
},
"exploitabilityScore": 1.7,
"impactScore": 3.7
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-79"
}
]
}
],
"references": [
{
"url": "https://patchstack.com/database/wordpress/plugin/risk-free-cash-on-delivery-cod-woocommerce/vulnerability/wordpress-risk-free-cash-on-delivery-cod-woocommerce-plugin-1-0-4-cross-site-scripting-xss-vulnerability?_s_id=cve",
"source": "[email protected]"
}
]
}
CVE-2025/CVE-2025-483xx/CVE-2025-48359.json
+56
View File
@@ -0,0 +1,56 @@
{
"id": "CVE-2025-48359",
"sourceIdentifier": "[email protected]",
"published": "2025-08-28T13:15:56.223",
"lastModified": "2025-08-28T13:15:56.223",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-Site Request Forgery (CSRF) vulnerability in thaihavnn07 ATT YouTube Widget allows Stored XSS. This issue affects ATT YouTube Widget: from n/a through 1.0."
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "REQUIRED",
"scope": "CHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "LOW"
},
"exploitabilityScore": 2.8,
"impactScore": 3.7
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-352"
}
]
}
],
"references": [
{
"url": "https://patchstack.com/database/wordpress/plugin/att-youtube/vulnerability/wordpress-att-youtube-widget-plugin-1-0-cross-site-request-forgery-csrf-to-stored-xss-vulnerability?_s_id=cve",
"source": "[email protected]"
}
]
}
CVE-2025/CVE-2025-483xx/CVE-2025-48360.json
+56
View File
@@ -0,0 +1,56 @@
{
"id": "CVE-2025-48360",
"sourceIdentifier": "[email protected]",
"published": "2025-08-28T13:15:56.430",
"lastModified": "2025-08-28T13:15:56.430",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Razvan Stanga Varnish/Nginx Proxy Caching allows Stored XSS. This issue affects Varnish/Nginx Proxy Caching: from n/a through 1.8.3."
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "HIGH",
"userInteraction": "REQUIRED",
"scope": "CHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "LOW"
},
"exploitabilityScore": 1.7,
"impactScore": 3.7
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-79"
}
]
}
],
"references": [
{
"url": "https://patchstack.com/database/wordpress/plugin/vcaching/vulnerability/wordpress-varnish-nginx-proxy-caching-plugin-1-8-3-cross-site-scripting-xss-vulnerability?_s_id=cve",
"source": "[email protected]"
}
]
}
CVE-2025/CVE-2025-483xx/CVE-2025-48361.json
+56
View File
@@ -0,0 +1,56 @@
{
"id": "CVE-2025-48361",
"sourceIdentifier": "[email protected]",
"published": "2025-08-28T13:15:56.650",
"lastModified": "2025-08-28T13:15:56.650",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Insertion of Sensitive Information Into Sent Data vulnerability in Saeed Sattar Beglou Hesabfa Accounting allows Retrieve Embedded Sensitive Data. This issue affects Hesabfa Accounting: from n/a through 2.2.4."
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 3.9,
"impactScore": 1.4
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-201"
}
]
}
],
"references": [
{
"url": "https://patchstack.com/database/wordpress/plugin/hesabfa-accounting/vulnerability/wordpress-hesabfa-accounting-plugin-2-2-4-sensitive-data-exposure-via-log-file-vulnerability?_s_id=cve",
"source": "[email protected]"
}
]
}
CVE-2025/CVE-2025-483xx/CVE-2025-48362.json
+56
View File
@@ -0,0 +1,56 @@
{
"id": "CVE-2025-48362",
"sourceIdentifier": "[email protected]",
"published": "2025-08-28T13:15:56.877",
"lastModified": "2025-08-28T13:15:56.877",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-Site Request Forgery (CSRF) vulnerability in Saeed Sattar Beglou Hesabfa Accounting allows Cross Site Request Forgery. This issue affects Hesabfa Accounting: from n/a through 2.2.4."
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "REQUIRED",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"availabilityImpact": "LOW"
},
"exploitabilityScore": 2.8,
"impactScore": 2.5
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-352"
}
]
}
],
"references": [
{
"url": "https://patchstack.com/database/wordpress/plugin/hesabfa-accounting/vulnerability/wordpress-hesabfa-accounting-plugin-2-2-4-cross-site-request-forgery-csrf-vulnerability?_s_id=cve",
"source": "[email protected]"
}
]
}
CVE-2025/CVE-2025-483xx/CVE-2025-48363.json
+56
View File
@@ -0,0 +1,56 @@
{
"id": "CVE-2025-48363",
"sourceIdentifier": "[email protected]",
"published": "2025-08-28T13:15:58.020",
"lastModified": "2025-08-28T13:15:58.020",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-Site Request Forgery (CSRF) vulnerability in Metin Sara\u00e7 Popup for CF7 with Sweet Alert allows Cross Site Request Forgery. This issue affects Popup for CF7 with Sweet Alert: from n/a through 1.6.5."
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "REQUIRED",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 2.8,
"impactScore": 1.4
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-352"
}
]
}
],
"references": [
{
"url": "https://patchstack.com/database/wordpress/plugin/cf7-sweet-alert-popup/vulnerability/wordpress-popup-for-cf7-with-sweet-alert-plugin-1-6-5-cross-site-request-forgery-csrf-vulnerability?_s_id=cve",
"source": "[email protected]"
}
]
}
CVE-2025/CVE-2025-483xx/CVE-2025-48364.json
+56
View File
@@ -0,0 +1,56 @@
{
"id": "CVE-2025-48364",
"sourceIdentifier": "[email protected]",
"published": "2025-08-28T13:15:58.593",
"lastModified": "2025-08-28T13:15:58.593",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Server-Side Request Forgery (SSRF) vulnerability in vEnCa-X rajce allows Server Side Request Forgery. This issue affects rajce: from n/a through 0.4.2."
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N",
"baseScore": 4.9,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "CHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 1.8,
"impactScore": 2.7
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-918"
}
]
}
],
"references": [
{
"url": "https://patchstack.com/database/wordpress/plugin/rajce/vulnerability/wordpress-rajce-plugin-0-4-2-server-side-request-forgery-ssrf-vulnerability?_s_id=cve",
"source": "[email protected]"
}
]
}
CVE-2025/CVE-2025-483xx/CVE-2025-48365.json
+56
View File
@@ -0,0 +1,56 @@
{
"id": "CVE-2025-48365",
"sourceIdentifier": "[email protected]",
"published": "2025-08-28T13:15:58.803",
"lastModified": "2025-08-28T13:15:58.803",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in imaprogrammer Custom Comment allows Stored XSS. This issue affects Custom Comment: from n/a through 2.1.6."
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "HIGH",
"userInteraction": "REQUIRED",
"scope": "CHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "LOW"
},
"exploitabilityScore": 1.7,
"impactScore": 3.7
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-79"
}
]
}
],
"references": [
{
"url": "https://patchstack.com/database/wordpress/plugin/customcomment/vulnerability/wordpress-custom-comment-plugin-2-1-6-cross-site-scripting-xss-vulnerability-2?_s_id=cve",
"source": "[email protected]"
}
]
}
CVE-2025/CVE-2025-489xx/CVE-2025-48963.json
+56
View File
@@ -0,0 +1,56 @@
{
"id": "CVE-2025-48963",
"sourceIdentifier": "[email protected]",
"published": "2025-08-28T10:15:32.437",
"lastModified": "2025-08-28T10:15:32.437",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Local privilege escalation due to improper soft link handling. The following products are affected: Acronis Cyber Protect Cloud Agent (Linux, macOS, Windows) before build 40296."
}
],
"metrics": {
"cvssMetricV30": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.0",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "REQUIRED",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 1.3,
"impactScore": 5.9
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-610"
}
]
}
],
"references": [
{
"url": "https://security-advisory.acronis.com/advisories/SEC-8568",
"source": "[email protected]"
}
]
}
CVE-2025/CVE-2025-493xx/CVE-2025-49383.json
+56
View File
@@ -0,0 +1,56 @@
{
"id": "CVE-2025-49383",
"sourceIdentifier": "[email protected]",
"published": "2025-08-28T13:15:59.013",
"lastModified": "2025-08-28T13:15:59.013",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in CocoBasic Neresa allows PHP Local File Inclusion. This issue affects Neresa: from n/a through 1.3."
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 2.2,
"impactScore": 5.9
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-98"
}
]
}
],
"references": [
{
"url": "https://patchstack.com/database/wordpress/theme/neresa-wp/vulnerability/wordpress-neresa-theme-1-3-local-file-inclusion-vulnerability?_s_id=cve",
"source": "[email protected]"
}
]
}
CVE-2025/CVE-2025-493xx/CVE-2025-49387.json
+56
View File
@@ -0,0 +1,56 @@
{
"id": "CVE-2025-49387",
"sourceIdentifier": "[email protected]",
"published": "2025-08-28T13:15:59.230",
"lastModified": "2025-08-28T13:15:59.230",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Unrestricted Upload of File with Dangerous Type vulnerability in add-ons.org Drag and Drop File Upload for Elementor Forms allows Upload a Web Shell to a Web Server. This issue affects Drag and Drop File Upload for Elementor Forms: from n/a through 1.5.3."
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"baseScore": 10.0,
"baseSeverity": "CRITICAL",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "CHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 3.9,
"impactScore": 6.0
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-434"
}
]
}
],
"references": [
{
"url": "https://patchstack.com/database/wordpress/plugin/drag-and-drop-file-upload-for-elementor-forms/vulnerability/wordpress-drag-and-drop-file-upload-for-elementor-forms-plugin-1-5-3-arbitrary-file-upload-vulnerability?_s_id=cve",
"source": "[email protected]"
}
]
}
CVE-2025/CVE-2025-493xx/CVE-2025-49388.json
+56
View File
@@ -0,0 +1,56 @@
{
"id": "CVE-2025-49388",
"sourceIdentifier": "[email protected]",
"published": "2025-08-28T13:15:59.430",
"lastModified": "2025-08-28T13:15:59.430",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Incorrect Privilege Assignment vulnerability in kamleshyadav Miraculous Core Plugin allows Privilege Escalation. This issue affects Miraculous Core Plugin: from n/a through 2.0.7."
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-266"
}
]
}
],
"references": [
{
"url": "https://patchstack.com/database/wordpress/plugin/miraculouscore/vulnerability/wordpress-miraculous-core-plugin-plugin-2-0-7-privilege-escalation-vulnerability?_s_id=cve",
"source": "[email protected]"
}
]
}
CVE-2025/CVE-2025-494xx/CVE-2025-49402.json
+56
View File
@@ -0,0 +1,56 @@
{
"id": "CVE-2025-49402",
"sourceIdentifier": "[email protected]",
"published": "2025-08-28T13:15:59.623",
"lastModified": "2025-08-28T13:15:59.623",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Missing Authorization vulnerability in favethemes Houzez CRM allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Houzez CRM: from n/a through 1.4.7."
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 2.8,
"impactScore": 3.6
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-862"
}
]
}
],
"references": [
{
"url": "https://patchstack.com/database/wordpress/plugin/houzez-crm/vulnerability/wordpress-houzez-crm-plugin-1-4-7-broken-access-control-vulnerability?_s_id=cve",
"source": "[email protected]"
}
]
}
CVE-2025/CVE-2025-494xx/CVE-2025-49404.json
+56
View File
@@ -0,0 +1,56 @@
{
"id": "CVE-2025-49404",
"sourceIdentifier": "[email protected]",
"published": "2025-08-28T13:15:59.837",
"lastModified": "2025-08-28T13:15:59.837",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in purethemes Listeo-Core allows SQL Injection. This issue affects Listeo-Core: from n/a through 1.9.32."
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L",
"baseScore": 8.5,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "CHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"availabilityImpact": "LOW"
},
"exploitabilityScore": 3.1,
"impactScore": 4.7
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-89"
}
]
}
],
"references": [
{
"url": "https://patchstack.com/database/wordpress/plugin/listeo-core/vulnerability/wordpress-listeo-core-plugin-1-9-32-sql-injection-vulnerability?_s_id=cve",
"source": "[email protected]"
}
]
}
CVE-2025/CVE-2025-494xx/CVE-2025-49405.json
+56
View File
@@ -0,0 +1,56 @@
{
"id": "CVE-2025-49405",
"sourceIdentifier": "[email protected]",
"published": "2025-08-28T13:16:00.063",
"lastModified": "2025-08-28T13:16:00.063",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in favethemes Houzez allows PHP Local File Inclusion. This issue affects Houzez: from n/a through 4.1.1."
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 2.2,
"impactScore": 5.9
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-98"
}
]
}
],
"references": [
{
"url": "https://patchstack.com/database/wordpress/theme/houzez/vulnerability/wordpress-houzez-theme-4-1-1-local-file-inclusion-vulnerability?_s_id=cve",
"source": "[email protected]"
}
]
}
CVE-2025/CVE-2025-494xx/CVE-2025-49407.json
+56
View File
@@ -0,0 +1,56 @@
{
"id": "CVE-2025-49407",
"sourceIdentifier": "[email protected]",
"published": "2025-08-28T13:16:00.273",
"lastModified": "2025-08-28T13:16:00.273",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in favethemes Houzez allows Reflected XSS. This issue affects Houzez: from n/a through 4.1.1."
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "REQUIRED",
"scope": "CHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "LOW"
},
"exploitabilityScore": 2.8,
"impactScore": 3.7
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-79"
}
]
}
],
"references": [
{
"url": "https://patchstack.com/database/wordpress/theme/houzez/vulnerability/wordpress-houzez-theme-4-1-1-cross-site-scripting-xss-vulnerability?_s_id=cve",
"source": "[email protected]"
}
]
}
CVE-2025/CVE-2025-524xx/CVE-2025-52460.json
+104
View File
@@ -0,0 +1,104 @@
{
"id": "CVE-2025-52460",
"sourceIdentifier": "[email protected]",
"published": "2025-08-28T09:15:32.843",
"lastModified": "2025-08-28T09:15:32.843",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Files or directories accessible to external parties issue exists in SS1 Ver.16.0.0.10 and earlier (Media version:16.0.0a and earlier). If exploited, uploaded files and SS1 configuration files may be accessed by a remote unauthenticated attacker."
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
],
"cvssMetricV30": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.0",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 3.9,
"impactScore": 1.4
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-552"
}
]
}
],
"references": [
{
"url": "https://jvn.jp/en/jp/JVN99577552/",
"source": "[email protected]"
},
{
"url": "https://www.dos-osaka.co.jp/news/2025/08/250827.html",
"source": "[email protected]"
}
]
}
CVE-2025/CVE-2025-527xx/CVE-2025-52761.json
+56
View File
@@ -0,0 +1,56 @@
{
"id": "CVE-2025-52761",
"sourceIdentifier": "[email protected]",
"published": "2025-08-28T13:16:00.483",
"lastModified": "2025-08-28T13:16:00.483",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Deserialization of Untrusted Data vulnerability in manfcarlo WP Funnel Manager allows Object Injection. This issue affects WP Funnel Manager: from n/a through 1.4.0."
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-502"
}
]
}
],
"references": [
{
"url": "https://patchstack.com/database/wordpress/plugin/wp-funnel-manager/vulnerability/wordpress-wp-funnel-manager-plugin-1-4-0-php-object-injection-vulnerability?_s_id=cve",
"source": "[email protected]"
}
]
}
CVE-2025/CVE-2025-532xx/CVE-2025-53215.json
+56
View File
@@ -0,0 +1,56 @@
{
"id": "CVE-2025-53215",
"sourceIdentifier": "[email protected]",
"published": "2025-08-28T13:16:00.703",
"lastModified": "2025-08-28T13:16:00.703",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 8bitkid Yahoo! WebPlayer allows Reflected XSS. This issue affects Yahoo! WebPlayer: from n/a through 2.0.6."
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "REQUIRED",
"scope": "CHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "LOW"
},
"exploitabilityScore": 2.8,
"impactScore": 3.7
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-79"
}
]
}
],
"references": [
{
"url": "https://patchstack.com/database/wordpress/plugin/yahoo-media-player/vulnerability/wordpress-yahoo-webplayer-plugin-2-0-6-cross-site-scripting-xss-vulnerability?_s_id=cve",
"source": "[email protected]"
}
]
}
CVE-2025/CVE-2025-532xx/CVE-2025-53216.json
+56
View File
@@ -0,0 +1,56 @@
{
"id": "CVE-2025-53216",
"sourceIdentifier": "[email protected]",
"published": "2025-08-28T13:16:00.913",
"lastModified": "2025-08-28T13:16:00.913",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeUniver Glamer allows PHP Local File Inclusion. This issue affects Glamer: from n/a through 1.0.2."
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 2.2,
"impactScore": 5.9
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-98"
}
]
}
],
"references": [
{
"url": "https://patchstack.com/database/wordpress/theme/glamer/vulnerability/wordpress-glamer-theme-1-0-2-local-file-inclusion-vulnerability?_s_id=cve",
"source": "[email protected]"
}
]
}
CVE-2025/CVE-2025-532xx/CVE-2025-53220.json
+56
View File
@@ -0,0 +1,56 @@
{
"id": "CVE-2025-53220",
"sourceIdentifier": "[email protected]",
"published": "2025-08-28T13:16:01.133",
"lastModified": "2025-08-28T13:16:01.133",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in XmasB XmasB Quotes allows Reflected XSS. This issue affects XmasB Quotes: from n/a through 1.6.1."
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "REQUIRED",
"scope": "CHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "LOW"
},
"exploitabilityScore": 2.8,
"impactScore": 3.7
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-79"
}
]
}
],
"references": [
{
"url": "https://patchstack.com/database/wordpress/plugin/xmasb-quotes/vulnerability/wordpress-xmasb-quotes-plugin-1-6-1-cross-site-scripting-xss-vulnerability?_s_id=cve",
"source": "[email protected]"
}
]
}
CVE-2025/CVE-2025-532xx/CVE-2025-53223.json
+56
View File
@@ -0,0 +1,56 @@
{
"id": "CVE-2025-53223",
"sourceIdentifier": "[email protected]",
"published": "2025-08-28T13:16:01.343",
"lastModified": "2025-08-28T13:16:01.343",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in undoIT Theme Switcher Reloaded allows Reflected XSS. This issue affects Theme Switcher Reloaded: from n/a through 1.1."
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "REQUIRED",
"scope": "CHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "LOW"
},
"exploitabilityScore": 2.8,
"impactScore": 3.7
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-79"
}
]
}
],
"references": [
{
"url": "https://patchstack.com/database/wordpress/plugin/theme-switcher-reloaded/vulnerability/wordpress-theme-switcher-reloaded-plugin-1-1-cross-site-scripting-xss-vulnerability?_s_id=cve",
"source": "[email protected]"
}
]
}
CVE-2025/CVE-2025-532xx/CVE-2025-53224.json
+56
View File
@@ -0,0 +1,56 @@
{
"id": "CVE-2025-53224",
"sourceIdentifier": "[email protected]",
"published": "2025-08-28T13:16:01.540",
"lastModified": "2025-08-28T13:16:01.540",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Koen Schuit NextGEN Gallery Search allows Reflected XSS. This issue affects NextGEN Gallery Search: from n/a through 2.12."
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "REQUIRED",
"scope": "CHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "LOW"
},
"exploitabilityScore": 2.8,
"impactScore": 3.7
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-79"
}
]
}
],
"references": [
{
"url": "https://patchstack.com/database/wordpress/plugin/nextgen-gallery-search-galleries/vulnerability/wordpress-nextgen-gallery-search-plugin-2-12-cross-site-scripting-xss-vulnerability?_s_id=cve",
"source": "[email protected]"
}
]
}
CVE-2025/CVE-2025-532xx/CVE-2025-53225.json
+56
View File
@@ -0,0 +1,56 @@
{
"id": "CVE-2025-53225",
"sourceIdentifier": "[email protected]",
"published": "2025-08-28T13:16:01.757",
"lastModified": "2025-08-28T13:16:01.757",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in eboekhouden e-Boekhouden.nl allows Reflected XSS. This issue affects e-Boekhouden.nl: from n/a through 1.9.3."
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "REQUIRED",
"scope": "CHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "LOW"
},
"exploitabilityScore": 2.8,
"impactScore": 3.7
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-79"
}
]
}
],
"references": [
{
"url": "https://patchstack.com/database/wordpress/plugin/e-boekhoudennl-connector/vulnerability/wordpress-e-boekhouden-nl-plugin-1-9-3-cross-site-scripting-xss-vulnerability?_s_id=cve",
"source": "[email protected]"
}
]
}
CVE-2025/CVE-2025-532xx/CVE-2025-53227.json
+56
View File
@@ -0,0 +1,56 @@
{
"id": "CVE-2025-53227",
"sourceIdentifier": "[email protected]",
"published": "2025-08-28T13:16:01.997",
"lastModified": "2025-08-28T13:16:01.997",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Unfoldwp Magazine Saga allows PHP Local File Inclusion. This issue affects Magazine Saga: from n/a through 1.2.7."
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 2.2,
"impactScore": 5.9
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-98"
}
]
}
],
"references": [
{
"url": "https://patchstack.com/database/wordpress/theme/magazine-saga/vulnerability/wordpress-magazine-saga-theme-1-2-7-local-file-inclusion-vulnerability?_s_id=cve",
"source": "[email protected]"
}
]
}
CVE-2025/CVE-2025-532xx/CVE-2025-53230.json
+56
View File
@@ -0,0 +1,56 @@
{
"id": "CVE-2025-53230",
"sourceIdentifier": "[email protected]",
"published": "2025-08-28T13:16:02.203",
"lastModified": "2025-08-28T13:16:02.203",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Missing Authorization vulnerability in honzat Page Manager for Elementor allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Page Manager for Elementor: from n/a through 2.0.5."
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H",
"baseScore": 7.6,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 2.8,
"impactScore": 4.7
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-862"
}
]
}
],
"references": [
{
"url": "https://patchstack.com/database/wordpress/plugin/page-manager-for-elementor/vulnerability/wordpress-page-manager-for-elementor-plugin-2-0-5-broken-access-control-vulnerability?_s_id=cve",
"source": "[email protected]"
}
]
}
CVE-2025/CVE-2025-532xx/CVE-2025-53243.json
+56
View File
@@ -0,0 +1,56 @@
{
"id": "CVE-2025-53243",
"sourceIdentifier": "[email protected]",
"published": "2025-08-28T13:16:02.410",
"lastModified": "2025-08-28T13:16:02.410",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Deserialization of Untrusted Data vulnerability in emarket-design Employee Directory \u2013 Staff Listing & Team Directory Plugin for WordPress allows Object Injection. This issue affects Employee Directory \u2013 Staff Listing & Team Directory Plugin for WordPress: from n/a through 4.5.3."
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 2.2,
"impactScore": 5.9
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-502"
}
]
}
],
"references": [
{
"url": "https://patchstack.com/database/wordpress/plugin/employee-directory/vulnerability/wordpress-employee-directory-staff-listing-team-directory-plugin-for-wordpress-plugin-4-5-2-php-object-injection-vulnerability?_s_id=cve",
"source": "[email protected]"
}
]
}
CVE-2025/CVE-2025-532xx/CVE-2025-53244.json
+56
View File
@@ -0,0 +1,56 @@
{
"id": "CVE-2025-53244",
"sourceIdentifier": "[email protected]",
"published": "2025-08-28T13:16:02.690",
"lastModified": "2025-08-28T13:16:02.690",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Unfoldwp Magazine Elite allows PHP Local File Inclusion. This issue affects Magazine Elite: from n/a through 1.2.4."
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 2.2,
"impactScore": 5.9
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-98"
}
]
}
],
"references": [
{
"url": "https://patchstack.com/database/wordpress/theme/magazine-elite/vulnerability/wordpress-magazine-elite-theme-1-2-4-local-file-inclusion-vulnerability?_s_id=cve",
"source": "[email protected]"
}
]
}
CVE-2025/CVE-2025-532xx/CVE-2025-53247.json
+56
View File
@@ -0,0 +1,56 @@
{
"id": "CVE-2025-53247",
"sourceIdentifier": "[email protected]",
"published": "2025-08-28T13:16:02.897",
"lastModified": "2025-08-28T13:16:02.897",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in WPInterface BlogMarks allows PHP Local File Inclusion. This issue affects BlogMarks: from n/a through 1.0.8."
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 2.2,
"impactScore": 5.9
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-98"
}
]
}
],
"references": [
{
"url": "https://patchstack.com/database/wordpress/theme/blogmarks/vulnerability/wordpress-blogmarks-theme-1-0-8-local-file-inclusion-vulnerability?_s_id=cve",
"source": "[email protected]"
}
]
}
CVE-2025/CVE-2025-532xx/CVE-2025-53248.json
+56
View File
@@ -0,0 +1,56 @@
{
"id": "CVE-2025-53248",
"sourceIdentifier": "[email protected]",
"published": "2025-08-28T13:16:03.093",
"lastModified": "2025-08-28T13:16:03.093",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Unfoldwp Magazine allows PHP Local File Inclusion. This issue affects Magazine: from n/a through 1.2.2."
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 2.2,
"impactScore": 5.9
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-98"
}
]
}
],
"references": [
{
"url": "https://patchstack.com/database/wordpress/theme/eximious-magazine/vulnerability/wordpress-magazine-theme-1-2-2-local-file-inclusion-vulnerability?_s_id=cve",
"source": "[email protected]"
}
]
}
CVE-2025/CVE-2025-532xx/CVE-2025-53250.json
+56
View File
@@ -0,0 +1,56 @@
{
"id": "CVE-2025-53250",
"sourceIdentifier": "[email protected]",
"published": "2025-08-28T13:16:03.310",
"lastModified": "2025-08-28T13:16:03.310",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Server-Side Request Forgery (SSRF) vulnerability in Chartbeat Chartbeat allows Server Side Request Forgery. This issue affects Chartbeat: from n/a through 2.0.7."
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "CHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 3.1,
"impactScore": 2.7
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-918"
}
]
}
],
"references": [
{
"url": "https://patchstack.com/database/wordpress/plugin/chartbeat/vulnerability/wordpress-chartbeat-plugin-2-0-7-server-side-request-forgery-ssrf-vulnerability?_s_id=cve",
"source": "[email protected]"
}
]
}
CVE-2025/CVE-2025-532xx/CVE-2025-53289.json
+56
View File
@@ -0,0 +1,56 @@
{
"id": "CVE-2025-53289",
"sourceIdentifier": "[email protected]",
"published": "2025-08-28T13:16:03.510",
"lastModified": "2025-08-28T13:16:03.510",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jason Theme Blvd Widget Areas allows Reflected XSS. This issue affects Theme Blvd Widget Areas: from n/a through 1.3.0."
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "REQUIRED",
"scope": "CHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "LOW"
},
"exploitabilityScore": 2.8,
"impactScore": 3.7
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-79"
}
]
}
],
"references": [
{
"url": "https://patchstack.com/database/wordpress/plugin/theme-blvd-widget-areas/vulnerability/wordpress-theme-blvd-widget-areas-plugin-1-3-0-cross-site-scripting-xss-vulnerability?_s_id=cve",
"source": "[email protected]"
}
]
}
CVE-2025/CVE-2025-533xx/CVE-2025-53326.json
+56
View File
@@ -0,0 +1,56 @@
{
"id": "CVE-2025-53326",
"sourceIdentifier": "[email protected]",
"published": "2025-08-28T13:16:03.720",
"lastModified": "2025-08-28T13:16:03.720",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in CodeYatri Gutenify allows PHP Local File Inclusion. This issue affects Gutenify: from n/a through 1.5.6."
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 1.6,
"impactScore": 5.9
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-98"
}
]
}
],
"references": [
{
"url": "https://patchstack.com/database/wordpress/plugin/gutenify/vulnerability/wordpress-gutenify-plugin-1-5-6-local-file-inclusion-vulnerability?_s_id=cve",
"source": "[email protected]"
}
]
}
CVE-2025/CVE-2025-533xx/CVE-2025-53328.json
+56
View File
@@ -0,0 +1,56 @@
{
"id": "CVE-2025-53328",
"sourceIdentifier": "[email protected]",
"published": "2025-08-28T13:16:03.907",
"lastModified": "2025-08-28T13:16:03.907",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Assaf Parag Poll, Survey & Quiz Maker Plugin by Opinion Stage allows PHP Local File Inclusion. This issue affects Poll, Survey & Quiz Maker Plugin by Opinion Stage: from n/a through 19.11.0."
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"privilegesRequired": "NONE",
"userInteraction": "REQUIRED",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 1.6,
"impactScore": 5.9
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-98"
}
]
}
],
"references": [
{
"url": "https://patchstack.com/database/wordpress/plugin/social-polls-by-opinionstage/vulnerability/wordpress-poll-survey-quiz-maker-plugin-by-opinion-stage-plugin-19-11-0-local-file-inclusion-vulnerability?_s_id=cve",
"source": "[email protected]"
}
]
}
CVE-2025/CVE-2025-533xx/CVE-2025-53334.json
+56
View File
@@ -0,0 +1,56 @@
{
"id": "CVE-2025-53334",
"sourceIdentifier": "[email protected]",
"published": "2025-08-28T13:16:04.120",
"lastModified": "2025-08-28T13:16:04.120",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in TieLabs Jannah allows PHP Local File Inclusion. This issue affects Jannah: from n/a through 7.4.1."
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 2.2,
"impactScore": 5.9
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-98"
}
]
}
],
"references": [
{
"url": "https://patchstack.com/database/wordpress/theme/jannah/vulnerability/wordpress-jannah-theme-7-4-1-local-file-inclusion-vulnerability?_s_id=cve",
"source": "[email protected]"
}
]
}
CVE-2025/CVE-2025-533xx/CVE-2025-53337.json
+56
View File
@@ -0,0 +1,56 @@
{
"id": "CVE-2025-53337",
"sourceIdentifier": "[email protected]",
"published": "2025-08-28T13:16:04.340",
"lastModified": "2025-08-28T13:16:04.340",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Missing Authorization vulnerability in Ashan Perera LifePress allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects LifePress: from n/a through 2.1.3."
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"availabilityImpact": "LOW"
},
"exploitabilityScore": 2.8,
"impactScore": 2.5
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-862"
}
]
}
],
"references": [
{
"url": "https://patchstack.com/database/wordpress/plugin/lifepress/vulnerability/wordpress-lifepress-plugin-2-1-3-broken-access-control-vulnerability?_s_id=cve",
"source": "[email protected]"
}
]
}
CVE-2025/CVE-2025-533xx/CVE-2025-53396.json
+104
View File
@@ -0,0 +1,104 @@
{
"id": "CVE-2025-53396",
"sourceIdentifier": "[email protected]",
"published": "2025-08-28T09:15:33.627",
"lastModified": "2025-08-28T09:15:33.627",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Incorrect permission assignment for critical resource issue exists in SS1 Ver.16.0.0.10 and earlier (Media version:16.0.0a and earlier), which may allow users who can log in to a client terminal to obtain root privileges."
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
],
"cvssMetricV30": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.0",
"vectorString": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 7.0,
"baseSeverity": "HIGH",
"attackVector": "LOCAL",
"attackComplexity": "HIGH",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 1.0,
"impactScore": 5.9
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-732"
}
]
}
],
"references": [
{
"url": "https://jvn.jp/en/jp/JVN99577552/",
"source": "[email protected]"
},
{
"url": "https://www.dos-osaka.co.jp/news/2025/08/250827.html",
"source": "[email protected]"
}
]
}
CVE-2025/CVE-2025-535xx/CVE-2025-53572.json
+56
View File
@@ -0,0 +1,56 @@
{
"id": "CVE-2025-53572",
"sourceIdentifier": "[email protected]",
"published": "2025-08-28T13:16:04.550",
"lastModified": "2025-08-28T13:16:04.550",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Deserialization of Untrusted Data vulnerability in emarket-design WP Easy Contact allows Object Injection. This issue affects WP Easy Contact: from n/a through 4.0.1."
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 2.2,
"impactScore": 5.9
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-502"
}
]
}
],
"references": [
{
"url": "https://patchstack.com/database/wordpress/plugin/wp-easy-contact/vulnerability/wordpress-wp-easy-contact-plugin-4-0-1-php-object-injection-vulnerability?_s_id=cve",
"source": "[email protected]"
}
]
}
CVE-2025/CVE-2025-535xx/CVE-2025-53576.json
+56
View File
@@ -0,0 +1,56 @@
{
"id": "CVE-2025-53576",
"sourceIdentifier": "[email protected]",
"published": "2025-08-28T13:16:04.770",
"lastModified": "2025-08-28T13:16:04.770",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ovatheme Ovatheme Events allows PHP Local File Inclusion. This issue affects Ovatheme Events: from n/a through 1.2.8."
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 2.2,
"impactScore": 5.9
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-98"
}
]
}
],
"references": [
{
"url": "https://patchstack.com/database/wordpress/plugin/ova-events/vulnerability/wordpress-ovatheme-events-plugin-1-2-8-local-file-inclusion-vulnerability?_s_id=cve",
"source": "[email protected]"
}
]
}
CVE-2025/CVE-2025-535xx/CVE-2025-53578.json
+56
View File
@@ -0,0 +1,56 @@
{
"id": "CVE-2025-53578",
"sourceIdentifier": "[email protected]",
"published": "2025-08-28T13:16:04.990",
"lastModified": "2025-08-28T13:16:04.990",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in gavias Kipso allows PHP Local File Inclusion. This issue affects Kipso: from n/a through 1.3.4."
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 2.2,
"impactScore": 5.9
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-98"
}
]
}
],
"references": [
{
"url": "https://patchstack.com/database/wordpress/theme/kipso/vulnerability/wordpress-kipso-theme-1-3-4-local-file-inclusion-vulnerability?_s_id=cve",
"source": "[email protected]"
}
]
}
CVE-2025/CVE-2025-535xx/CVE-2025-53579.json
+56
View File
@@ -0,0 +1,56 @@
{
"id": "CVE-2025-53579",
"sourceIdentifier": "[email protected]",
"published": "2025-08-28T13:16:05.203",
"lastModified": "2025-08-28T13:16:05.203",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in captcha.eu Captcha.eu allows Reflected XSS. This issue affects Captcha.eu: from n/a through n/a."
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "REQUIRED",
"scope": "CHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "LOW"
},
"exploitabilityScore": 2.8,
"impactScore": 3.7
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-79"
}
]
}
],
"references": [
{
"url": "https://patchstack.com/database/wordpress/plugin/captcha-eu/vulnerability/wordpress-captcha-eu-plugin-1-0-61-cross-site-scripting-xss-vulnerability?_s_id=cve",
"source": "[email protected]"
}
]
}
CVE-2025/CVE-2025-535xx/CVE-2025-53583.json
+56
View File
@@ -0,0 +1,56 @@
{
"id": "CVE-2025-53583",
"sourceIdentifier": "[email protected]",
"published": "2025-08-28T13:16:05.413",
"lastModified": "2025-08-28T13:16:05.413",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Deserialization of Untrusted Data vulnerability in emarket-design Employee Spotlight allows Object Injection. This issue affects Employee Spotlight: from n/a through 5.1.1."
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 2.2,
"impactScore": 5.9
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-502"
}
]
}
],
"references": [
{
"url": "https://patchstack.com/database/wordpress/plugin/employee-spotlight/vulnerability/wordpress-employee-spotlight-plugin-5-1-1-php-object-injection-vulnerability?_s_id=cve",
"source": "[email protected]"
}
]
}
CVE-2025/CVE-2025-535xx/CVE-2025-53584.json
+56
View File
@@ -0,0 +1,56 @@
{
"id": "CVE-2025-53584",
"sourceIdentifier": "[email protected]",
"published": "2025-08-28T13:16:05.600",
"lastModified": "2025-08-28T13:16:05.600",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Deserialization of Untrusted Data vulnerability in emarket-design WP Ticket Customer Service Software & Support Ticket System allows Object Injection. This issue affects WP Ticket Customer Service Software & Support Ticket System: from n/a through 6.0.2."
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 2.2,
"impactScore": 5.9
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-502"
}
]
}
],
"references": [
{
"url": "https://patchstack.com/database/wordpress/plugin/wp-ticket/vulnerability/wordpress-wp-ticket-customer-service-software-support-ticket-system-plugin-6-0-2-php-object-injection-vulnerability?_s_id=cve",
"source": "[email protected]"
}
]
}
CVE-2025/CVE-2025-535xx/CVE-2025-53588.json
+56
View File
@@ -0,0 +1,56 @@
{
"id": "CVE-2025-53588",
"sourceIdentifier": "[email protected]",
"published": "2025-08-28T13:16:05.817",
"lastModified": "2025-08-28T13:16:05.817",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Dmitry V. (CEO of \"UKR Solution\") UPC/EAN/GTIN Code Generator allows Path Traversal. This issue affects UPC/EAN/GTIN Code Generator: from n/a through 2.0.2."
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "CHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 3.1,
"impactScore": 4.0
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-22"
}
]
}
],
"references": [
{
"url": "https://patchstack.com/database/wordpress/plugin/upc-ean-barcode-generator/vulnerability/wordpress-upc-ean-gtin-code-generator-plugin-2-0-2-arbitrary-file-deletion-vulnerability?_s_id=cve",
"source": "[email protected]"
}
]
}
CVE-2025/CVE-2025-539xx/CVE-2025-53970.json
+104
View File
@@ -0,0 +1,104 @@
{
"id": "CVE-2025-53970",
"sourceIdentifier": "[email protected]",
"published": "2025-08-28T09:15:34.390",
"lastModified": "2025-08-28T09:15:34.390",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "SS1 Ver.16.0.0.10 and earlier (Media version:16.0.0a and earlier) allows a remote unauthenticated attacker to upload arbitrary files and execute OS commands with SYSTEM privileges."
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
],
"cvssMetricV30": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.0",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-434"
}
]
}
],
"references": [
{
"url": "https://jvn.jp/en/jp/JVN99577552/",
"source": "[email protected]"
},
{
"url": "https://www.dos-osaka.co.jp/news/2025/08/250827.html",
"source": "[email protected]"
}
]
}
CVE-2025/CVE-2025-540xx/CVE-2025-54029.json
+56
View File
@@ -0,0 +1,56 @@
{
"id": "CVE-2025-54029",
"sourceIdentifier": "[email protected]",
"published": "2025-08-28T13:16:06.043",
"lastModified": "2025-08-28T13:16:06.043",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in extendons WooCommerce csv import export allows Path Traversal. This issue affects WooCommerce csv import export: from n/a through 2.0.6."
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "CHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 3.1,
"impactScore": 4.0
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-22"
}
]
}
],
"references": [
{
"url": "https://patchstack.com/database/wordpress/plugin/extendons-eo-wooimport-export/vulnerability/wordpress-woocommerce-csv-import-export-plugin-2-0-6-arbitrary-file-deletion-vulnerability?_s_id=cve",
"source": "[email protected]"
}
]
}
CVE-2025/CVE-2025-545xx/CVE-2025-54540.json
+82
View File
@@ -0,0 +1,82 @@
{
"id": "CVE-2025-54540",
"sourceIdentifier": "[email protected]",
"published": "2025-08-28T11:15:30.070",
"lastModified": "2025-08-28T11:15:30.070",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "QuickCMS is vulnerable to Reflected XSS via\u00a0sSort\u00a0parameter in admin's panel functionality. A malicious attacker can craft a specially crafted URL that, when opened, results in arbitrary JavaScript execution in the victim's browser.\n\nThe vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only version 6.8 was tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable."
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "ACTIVE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-79"
}
]
}
],
"references": [
{
"url": "https://cert.pl/posts/2025/08/CVE-2025-54540",
"source": "[email protected]"
},
{
"url": "https://opensolution.org",
"source": "[email protected]"
}
]
}
CVE-2025/CVE-2025-545xx/CVE-2025-54541.json
+82
View File
@@ -0,0 +1,82 @@
{
"id": "CVE-2025-54541",
"sourceIdentifier": "[email protected]",
"published": "2025-08-28T11:15:32.297",
"lastModified": "2025-08-28T11:15:32.297",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "QuickCMS is vulnerable to Cross-Site Request Forgery in page deletion functionality. Malicious attacker can craft special website, which when visited by the admin, will automatically send a POST request deleting an article.\n\nThe vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only version 6.8 was tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable."
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "LOW",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-352"
}
]
}
],
"references": [
{
"url": "https://cert.pl/posts/2025/08/CVE-2025-54540",
"source": "[email protected]"
},
{
"url": "https://opensolution.org",
"source": "[email protected]"
}
]
}
CVE-2025/CVE-2025-545xx/CVE-2025-54542.json
+82
View File
@@ -0,0 +1,82 @@
{
"id": "CVE-2025-54542",
"sourceIdentifier": "[email protected]",
"published": "2025-08-28T11:15:32.510",
"lastModified": "2025-08-28T11:15:32.510",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "QuickCMS sends password and login via GET Request. This allows a\u00a0local attacker with access to the victim's browser history to obtain the necessary credentials to log in as the user.\n\nThe vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only version 6.8 was tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable."
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-598"
}
]
}
],
"references": [
{
"url": "https://cert.pl/posts/2025/08/CVE-2025-54540",
"source": "[email protected]"
},
{
"url": "https://opensolution.org",
"source": "[email protected]"
}
]
}
CVE-2025/CVE-2025-545xx/CVE-2025-54543.json
+82
View File
@@ -0,0 +1,82 @@
{
"id": "CVE-2025-54543",
"sourceIdentifier": "[email protected]",
"published": "2025-08-28T11:15:32.700",
"lastModified": "2025-08-28T11:15:32.700",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "QuickCMS is vulnerable to Stored XSS via\u00a0sDescriptionMeta\u00a0parameter in page editor SEO functionality. Malicious attacker with admin privileges can inject arbitrary HTML and JS into website, which will be rendered/executed when visiting edited page. By default admin user is not able to add JavaScript into the website.\n\nThe vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only version 6.8 was tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable."
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "PASSIVE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-79"
}
]
}
],
"references": [
{
"url": "https://cert.pl/posts/2025/08/CVE-2025-54540",
"source": "[email protected]"
},
{
"url": "https://opensolution.org",
"source": "[email protected]"
}
]
}
Loaded 100 of 149 files, more files were not shown because too many files have changed in this diff. Show more