Instruction: Please provide detailed information about CVE-2025-2708

CVE:CVE-2025-2708
Description:A vulnerability, which was classified as critical, was found in zhijiantianya ruoyi-vue-pro 2.4.1. This affects an unknown part of the file /admin-api/infra/file/upload of the component Backend File Upload Interface. The manipulation of the argument path leads to path traversal. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-03-24T20:15:18.950


Instruction: Please provide detailed information about CVE-2025-2709

CVE:CVE-2025-2709
Description:A vulnerability has been found in Yonyou UFIDA ERP-NC 5.0 and classified as problematic. This vulnerability affects unknown code of the file /login.jsp. The manipulation of the argument key/redirect leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-03-24T20:15:19.133


Instruction: Please provide detailed information about CVE-2025-29100

CVE:CVE-2025-29100
Description:Tenda AC8 V16.03.34.06 is vulnerable to Buffer Overflow in the fromSetRouteStatic function via the parameter list.
published:2025-03-24T21:15:17.673


Instruction: Please provide detailed information about CVE-2025-29135

CVE:CVE-2025-29135
Description:A stack-based buffer overflow vulnerability in Tenda AC7 V15.03.06.44 allows a remote attacker to execute arbitrary code through a stack overflow attack using the security parameter of the formWifiBasicSet function.
published:2025-03-24T21:15:17.787


Instruction: Please provide detailed information about CVE-2025-29310

CVE:CVE-2025-29310
Description:An issue in onos v2.7.0 allows attackers to trigger a packet deserialization problem when supplying a crafted LLDP packet. This vulnerability allows attackers to execute arbitrary commands or access network information.
published:2025-03-24T21:15:17.893


Instruction: Please provide detailed information about CVE-2025-29311

CVE:CVE-2025-29311
Description:Limited secret space in LLDP packets used in onos v2.7.0 allows attackers to obtain the private key via a bruteforce attack. Attackers are able to leverage this vulnerability into creating crafted LLDP packets.
published:2025-03-24T21:15:18.003


Instruction: Please provide detailed information about CVE-2025-29312

CVE:CVE-2025-29312
Description:An issue in onos v2.7.0 allows attackers to trigger unexpected behavior within a device connected to a legacy switch via changing the link type from indirect to direct.
published:2025-03-24T21:15:18.113


Instruction: Please provide detailed information about CVE-2025-29313

CVE:CVE-2025-29313
Description:Use of incorrectly resolved name or reference in OpenDaylight Service Function Chaining (SFC) Subproject SFC Sodium-SR4 and below allows attackers to cause a Denial of Service (DoS).
published:2025-03-24T21:15:18.220


Instruction: Please provide detailed information about CVE-2025-29314

CVE:CVE-2025-29314
Description:Insecure Shiro cookie configurations in OpenDaylight Service Function Chaining (SFC) Subproject SFC Sodium-SR4 and below allow attackers to access sensitive information via a man-in-the-middle attack.
published:2025-03-24T21:15:18.330


Instruction: Please provide detailed information about CVE-2025-29315

CVE:CVE-2025-29315
Description:An issue in the Shiro-based RBAC (Role-based Access Control) mechanism of OpenDaylight Service Function Chaining (SFC) Subproject SFC Sodium-SR4 and below allows attackers to execute privileged operations via a crafted request.
published:2025-03-24T21:15:18.440


Instruction: Please provide detailed information about CVE-2025-2710

CVE:CVE-2025-2710
Description:A vulnerability was found in Yonyou UFIDA ERP-NC 5.0 and classified as problematic. This issue affects some unknown processing of the file /menu.jsp. The manipulation of the argument flag leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-03-24T21:15:18.547


Instruction: Please provide detailed information about CVE-2025-2711

CVE:CVE-2025-2711
Description:A vulnerability was found in Yonyou UFIDA ERP-NC 5.0. It has been classified as problematic. Affected is an unknown function of the file /help/systop.jsp. The manipulation of the argument langcode leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-03-24T21:15:18.760


Instruction: Please provide detailed information about CVE-2025-26512

CVE:CVE-2025-26512
Description:SnapCenter versions prior to  6.0.1P1 and 6.1P1 are susceptible to a vulnerability which may allow an  authenticated SnapCenter Server user to become an admin user on a remote  system where a SnapCenter plug-in has been installed.
published:2025-03-24T22:15:13.567


Instruction: Please provide detailed information about CVE-2025-2712

CVE:CVE-2025-2712
Description:A vulnerability was found in Yonyou UFIDA ERP-NC 5.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /help/top.jsp. The manipulation of the argument langcode leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-03-24T22:15:14.110


Instruction: Please provide detailed information about CVE-2025-2714

CVE:CVE-2025-2714
Description:A vulnerability was found in JoomlaUX JUX Real Estate 3.4.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /extensions/realestate/index.php/agents/agent-register/addagent. The manipulation of the argument plan_id leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-03-24T22:15:14.283


Instruction: Please provide detailed information about CVE-2025-2715

CVE:CVE-2025-2715
Description:A vulnerability classified as problematic has been found in timschofield webERP up to 5.0.0.rc+13. This affects an unknown part of the file ConfirmDispatch_Invoice.php of the component Confirm Dispatch and Invoice Page. The manipulation of the argument Narrative leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-03-24T23:15:13.440


Instruction: Please provide detailed information about CVE-2025-2716

CVE:CVE-2025-2716
Description:A vulnerability classified as problematic was found in China Mobile P22g-CIac 1.0.00.488. This vulnerability affects unknown code of the component Samba Path Handler. The manipulation leads to path traversal. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-03-24T23:15:13.610


Instruction: Please provide detailed information about CVE-2025-1097

CVE:CVE-2025-1097
Description:A security issue was discovered in  ingress-nginx https://github.com/kubernetes/ingress-nginx  where the `auth-tls-match-cn` Ingress annotation can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)
published:2025-03-25T00:15:13.590


Instruction: Please provide detailed information about CVE-2025-1098

CVE:CVE-2025-1098
Description:A security issue was discovered in  ingress-nginx https://github.com/kubernetes/ingress-nginx  where the `mirror-target` and `mirror-host` Ingress annotations can be used to inject arbitrary configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)
published:2025-03-25T00:15:14.613


Instruction: Please provide detailed information about CVE-2025-1974

CVE:CVE-2025-1974
Description:A security issue was discovered in Kubernetes where under certain conditions, an unauthenticated attacker with access to the pod network can achieve arbitrary code execution in the context of the ingress-nginx controller. This can lead to disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)
published:2025-03-25T00:15:14.753


Instruction: Please provide detailed information about CVE-2025-24513

CVE:CVE-2025-24513
Description:A security issue was discovered in  ingress-nginx https://github.com/kubernetes/ingress-nginx  where attacker-provided data are included in a filename by the ingress-nginx Admission Controller feature, resulting in directory traversal within the container. This could result in denial of service, or when combined with other vulnerabilities, limited disclosure of Secret objects from the cluster.
published:2025-03-25T00:15:14.900


Instruction: Please provide detailed information about CVE-2025-24514

CVE:CVE-2025-24514
Description:A security issue was discovered in  ingress-nginx https://github.com/kubernetes/ingress-nginx  where the `auth-url` Ingress annotation can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)
published:2025-03-25T00:15:15.047


Instruction: Please provide detailed information about CVE-2025-2717

CVE:CVE-2025-2717
Description:A vulnerability, which was classified as critical, has been found in D-Link DIR-823X 240126/240802. This issue affects the function sub_41710C of the file /goform/diag_nslookup of the component HTTP POST Request Handler. The manipulation of the argument target_addr leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
published:2025-03-25T00:15:15.290


Instruction: Please provide detailed information about CVE-2025-2720

CVE:CVE-2025-2720
Description:Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: According to the code maintainer the call of the POC is invalid because the buffer pointed to by "data" must have "len" valid bytes. The docs were updated to make that clear.
published:2025-03-25T00:15:15.500


Instruction: Please provide detailed information about CVE-2025-2721

CVE:CVE-2025-2721
Description:A vulnerability was found in GNOME libgsf up to 1.14.53. It has been classified as critical. This affects the function gsf_base64_encode_simple. The manipulation of the argument size_t leads to heap-based buffer overflow. An attack has to be approached locally. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-03-25T00:15:15.693


Instruction: Please provide detailed information about CVE-2025-2722

CVE:CVE-2025-2722
Description:A vulnerability was found in GNOME libgsf up to 1.14.53. It has been declared as critical. This vulnerability affects the function gsf_prop_settings_collect_va. The manipulation of the argument n_alloced_params leads to heap-based buffer overflow. Local access is required to approach this attack. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-03-25T01:15:11.617


Instruction: Please provide detailed information about CVE-2025-2723

CVE:CVE-2025-2723
Description:A vulnerability was found in GNOME libgsf up to 1.14.53. It has been rated as critical. This issue affects the function gsf_property_settings_collec. The manipulation of the argument n_alloced_params leads to heap-based buffer overflow. Attacking locally is a requirement. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-03-25T01:15:11.800


Instruction: Please provide detailed information about CVE-2025-2724

CVE:CVE-2025-2724
Description:A vulnerability classified as problematic has been found in GNOME libgsf up to 1.14.53. Affected is the function sorting_key_copy. The manipulation of the argument Name leads to out-of-bounds read. It is possible to launch the attack on the local host. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-03-25T02:15:14.143


Instruction: Please provide detailed information about CVE-2025-2725

CVE:CVE-2025-2725
Description:A vulnerability classified as critical was found in H3C Magic NX15, Magic NX30 Pro, Magic NX400, Magic R3010 and Magic BE18000 up to V100R014. Affected by this vulnerability is an unknown functionality of the file /api/login/auth of the component HTTP POST Request Handler. The manipulation leads to command injection. The attack needs to be initiated within the local network. The exploit has been disclosed to the public and may be used.
published:2025-03-25T03:15:16.097


Instruction: Please provide detailed information about CVE-2025-2726

CVE:CVE-2025-2726
Description:A vulnerability, which was classified as critical, has been found in H3C Magic NX15, Magic NX30 Pro, Magic NX400, Magic R3010 and Magic BE18000 up to V100R014. Affected by this issue is some unknown functionality of the file /api/esps of the component HTTP POST Request Handler. The manipulation leads to command injection. Access to the local network is required for this attack. The exploit has been disclosed to the public and may be used.
published:2025-03-25T03:15:16.280


Instruction: Please provide detailed information about CVE-2025-2727

CVE:CVE-2025-2727
Description:A vulnerability, which was classified as critical, was found in H3C Magic NX30 Pro up to V100R007. This affects an unknown part of the file /api/wizard/getNetworkStatus of the component HTTP POST Request Handler. The manipulation leads to command injection. Access to the local network is required for this attack to succeed. The exploit has been disclosed to the public and may be used.
published:2025-03-25T03:15:16.450


Instruction: Please provide detailed information about CVE-2025-2728

CVE:CVE-2025-2728
Description:A vulnerability has been found in H3C Magic NX30 Pro and Magic NX400 up to V100R014 and classified as critical. This vulnerability affects unknown code of the file /api/wizard/getNetworkConf. The manipulation leads to command injection. The attack needs to be approached within the local network.
published:2025-03-25T03:15:16.627


Instruction: Please provide detailed information about CVE-2025-2729

CVE:CVE-2025-2729
Description:A vulnerability was found in H3C Magic NX15, Magic NX30 Pro, Magic NX400, Magic R3010 and Magic BE18000 up to V100R014 and classified as critical. This issue affects some unknown processing of the file /api/wizard/networkSetup of the component HTTP POST Request Handler. The manipulation leads to command injection. The attack can only be done within the local network. The exploit has been disclosed to the public and may be used.
published:2025-03-25T03:15:16.800


Instruction: Please provide detailed information about CVE-2025-2730

CVE:CVE-2025-2730
Description:A vulnerability was found in H3C Magic NX15, Magic NX30 Pro, Magic NX400, Magic R3010 and Magic BE18000 up to V100R014. It has been classified as critical. Affected is an unknown function of the file /api/wizard/getssidname of the component HTTP POST Request Handler. The manipulation leads to command injection. The attack can only be initiated within the local network. The exploit has been disclosed to the public and may be used.
published:2025-03-25T03:15:16.973


Instruction: Please provide detailed information about CVE-2025-2731

CVE:CVE-2025-2731
Description:A vulnerability was found in H3C Magic NX15, Magic NX30 Pro, Magic NX400, Magic R3010 and Magic BE18000 up to V100R014. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /api/wizard/getDualbandSync of the component HTTP POST Request Handler. The manipulation leads to command injection. The attack needs to be done within the local network. The exploit has been disclosed to the public and may be used.
published:2025-03-25T04:15:18.943


Instruction: Please provide detailed information about CVE-2025-2732

CVE:CVE-2025-2732
Description:A vulnerability was found in H3C Magic NX15, Magic NX30 Pro, Magic NX400, Magic R3010 and Magic BE18000 up to V100R014. It has been rated as critical. Affected by this issue is some unknown functionality of the file /api/wizard/getWifiNeighbour of the component HTTP POST Request Handler. The manipulation leads to command injection. The attack needs to be initiated within the local network. The exploit has been disclosed to the public and may be used.
published:2025-03-25T04:15:20.793


Instruction: Please provide detailed information about CVE-2025-2733

CVE:CVE-2025-2733
Description:A vulnerability classified as critical has been found in mannaandpoem OpenManus up to 2025.3.13. This affects an unknown part of the file app/tool/python_execute.py of the component Prompt Handler. The manipulation leads to os command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-03-25T05:15:40.870


Instruction: Please provide detailed information about CVE-2025-2734

CVE:CVE-2025-2734
Description:A vulnerability, which was classified as critical, was found in PHPGurukul Old Age Home Management System 1.0. Affected is an unknown function of the file /admin/aboutus.php. The manipulation of the argument pagetitle leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
published:2025-03-25T05:15:41.073


Instruction: Please provide detailed information about CVE-2025-2735

CVE:CVE-2025-2735
Description:A vulnerability has been found in PHPGurukul Old Age Home Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin/add-services.php. The manipulation of the argument sertitle leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
published:2025-03-25T05:15:41.287


Instruction: Please provide detailed information about CVE-2025-2736

CVE:CVE-2025-2736
Description:A vulnerability was found in PHPGurukul Old Age Home Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/bwdates-report-details.php. The manipulation of the argument fromdate leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.
published:2025-03-25T05:15:41.490


Instruction: Please provide detailed information about CVE-2025-0717

CVE:CVE-2025-0717
Description:To exploit the vulnerability, it is necessary:
published:2025-03-25T06:15:40.123


Instruction: Please provide detailed information about CVE-2025-0845

CVE:CVE-2025-0845
Description:The DesignThemes Core Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 4.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
published:2025-03-25T06:15:40.213


Instruction: Please provide detailed information about CVE-2025-1452

CVE:CVE-2025-1452
Description:The Favorites WordPress plugin before 2.3.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
published:2025-03-25T06:15:40.390


Instruction: Please provide detailed information about CVE-2025-1798

CVE:CVE-2025-1798
Description:The  does not sanitise and escape some parameters when outputting them back in a page, allowing unauthenticated users the ability to perform stored Cross-Site Scripting attacks.
published:2025-03-25T06:15:40.480


Instruction: Please provide detailed information about CVE-2025-27809

CVE:CVE-2025-27809
Description:Mbed TLS before 2.28.10 and 3.x before 3.6.3, on the client side, accepts servers that have trusted certificates for arbitrary hostnames unless the TLS client application calls mbedtls_ssl_set_hostname.
published:2025-03-25T06:15:41.000


Instruction: Please provide detailed information about CVE-2025-27810

CVE:CVE-2025-27810
Description:Mbed TLS before 2.28.10 and 3.x before 3.6.3, in some cases of failed memory allocation or hardware errors, uses uninitialized stack memory to compose the TLS Finished message, potentially leading to authentication bypasses such as replays.
published:2025-03-25T06:15:41.180


Instruction: Please provide detailed information about CVE-2025-2224

CVE:CVE-2025-2224
Description:The Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings plugin for WordPress is vulnerable to unauthorized access  and modification of data due to a missing capability check on the 'parse_query' function in all versions up to, and including, 8.2. This makes it possible for unauthenticated attackers to update the post_status of any post to 'publish'.
published:2025-03-25T06:15:41.327


Instruction: Please provide detailed information about CVE-2025-2737

CVE:CVE-2025-2737
Description:A vulnerability was found in PHPGurukul Old Age Home Management System 1.0. It has been classified as critical. This affects an unknown part of the file /admin/contactus.php. The manipulation of the argument pagetitle leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
published:2025-03-25T06:15:41.493


Instruction: Please provide detailed information about CVE-2025-2738

CVE:CVE-2025-2738
Description:A vulnerability was found in PHPGurukul Old Age Home Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /admin/manage-scdetails.php. The manipulation of the argument namesc leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
published:2025-03-25T06:15:41.767


Instruction: Please provide detailed information about CVE-2025-2739

CVE:CVE-2025-2739
Description:A vulnerability was found in PHPGurukul Old Age Home Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /admin/manage-services.php. The manipulation of the argument sertitle leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
published:2025-03-25T06:15:41.953


Instruction: Please provide detailed information about CVE-2025-1320

CVE:CVE-2025-1320
Description:The teachPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 9.0.9. This is due to missing or incorrect nonce validation on the import.php page. This makes it possible for unauthenticated attackers to delete imports via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
published:2025-03-25T07:15:38.180


Instruction: Please provide detailed information about CVE-2025-2252

CVE:CVE-2025-2252
Description:The Easy Digital Downloads – eCommerce Payments and Subscriptions made easy plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.3.6.1 via the edd_ajax_get_download_title() function. This makes it possible for unauthenticated attackers to extract private post titles of downloads. The impact here is minimal.
published:2025-03-25T07:15:38.337


Instruction: Please provide detailed information about CVE-2025-2740

CVE:CVE-2025-2740
Description:A vulnerability classified as critical has been found in PHPGurukul Old Age Home Management System 1.0. Affected is an unknown function of the file /admin/eligibility.php. The manipulation of the argument pagetitle leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
published:2025-03-25T07:15:38.493


Instruction: Please provide detailed information about CVE-2025-2742

CVE:CVE-2025-2742
Description:A vulnerability classified as critical was found in zhijiantianya ruoyi-vue-pro 2.4.1. This vulnerability affects unknown code of the file /admin-api/mp/material/upload-permanent of the component Material Upload Interface. The manipulation of the argument File leads to path traversal. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-03-25T07:15:38.700


Instruction: Please provide detailed information about CVE-2025-2743

CVE:CVE-2025-2743
Description:A vulnerability, which was classified as problematic, has been found in zhijiantianya ruoyi-vue-pro 2.4.1. This issue affects some unknown processing of the file /admin-api/mp/material/upload-temporary of the component Material Upload Interface. The manipulation of the argument File leads to path traversal. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-03-25T07:15:38.883


Instruction: Please provide detailed information about CVE-2025-2744

CVE:CVE-2025-2744
Description:A vulnerability, which was classified as critical, was found in zhijiantianya ruoyi-vue-pro 2.4.1. Affected is an unknown function of the file /admin-api/mp/material/upload-news-image of the component Material Upload Interface. The manipulation of the argument File leads to path traversal. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-03-25T07:15:39.103


Instruction: Please provide detailed information about CVE-2025-2750

CVE:CVE-2025-2750
Description:A vulnerability, which was classified as critical, was found in Open Asset Import Library Assimp 5.4.3. This affects the function Assimp::CSMImporter::InternReadFile of the file code/AssetLib/CSM/CSMLoader.cpp of the component CSM File Handler. The manipulation leads to out-of-bounds write. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
published:2025-03-25T08:15:19.203


Instruction: Please provide detailed information about CVE-2025-2751

CVE:CVE-2025-2751
Description:A vulnerability has been found in Open Asset Import Library Assimp 5.4.3 and classified as problematic. This vulnerability affects the function Assimp::CSMImporter::InternReadFile of the file code/AssetLib/CSM/CSMLoader.cpp of the component CSM File Handler. The manipulation of the argument na leads to out-of-bounds read. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
published:2025-03-25T08:15:20.013


Instruction: Please provide detailed information about CVE-2025-2752

CVE:CVE-2025-2752
Description:A vulnerability was found in Open Asset Import Library Assimp 5.4.3 and classified as problematic. This issue affects the function fast_atoreal_move in the library include/assimp/fast_atof.h of the component CSM File Handler. The manipulation leads to out-of-bounds read. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
published:2025-03-25T08:15:20.193


Instruction: Please provide detailed information about CVE-2025-2319

CVE:CVE-2025-2319
Description:The EZ SQL Reports Shortcode Widget and DB Backup plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions 4.11.13 to 5.25.08. This is due to missing or incorrect nonce validation on the 'ELISQLREPORTS_menu' function. This makes it possible for unauthenticated attackers to execute code on the server via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Version 5.25.10 adds a nonce check, which makes this vulnerability exploitable by admins only.
published:2025-03-25T09:15:16.377


Instruction: Please provide detailed information about CVE-2025-2510

CVE:CVE-2025-2510
Description:The Frndzk Expandable Bottom Bar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'text' parameter in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
published:2025-03-25T09:15:16.597


Instruction: Please provide detailed information about CVE-2025-2559

CVE:CVE-2025-2559
Description:A flaw was found in Keycloak. When the configuration uses JWT tokens for authentication, the tokens are cached until expiration. If a client uses JWT tokens with an excessively long expiration time, for example, 24 or 48 hours, the cache can grow indefinitely, leading to an OutOfMemoryError. This issue could result in a denial of service condition, preventing legitimate users from accessing the system.
published:2025-03-25T09:15:17.047


Instruction: Please provide detailed information about CVE-2025-2753

CVE:CVE-2025-2753
Description:A vulnerability was found in Open Asset Import Library Assimp 5.4.3. It has been classified as critical. Affected is the function SceneCombiner::MergeScenes of the file code/AssetLib/LWS/LWSLoader.cpp of the component LWS File Handler. The manipulation leads to out-of-bounds read. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
published:2025-03-25T09:15:17.247


Instruction: Please provide detailed information about CVE-2025-2754

CVE:CVE-2025-2754
Description:A vulnerability was found in Open Asset Import Library Assimp 5.4.3. It has been declared as critical. Affected by this vulnerability is the function Assimp::AC3DImporter::ConvertObjectSection of the file code/AssetLib/AC/ACLoader.cpp of the component AC3D File Handler. The manipulation of the argument it leads to heap-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
published:2025-03-25T09:15:17.730


Instruction: Please provide detailed information about CVE-2025-2755

CVE:CVE-2025-2755
Description:A vulnerability was found in Open Asset Import Library Assimp 5.4.3. It has been rated as critical. Affected by this issue is the function Assimp::AC3DImporter::ConvertObjectSection of the file code/AssetLib/AC/ACLoader.cpp of the component AC3D File Handler. The manipulation of the argument src.entries leads to out-of-bounds read. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
published:2025-03-25T09:15:17.983


Instruction: Please provide detailed information about CVE-2025-2542

CVE:CVE-2025-2542
Description:The Your Simple SVG Support plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
published:2025-03-25T10:15:16.220


Instruction: Please provide detailed information about CVE-2025-2635

CVE:CVE-2025-2635
Description:The Digital License Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of remove_query_arg() function without appropriate escaping on the URL in all versions up to, and including, 1.7.3. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
published:2025-03-25T10:15:16.430


Instruction: Please provide detailed information about CVE-2025-2756

CVE:CVE-2025-2756
Description:A vulnerability classified as critical has been found in Open Asset Import Library Assimp 5.4.3. This affects the function Assimp::AC3DImporter::ConvertObjectSection of the file code/AssetLib/AC/ACLoader.cpp of the component AC3D File Handler. The manipulation of the argument tmp leads to heap-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
published:2025-03-25T10:15:16.627


Instruction: Please provide detailed information about CVE-2025-2757

CVE:CVE-2025-2757
Description:A vulnerability classified as critical was found in Open Asset Import Library Assimp 5.4.3. This vulnerability affects the function AI_MD5_PARSE_STRING_IN_QUOTATION of the file code/AssetLib/MD5/MD5Parser.cpp of the component MD5 File Handler. The manipulation of the argument data leads to heap-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
published:2025-03-25T10:15:16.887


Instruction: Please provide detailed information about CVE-2025-2109

CVE:CVE-2025-2109
Description:The WP Compress – Instant Performance & Speed Optimization plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 6.30.15 via the init() function. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query information from internal services.
published:2025-03-25T11:15:36.333


Instruction: Please provide detailed information about CVE-2025-1445

CVE:CVE-2025-1445
Description:A vulnerability exists in RTU IEC 61850 client and server functionality that could impact the availability if renegotiation of an open IEC61850 TLS connection takes place in specific timing situations, when IEC61850 communication is active.  Precondition is that IEC61850 as client or server are configured using TLS on RTU500 device. It affects the CMU the IEC61850 stack is configured on.
published:2025-03-25T13:15:40.347


Instruction: Please provide detailed information about CVE-2025-27631

CVE:CVE-2025-27631
Description:The TRMTracker web application is vulnerable to LDAP injection attack potentially allowing an attacker to inject code into a query and execute remote commands that can read and update data on the website.
published:2025-03-25T13:15:40.947


Instruction: Please provide detailed information about CVE-2025-27632

CVE:CVE-2025-27632
Description:A Host Header Injection vulnerability in TRMTracker application may allow an attacker by modifying the host header value in an HTTP request to leverage multiple attack vectors, including defacing the site content through web-cache poisoning.
published:2025-03-25T13:15:41.090


Instruction: Please provide detailed information about CVE-2025-27633

CVE:CVE-2025-27633
Description:The TRMTracker web application is vulnerable to reflected Cross-site scripting attack. The application allows client-side code injection that might be used to compromise the confidentiality and integrity of the system.
published:2025-03-25T13:15:41.223


Instruction: Please provide detailed information about CVE-2025-29932

CVE:CVE-2025-29932
Description:In JetBrains GoLand before 2025.1 an XXE during debugging was possible
published:2025-03-25T13:15:41.520


Instruction: Please provide detailed information about CVE-2025-22230

CVE:CVE-2025-22230
Description:VMware Tools for Windows contains an authentication bypass vulnerability due to improper access control. A malicious actor with non-administrative privileges on a guest VM may gain ability to perform certain high privilege operations within that VM.
published:2025-03-25T14:15:28.440


Instruction: Please provide detailed information about CVE-2025-29635

CVE:CVE-2025-29635
Description:A command injection vulnerability in D-Link DIR-823X 240126 and 240802 allows an authorized attacker to execute arbitrary commands on remote devices by sending a POST request to /goform/set_prohibiting via the corresponding function, triggering remote command execution.
published:2025-03-25T14:15:29.043


Instruction: Please provide detailed information about CVE-2025-30091

CVE:CVE-2025-30091
Description:In Tiny MoxieManager PHP before 4.0.0, remote code execution can occur in the installer command. This vulnerability allows unauthenticated attackers to inject and execute arbitrary code. Attacker-controlled data to InstallCommand can be inserted into config.php, and InstallCommand is available after an installation has completed.
published:2025-03-25T14:15:32.143


Instruction: Please provide detailed information about CVE-2025-26742

CVE:CVE-2025-26742
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GhozyLab Gallery for Social Photo allows Stored XSS.This issue affects Gallery for Social Photo: from n/a through 1.0.0.35.
published:2025-03-25T15:15:24.803


Instruction: Please provide detailed information about CVE-2025-27147

CVE:CVE-2025-27147
Description:The GLPI Inventory Plugin handles various types of tasks for GLPI agents, including network discovery and inventory (SNMP), software deployment, VMWare ESX host remote inventory, and data collection (files, Windows registry, WMI). Versions prior to 1.5.0 have an improper access control vulnerability. Version 1.5.0 fixes the vulnerability.
published:2025-03-25T15:15:24.957


Instruction: Please provide detailed information about CVE-2025-2530

CVE:CVE-2025-2530
Description:Luxion KeyShot DAE File Parsing Access of Uninitialized Pointer Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Luxion KeyShot. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.  The specific flaw exists within the parsing of dae files. The issue results from the lack of proper initialization of a pointer prior to accessing it. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-23698.
published:2025-03-25T15:15:25.610


Instruction: Please provide detailed information about CVE-2025-2531

CVE:CVE-2025-2531
Description:Luxion KeyShot DAE File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Luxion KeyShot. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.  The specific flaw exists within the parsing of dae files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-23704.
published:2025-03-25T15:15:25.773


Instruction: Please provide detailed information about CVE-2025-2532

CVE:CVE-2025-2532
Description:Luxion KeyShot USDC File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Luxion KeyShot. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.  The specific flaw exists within the parsing of usdc files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-23709.
published:2025-03-25T15:15:25.907


Instruction: Please provide detailed information about CVE-2025-30212

CVE:CVE-2025-30212
Description:Frappe is a full-stack web application framework. An SQL Injection vulnerability has been identified in Frappe Framework prior to versions 14.89.0 and 15.51.0 which could allow a malicious actor to access sensitive information. Versions 14.89.0 and 15.51.0 fix the issue. Upgrading is required; no other workaround is present.
published:2025-03-25T15:15:26.143


Instruction: Please provide detailed information about CVE-2025-30213

CVE:CVE-2025-30213
Description:Frappe is a full-stack web application framework. Prior to versions 14.91.0 and 15.52.0, a system user was able to create certain documents in a specific way that could lead to remote code execution. Versions 14.9.1 and 15.52.0 contain a patch for the vulnerability. There's no workaround; an upgrade is required.
published:2025-03-25T15:15:26.307


Instruction: Please provide detailed information about CVE-2025-30214

CVE:CVE-2025-30214
Description:Frappe is a full-stack web application framework. Prior to versions 14.89.0 and 15.51.0, making crafted requests could lead to information disclosure that could further lead to account takeover. Versions 14.89.0 and 15.51.0 fix the issue. There's no workaround to fix this without upgrading.
published:2025-03-25T15:15:26.460


Instruction: Please provide detailed information about CVE-2025-2312

CVE:CVE-2025-2312
Description:A flaw was found in cifs-utils. When trying to obtain Kerberos credentials, the cifs.upcall program from the cifs-utils package makes an upcall to the wrong namespace in containerized environments. This issue may lead to disclosing sensitive data from the host's Kerberos credentials cache.
published:2025-03-25T18:15:34.987


Instruction: Please provide detailed information about CVE-2025-28904

CVE:CVE-2025-28904
Description:Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Shamalli Web Directory Free allows Blind SQL Injection. This issue affects Web Directory Free: from n/a through 1.7.6.
published:2025-03-25T19:15:45.827


Instruction: Please provide detailed information about CVE-2025-30567

CVE:CVE-2025-30567
Description:Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in wp01ru WP01 allows Path Traversal. This issue affects WP01: from n/a through 2.6.2.
published:2025-03-25T19:15:46.350


Instruction: Please provide detailed information about CVE-2025-30118

CVE:CVE-2025-30118
Description:An issue was discovered on the Audi Universal Traffic Recorder 2.88. It has Susceptibility to denial of service. It uses the same default credentials for all devices and does not implement proper multi-device authentication, allowing attackers to deny the owner access by occupying the only available connection. The SSID remains broadcast at all times, increasing exposure to potential attacks.
published:2025-03-25T20:15:22.447


Instruction: Please provide detailed information about CVE-2025-30216

CVE:CVE-2025-30216
Description:CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between a spacecraft running the core Flight System (cFS) and a ground station. In versions 1.3.3 and prior, a Heap Overflow vulnerability occurs in the `Crypto_TM_ProcessSecurity` function (`crypto_tm.c:1735:8`). When processing the Secondary Header Length of a TM protocol packet, if the Secondary Header Length exceeds the packet's total length, a heap overflow is triggered during the memcpy operation that copies packet data into the dynamically allocated buffer `p_new_dec_frame`. This allows an attacker to overwrite adjacent heap memory, potentially leading to arbitrary code execution or system instability. A patch is available at commit 810fd66d592c883125272fef123c3240db2f170f.
published:2025-03-25T20:15:22.567


Instruction: Please provide detailed information about CVE-2025-25371

CVE:CVE-2025-25371
Description:NASA cFS (Core Flight System) Aquila is vulnerable to path traversal in the OSAL module, allowing the override of any arbitrary file on the system.
published:2025-03-25T21:15:41.907


Instruction: Please provide detailed information about CVE-2025-25372

CVE:CVE-2025-25372
Description:NASA cFS (Core Flight System) Aquila is vulnerable to segmentation fault via sending a malicious telecommand to the Memory Management Module.
published:2025-03-25T21:15:42.027


Instruction: Please provide detailed information about CVE-2025-25373

CVE:CVE-2025-25373
Description:The Memory Management Module of NASA cFS (Core Flight System) Aquila has insecure permissions, which can be exploited to gain an RCE on the platform.
published:2025-03-25T21:15:42.140


Instruction: Please provide detailed information about CVE-2025-25374

CVE:CVE-2025-25374
Description:In NASA cFS (Core Flight System) Aquila, it is possible to put the onboard software in a state that will prevent the launch of any external application, causing a platform denial of service.
published:2025-03-25T21:15:42.250


Instruction: Please provide detailed information about CVE-2025-27830

CVE:CVE-2025-27830
Description:An issue was discovered in Artifex Ghostscript before 10.05.0. A buffer overflow occurs during serialization of DollarBlend in a font, for base/write_t1.c and psi/zfapi.c.
published:2025-03-25T21:15:42.353


Instruction: Please provide detailed information about CVE-2025-27831

CVE:CVE-2025-27831
Description:An issue was discovered in Artifex Ghostscript before 10.05.0. The DOCXWRITE TXTWRITE device has a text buffer overflow via long characters to devices/vector/doc_common.c.
published:2025-03-25T21:15:42.467


Instruction: Please provide detailed information about CVE-2025-27832

CVE:CVE-2025-27832
Description:An issue was discovered in Artifex Ghostscript before 10.05.0. The NPDL device has a Compression buffer overflow for contrib/japanese/gdevnpdl.c.
published:2025-03-25T21:15:42.570


Instruction: Please provide detailed information about CVE-2025-27833

CVE:CVE-2025-27833
Description:An issue was discovered in Artifex Ghostscript before 10.05.0. A buffer overflow occurs for a long TTF font name to pdf/pdf_fmap.c.
published:2025-03-25T21:15:42.683


Instruction: Please provide detailed information about CVE-2025-27834

CVE:CVE-2025-27834
Description:An issue was discovered in Artifex Ghostscript before 10.05.0. A buffer overflow occurs via an oversized Type 4 function in a PDF document to pdf/pdf_func.c.
published:2025-03-25T21:15:42.870


Instruction: Please provide detailed information about CVE-2025-27835

CVE:CVE-2025-27835
Description:An issue was discovered in Artifex Ghostscript before 10.05.0. A buffer overflow occurs when converting glyphs to Unicode in psi/zbfont.c.
published:2025-03-25T21:15:43.013


Instruction: Please provide detailed information about CVE-2025-27836

CVE:CVE-2025-27836
Description:An issue was discovered in Artifex Ghostscript before 10.05.0. The BJ10V device has a Print buffer overflow in contrib/japanese/gdev10v.c.
published:2025-03-25T21:15:43.137


Instruction: Please provide detailed information about CVE-2025-27837

CVE:CVE-2025-27837
Description:An issue was discovered in Artifex Ghostscript before 10.05.0. Access to arbitrary files can occur through a truncated path with invalid UTF-8 characters, for base/gp_mswin.c and base/winrtsup.cpp.
published:2025-03-25T21:15:43.250


Instruction: Please provide detailed information about CVE-2025-29789

CVE:CVE-2025-29789
Description:OpenEMR is a free and open source electronic health records and medical practice management application. Versions prior to 7.3.0 are vulnerable to Directory Traversal in the Load Code feature. Version 7.3.0 contains a patch for the issue.
published:2025-03-25T21:15:43.363


Instruction: Please provide detailed information about CVE-2025-30741

CVE:CVE-2025-30741
Description:Pixelfed before 0.12.5 allows anyone to follow private accounts and see private posts on other Fediverse servers. This affects users elsewhere in the Fediverse, if they otherwise have any followers from a Pixelfed instance.
published:2025-03-25T21:15:43.527


Instruction: Please provide detailed information about CVE-2025-30219

CVE:CVE-2025-30219
Description:RabbitMQ is a messaging and streaming broker. Versions prior to 4.0.3 are vulnerable to a sophisticated attack that could modify virtual host name on disk and then make it unrecoverable (with other on disk file modifications) can lead to arbitrary JavaScript code execution in the browsers of management UI users. When a virtual host on a RabbitMQ node fails to start, recent versions will display an error message (a notification) in the management UI. The error message includes virtual host name, which was not escaped prior to open source RabbitMQ 4.0.3 and Tanzu RabbitMQ 4.0.3, 3.13.8. An attack that both makes a virtual host fail to start and creates a new virtual host name with an XSS code snippet or changes the name of an existing virtual host on disk could trigger arbitrary JavaScript code execution in the management UI (the user's browser). Open source RabbitMQ `4.0.3` and Tanzu RabbitMQ `4.0.3` and `3.13.8` patch the issue.
published:2025-03-25T23:15:36.560


Instruction: Please provide detailed information about CVE-2025-30222

CVE:CVE-2025-30222
Description:Shescape is a simple shell escape library for JavaScript. Versions 1.7.2 through 2.1.1 are vulnerable to potential environment variable exposure on Windows with CMD. This impact users of Shescape on Windows that explicitly configure `shell: 'cmd.exe'` or `shell: true` using any of `quote`/`quoteAll`/`escape`/`escapeAll`. An attacker may be able to get read-only access to environment variables. This bug has been patched in v2.1.2. For those who are already using v2 of Shescape, no further changes are required. Those who are are using v1 of Shescape should follow the migration guide to upgrade to v2. There is no plan to release a patch compatible with v1 of Shescape. As a workaround, users can remove all instances of `%` from user input before using Shescape.
published:2025-03-25T23:15:36.707


Instruction: Please provide detailed information about CVE-2025-2276

CVE:CVE-2025-2276
Description:The Ultimate Dashboard – Custom WordPress Dashboard plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the handle_module_actions function in all versions up to, and including, 3.8.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to activate/deactivate plugin modules.
published:2025-03-26T00:15:13.440


Instruction: Please provide detailed information about CVE-2025-2302

CVE:CVE-2025-2302
Description:The Advanced Woo Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's aws_search_terms shortcode in all versions up to, and including, 3.28 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
published:2025-03-26T00:15:13.593


Instruction: Please provide detailed information about CVE-2025-1490

CVE:CVE-2025-1490
Description:The Smart Maintenance Mode plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘setstatus’ parameter in all versions up to, and including, 1.5.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
published:2025-03-26T03:15:12.257


Instruction: Please provide detailed information about CVE-2025-2165

CVE:CVE-2025-2165
Description:The SH Email Alert plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'mid' parameter in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
published:2025-03-26T03:15:12.853


Instruction: Please provide detailed information about CVE-2025-2573

CVE:CVE-2025-2573
Description:The Amazing service box Addons For WPBakery Page Builder (formerly Visual Composer) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 2.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
published:2025-03-26T03:15:13.033


Instruction: Please provide detailed information about CVE-2025-2576

CVE:CVE-2025-2576
Description:The Ayyash Studio — The kick-start kit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
published:2025-03-26T03:15:13.213


Instruction: Please provide detailed information about CVE-2025-30742

CVE:CVE-2025-30742
Description:httpd.c in atophttpd 2.8.0 has an off-by-one error and resultant out-of-bounds read because a certain 1024-character req string would not have a final '\0' character.
published:2025-03-26T04:15:23.403


Instruction: Please provide detailed information about CVE-2025-1784

CVE:CVE-2025-1784
Description:The Spectra – WordPress Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the uagb block in all versions up to, and including, 2.19.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
published:2025-03-26T06:15:28.557


Instruction: Please provide detailed information about CVE-2025-1514

CVE:CVE-2025-1514
Description:The Active Products Tables for WooCommerce. Use constructor to create tables plugin for WordPress is vulnerable to unauthorized filter calling due to insufficient restrictions on the get_smth() function in all versions up to, and including, 1.0.6.7. This makes it possible for unauthenticated attackers to call arbitrary WordPress filters with a single parameter.
published:2025-03-26T09:15:15.950


Instruction: Please provide detailed information about CVE-2025-2009

CVE:CVE-2025-2009
Description:The Newsletters plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the logging functionality in all versions up to, and including, 4.9.9.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
published:2025-03-26T09:15:16.140


Instruction: Please provide detailed information about CVE-2025-2167

CVE:CVE-2025-2167
Description:The Event post plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'events_list' shortcodes in all versions up to, and including, 5.9.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
published:2025-03-26T09:15:16.500


Instruction: Please provide detailed information about CVE-2025-2257

CVE:CVE-2025-2257
Description:The Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.16.10 via the compression_level setting. This is due to the plugin using the compression_level setting in proc_open() without any validation. This makes it possible for authenticated attackers, with administrator-level access and above, to execute code on the server.
published:2025-03-26T09:15:16.647


Instruction: Please provide detailed information about CVE-2025-1310

CVE:CVE-2025-1310
Description:The Jobs for WordPress plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.7.11 via the 'job_postings_get_file' parameter. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.
published:2025-03-26T10:15:14.653


Instruction: Please provide detailed information about CVE-2025-1437

CVE:CVE-2025-1437
Description:The Advanced iFrame plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'advanced_iframe' shortcode in all versions up to, and including, 2024.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
published:2025-03-26T10:15:14.930


Instruction: Please provide detailed information about CVE-2025-1439

CVE:CVE-2025-1439
Description:The Advanced iFrame plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'advanced_iframe' shortcode in all versions up to, and including, 2024.5 due to insufficient input sanitization and output escaping on user supplied attributes through the 'src' attribute when the src supplied returns a header with an injected value . This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
published:2025-03-26T10:15:15.093


Instruction: Please provide detailed information about CVE-2025-1440

CVE:CVE-2025-1440
Description:The Advanced iFrame plugin for WordPress is vulnerable to unauthorized excessive creation of options on the aip_map_url_callback() function in all versions up to, and including, 2024.5 due to insufficient restrictions. This makes it possible for unauthenticated attackers to update the advancediFrameParameterData option with an excessive amount of unvalidated data.
published:2025-03-26T10:15:15.260


Instruction: Please provide detailed information about CVE-2025-1703

CVE:CVE-2025-1703
Description:The Ultimate Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘content’ parameter in all versions up to, and including, 3.2.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
published:2025-03-26T10:15:15.437


Instruction: Please provide detailed information about CVE-2025-1542

CVE:CVE-2025-1542
Description:Improper permission control vulnerability in the OXARI ServiceDesk application could allow an attacker using a guest access or an unprivileged account to gain additional administrative permissions in the application.This issue affects OXARI ServiceDesk in versions before 2.0.324.0.
published:2025-03-26T11:15:38.240


Instruction: Please provide detailed information about CVE-2025-27551

CVE:CVE-2025-27551
Description:DBIx::Class::EncodedColumn use the rand() function, which is not cryptographically secure to salt password hashes.  This vulnerability is associated with program files lib/DBIx/Class/EncodedColumn/Digest.pm.  This issue affects DBIx::Class::EncodedColumn until 0.00032.
published:2025-03-26T11:15:38.943


Instruction: Please provide detailed information about CVE-2025-27552

CVE:CVE-2025-27552
Description:DBIx::Class::EncodedColumn use the rand() function, which is not cryptographically secure to salt password hashes.  This vulnerability is associated with program files Crypt/Eksblowfish/Bcrypt.pm.  This issue affects DBIx::Class::EncodedColumn until 0.00032.
published:2025-03-26T11:15:39.063


Instruction: Please provide detailed information about CVE-2025-2596

CVE:CVE-2025-2596
Description:Session logout could be overwritten in Checkmk GmbH's Checkmk versions <2.3.0p30, <2.2.0p41, and 2.1.0p49 (EOL)
published:2025-03-26T11:15:39.183


Instruction: Please provide detailed information about CVE-2025-1312

CVE:CVE-2025-1312
Description:The Ultimate Blocks – WordPress Blocks Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'buttonTextColor’ parameter in all versions up to, and including, 3.2.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
published:2025-03-26T12:15:14.890


Instruction: Please provide detailed information about CVE-2025-1769

CVE:CVE-2025-1769
Description:The Product Import Export for WooCommerce – Import Export Product CSV Suite plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.5.0 via the download_file() function. This makes it possible for authenticated attackers, with Administrator-level access and above, to read the contents of arbitrary log files on the server, which can contain sensitive information.
published:2025-03-26T12:15:15.040


Instruction: Please provide detailed information about CVE-2025-1911

CVE:CVE-2025-1911
Description:The Product Import Export for WooCommerce – Import Export Product CSV Suite plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the admin_log_page() function in all versions up to, and including, 2.5.0. This makes it possible for authenticated attackers, with Administrator-level access and above, to delete arbitrary log files on the server.
published:2025-03-26T12:15:15.197


Instruction: Please provide detailed information about CVE-2025-1912

CVE:CVE-2025-1912
Description:The Product Import Export for WooCommerce – Import Export Product CSV Suite plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.5.0 via the validate_file() Function. This makes it possible for authenticated attackers, with Administrator-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
published:2025-03-26T12:15:15.353


Instruction: Please provide detailed information about CVE-2025-1913

CVE:CVE-2025-1913
Description:The Product Import Export for WooCommerce – Import Export Product CSV Suite plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.5.0 via deserialization of untrusted input from the 'form_data' parameter This makes it possible for authenticated attackers, with Administrator-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present.
published:2025-03-26T12:15:15.513


Instruction: Please provide detailed information about CVE-2025-2110

CVE:CVE-2025-2110
Description:The WP Compress – Instant Performance & Speed Optimization plugin for WordPress is vulnerable to unauthorized access, modification, and loss of data due to missing capability checks on its on its AJAX functions in all versions up to, and including, 6.30.15. This makes it possible for authenticated attackers, with Subscriber-level access and above, to compromise the site in various ways depending on the specific function exploited - for example, by retrieving sensitive settings and configuration details, or by altering and deleting them, thereby disclosing sensitive information, disrupting the plugin’s functionality, and potentially impacting overall site performance.
published:2025-03-26T12:15:15.827


Instruction: Please provide detailed information about CVE-2025-2228

CVE:CVE-2025-2228
Description:The Responsive Addons for Elementor – Free Elementor Addons Plugin and Elementor Templates plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.6.8 the 'register_user' function. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive data including usernames and passwords of any users who register via the Edit Login | Registration Form widget, as long as that user opens the email notification for successful registration.
published:2025-03-26T13:15:36.373


Instruction: Please provide detailed information about CVE-2025-23203

CVE:CVE-2025-23203
Description:Icinga Director is an Icinga config deployment tool. A Security vulnerability has been found starting in version 1.0.0 and prior to 1.10.3 and 1.11.3 on several director endpoints of REST API. To reproduce this vulnerability an authenticated user with permission to access the Director is required (plus api access with regard to the api endpoints). And even though some of these Icinga Director users are restricted from accessing certain objects, are able to retrieve information related to them if their name is known. This makes it possible to change the configuration of these objects by those Icinga Director users restricted from accessing them. This results in further exploitation, data breaches and sensitive information disclosure. Affected endpoints include icingaweb2/director/service, if the host name is left out of the query; icingaweb2/directore/notification; icingaweb2/director/serviceset; and icingaweb2/director/scheduled-downtime. In addition, the endpoint `icingaweb2/director/services?host=filteredHostName` returns a status code 200 even though the services for the host is filtered. This in turn lets the restricted user know that the host `filteredHostName` exists even though the user is restricted from accessing it.  This could again result in further exploitation of this information and data breaches. Icinga Director has patches in versions 1.10.3 and 1.11.1. If upgrading is not feasible, disable the director module for the users other than admin role for the time being.
published:2025-03-26T14:15:32.250


Instruction: Please provide detailed information about CVE-2025-24808

CVE:CVE-2025-24808
Description:Discourse is an open-source discussion platform. Prior to versions `3.3.4` on the `stable` branch and `3.4.0.beta5` on the `beta` branch, someone who is about to reach the limit of users in a group DM may send requests to add new users in parallel. The requests might all go through ignoring the limit due to a race condition. The patch in versions `3.3.4` and `3.4.0.beta5` uses the `lock` step in service to wrap part of the `add_users_to_channel` service inside a distributed lock/mutex in order to avoid the race condition.
published:2025-03-26T14:15:32.417


Instruction: Please provide detailed information about CVE-2025-22283

CVE:CVE-2025-22283
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Riyaz GetSocial allows Reflected XSS. This issue affects GetSocial: from n/a through 2.0.1.
published:2025-03-26T15:15:53.340


Instruction: Please provide detailed information about CVE-2025-23459

CVE:CVE-2025-23459
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound NS Simple Intro Loader allows Reflected XSS. This issue affects NS Simple Intro Loader: from n/a through 2.2.3.
published:2025-03-26T15:15:53.600


Instruction: Please provide detailed information about CVE-2025-23460

CVE:CVE-2025-23460
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound RWS Enquiry And Lead Follow-up allows Reflected XSS. This issue affects RWS Enquiry And Lead Follow-up: from n/a through 1.0.
published:2025-03-26T15:15:53.830


Instruction: Please provide detailed information about CVE-2025-23466

CVE:CVE-2025-23466
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpsiteeditor Site Editor Google Map allows Reflected XSS. This issue affects Site Editor Google Map: from n/a through 1.0.1.
published:2025-03-26T15:15:54.100


Instruction: Please provide detailed information about CVE-2025-23542

CVE:CVE-2025-23542
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Robert D Payne RDP Linkedin Login allows Reflected XSS. This issue affects RDP Linkedin Login: from n/a through 1.7.0.
published:2025-03-26T15:15:55.610


Instruction: Please provide detailed information about CVE-2025-23543

CVE:CVE-2025-23543
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound FOMO Pay Chinese Payment Solution allows Reflected XSS. This issue affects FOMO Pay Chinese Payment Solution: from n/a through 2.0.4.
published:2025-03-26T15:15:57.723


Instruction: Please provide detailed information about CVE-2025-23546

CVE:CVE-2025-23546
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound RDP inGroups+ allows Reflected XSS. This issue affects RDP inGroups+: from n/a through 1.0.6.
published:2025-03-26T15:15:57.993


Instruction: Please provide detailed information about CVE-2025-23612

CVE:CVE-2025-23612
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound Pixobe Cartography allows Reflected XSS. This issue affects Pixobe Cartography: from n/a through 1.0.1.
published:2025-03-26T15:15:58.283


Instruction: Please provide detailed information about CVE-2025-23632

CVE:CVE-2025-23632
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rhizome Networks CG Button allows Reflected XSS. This issue affects CG Button: from n/a through 1.0.5.6.
published:2025-03-26T15:15:58.530


Instruction: Please provide detailed information about CVE-2025-23633

CVE:CVE-2025-23633
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound WP Database Audit allows Reflected XSS. This issue affects WP Database Audit: from n/a through 1.0.
published:2025-03-26T15:15:58.753


Instruction: Please provide detailed information about CVE-2025-23638

CVE:CVE-2025-23638
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound Frontend Post Submission allows Reflected XSS. This issue affects Frontend Post Submission: from n/a through 1.0.
published:2025-03-26T15:15:58.940


Instruction: Please provide detailed information about CVE-2025-23666

CVE:CVE-2025-23666
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound Management-screen-droptiles allows Reflected XSS. This issue affects Management-screen-droptiles: from n/a through 1.0.
published:2025-03-26T15:16:00.870


Instruction: Please provide detailed information about CVE-2025-23680

CVE:CVE-2025-23680
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound Narnoo Operator allows Reflected XSS. This issue affects Narnoo Operator: from n/a through 2.0.0.
published:2025-03-26T15:16:02.850


Instruction: Please provide detailed information about CVE-2025-23704

CVE:CVE-2025-23704
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Reuven Karasik Your Lightbox allows Reflected XSS. This issue affects Your Lightbox: from n/a through 1.0.
published:2025-03-26T15:16:03.380


Instruction: Please provide detailed information about CVE-2025-23714

CVE:CVE-2025-23714
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound AppReview allows Reflected XSS. This issue affects AppReview: from n/a through 0.2.9.
published:2025-03-26T15:16:03.907


Instruction: Please provide detailed information about CVE-2025-23728

CVE:CVE-2025-23728
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound AuMenu allows Reflected XSS. This issue affects AuMenu: from n/a through 1.1.5.
published:2025-03-26T15:16:04.433


Instruction: Please provide detailed information about CVE-2025-23735

CVE:CVE-2025-23735
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cosmin Schiopu Infugrator allows Reflected XSS. This issue affects Infugrator: from n/a through 1.0.3.
published:2025-03-26T15:16:06.437


Instruction: Please provide detailed information about CVE-2025-23937

CVE:CVE-2025-23937
Description:Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in NotFound LinkedIn Lite allows PHP Local File Inclusion. This issue affects LinkedIn Lite: from n/a through 1.0.
published:2025-03-26T15:16:06.673


Instruction: Please provide detailed information about CVE-2025-23952

CVE:CVE-2025-23952
Description:Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ntm custom-field-list-widget allows PHP Local File Inclusion. This issue affects custom-field-list-widget: from n/a through 1.5.1.
published:2025-03-26T15:16:06.913


Instruction: Please provide detailed information about CVE-2025-23964

CVE:CVE-2025-23964
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound Google Plus allows Reflected XSS. This issue affects Google Plus: from n/a through 1.0.2.
published:2025-03-26T15:16:07.173


Instruction: Please provide detailed information about CVE-2025-24690

CVE:CVE-2025-24690
Description:Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Michele Giorgi Formality allows PHP Local File Inclusion. This issue affects Formality: from n/a through 1.5.7.
published:2025-03-26T15:16:07.407


Instruction: Please provide detailed information about CVE-2025-24972

CVE:CVE-2025-24972
Description:Discourse is an open-source discussion platform. Prior to versions `3.3.4` on the `stable` branch and `3.4.0.beta5` on the `beta` branch, in specific circumstances, users could be added to group direct messages despite disabling direct messaging in their preferences. Versions `3.3.4` and `3.4.0.beta5` contain a patch for the issue. A workaround is available. If a user disables chat in their preferences then they cannot be added to new group chats.
published:2025-03-26T15:16:07.920


Instruction: Please provide detailed information about CVE-2025-25134

CVE:CVE-2025-25134
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound Theme Demo Bar allows Reflected XSS. This issue affects Theme Demo Bar: from n/a through 1.6.3.
published:2025-03-26T15:16:08.190


Instruction: Please provide detailed information about CVE-2025-26536

CVE:CVE-2025-26536
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Yendif Player Another Events Calendar allows Reflected XSS. This issue affects Another Events Calendar: from n/a through 1.7.0.
published:2025-03-26T15:16:08.890


Instruction: Please provide detailed information about CVE-2025-26537

CVE:CVE-2025-26537
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound GDPR Tools allows Stored XSS. This issue affects GDPR Tools: from n/a through 1.0.2.
published:2025-03-26T15:16:09.130


Instruction: Please provide detailed information about CVE-2025-26541

CVE:CVE-2025-26541
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodeSolz Bitcoin / AltCoin Payment Gateway for WooCommerce allows Reflected XSS. This issue affects Bitcoin / AltCoin Payment Gateway for WooCommerce: from n/a through 1.7.6.
published:2025-03-26T15:16:09.357


Instruction: Please provide detailed information about CVE-2025-26542

CVE:CVE-2025-26542
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound Zalo Live Chat allows Reflected XSS. This issue affects Zalo Live Chat: from n/a through 1.1.0.
published:2025-03-26T15:16:09.613


Instruction: Please provide detailed information about CVE-2025-26544

CVE:CVE-2025-26544
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound UTM tags tracking for Contact Form 7 allows Reflected XSS. This issue affects UTM tags tracking for Contact Form 7: from n/a through 2.1.
published:2025-03-26T15:16:09.850


Instruction: Please provide detailed information about CVE-2025-26546

CVE:CVE-2025-26546
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound Cookies Pro allows Reflected XSS. This issue affects Cookies Pro: from n/a through 1.0.
published:2025-03-26T15:16:10.050


Instruction: Please provide detailed information about CVE-2025-26559

CVE:CVE-2025-26559
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound Secure Invites allows Reflected XSS. This issue affects Secure Invites: from n/a through 1.3.
published:2025-03-26T15:16:10.203


Instruction: Please provide detailed information about CVE-2025-26560

CVE:CVE-2025-26560
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound WP Contact Form III allows Reflected XSS. This issue affects WP Contact Form III: from n/a through 1.6.2d.
published:2025-03-26T15:16:10.363


Instruction: Please provide detailed information about CVE-2025-26564

CVE:CVE-2025-26564
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in kagla GNUCommerce allows Reflected XSS. This issue affects GNUCommerce: from n/a through 1.5.4.
published:2025-03-26T15:16:10.533


Instruction: Please provide detailed information about CVE-2025-26565

CVE:CVE-2025-26565
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in kagla GNUPress allows Reflected XSS. This issue affects GNUPress: from n/a through 0.2.9.
published:2025-03-26T15:16:10.687


Instruction: Please provide detailed information about CVE-2025-26566

CVE:CVE-2025-26566
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound In Stock Mailer for WooCommerce allows Reflected XSS. This issue affects In Stock Mailer for WooCommerce: from n/a through 2.1.1.
published:2025-03-26T15:16:10.863


Instruction: Please provide detailed information about CVE-2025-26573

CVE:CVE-2025-26573
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound Rizzi Guestbook allows Reflected XSS. This issue affects Rizzi Guestbook: from n/a through 4.0.1.
published:2025-03-26T15:16:11.040


Instruction: Please provide detailed information about CVE-2025-26575

CVE:CVE-2025-26575
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kyle Maurer Display Post Meta allows Reflected XSS. This issue affects Display Post Meta: from n/a through 2.4.4.
published:2025-03-26T15:16:11.203


Instruction: Please provide detailed information about CVE-2025-26576

CVE:CVE-2025-26576
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in takumin WP Simple Slideshow allows Reflected XSS. This issue affects WP Simple Slideshow: from n/a through 1.0.
published:2025-03-26T15:16:11.363


Instruction: Please provide detailed information about CVE-2025-26579

CVE:CVE-2025-26579
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in videowhisper MicroPayments allows Reflected XSS. This issue affects MicroPayments: from n/a through 3.1.6.
published:2025-03-26T15:16:11.557


Instruction: Please provide detailed information about CVE-2025-26581

CVE:CVE-2025-26581
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in videowhisper Picture Gallery allows Reflected XSS. This issue affects Picture Gallery: from n/a through 1.6.2.
published:2025-03-26T15:16:11.720


Instruction: Please provide detailed information about CVE-2025-26583

CVE:CVE-2025-26583
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in videowhisper Video Share VOD allows Reflected XSS. This issue affects Video Share VOD: from n/a through 2.7.2.
published:2025-03-26T15:16:11.903


Instruction: Please provide detailed information about CVE-2025-26584

CVE:CVE-2025-26584
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound TBTestimonials allows Reflected XSS. This issue affects TBTestimonials: from n/a through 1.7.3.
published:2025-03-26T15:16:12.063


Instruction: Please provide detailed information about CVE-2025-26739

CVE:CVE-2025-26739
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themefunction newseqo allows Stored XSS.This issue affects newseqo: from n/a through 2.1.1.
published:2025-03-26T15:16:12.233


Instruction: Please provide detailed information about CVE-2025-26747

CVE:CVE-2025-26747
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 99colorthemes RainbowNews allows Stored XSS.This issue affects RainbowNews: from n/a through 1.0.7.
published:2025-03-26T15:16:12.390


Instruction: Please provide detailed information about CVE-2025-26869

CVE:CVE-2025-26869
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Build allows Stored XSS.This issue affects Build: from n/a through 1.0.3.
published:2025-03-26T15:16:12.553


Instruction: Please provide detailed information about CVE-2025-26922

CVE:CVE-2025-26922
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in techthemes AuraMart allows Stored XSS.This issue affects AuraMart: from n/a through 2.0.7.
published:2025-03-26T15:16:12.713


Instruction: Please provide detailed information about CVE-2025-26923

CVE:CVE-2025-26923
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bastien Ho Event post allows Stored XSS.This issue affects Event post: from n/a through 5.9.8.
published:2025-03-26T15:16:12.877


Instruction: Please provide detailed information about CVE-2025-26929

CVE:CVE-2025-26929
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NOUS Ouvert Utile et Simple Accounting for WooCommerce allows Stored XSS.This issue affects Accounting for WooCommerce: from n/a through 1.6.8.
published:2025-03-26T15:16:13.043


Instruction: Please provide detailed information about CVE-2025-26941

CVE:CVE-2025-26941
Description:Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Andy Moyle Church Admin allows SQL Injection.This issue affects Church Admin: from n/a through 5.0.18.
published:2025-03-26T15:16:13.210


Instruction: Please provide detailed information about CVE-2025-26986

CVE:CVE-2025-26986
Description:Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in StylemixThemes Pearl - Corporate Business allows PHP Local File Inclusion.This issue affects Pearl - Corporate Business: from n/a before 3.4.8.
published:2025-03-26T15:16:13.373


Instruction: Please provide detailed information about CVE-2025-27014

CVE:CVE-2025-27014
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in designingmedia Hostiko allows Reflected XSS.This issue affects Hostiko: from n/a before 30.1.
published:2025-03-26T15:16:13.527


Instruction: Please provide detailed information about CVE-2025-27015

CVE:CVE-2025-27015
Description:Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in designingmedia Hostiko allows PHP Local File Inclusion.This issue affects Hostiko: from n/a before 30.1.
published:2025-03-26T15:16:13.683


Instruction: Please provide detailed information about CVE-2025-27267

CVE:CVE-2025-27267
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in srcoley Random Quotes allows Reflected XSS. This issue affects Random Quotes: from n/a through 1.3.
published:2025-03-26T15:16:13.850


Instruction: Please provide detailed information about CVE-2025-27404

CVE:CVE-2025-27404
Description:Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. A vulnerability in versions prior to 2.11.5 and 2.12.13 allows an attacker to craft a URL that, once visited by any user, allows to embed arbitrary Javascript into Icinga Web and to act on behalf of that user. This issue has been resolved in versions 2.11.5 and 2.12.3 of Icinga Web 2. As a workaround, those who have Icinga Web 2.12.2 may enable a content security policy in the application settings.
published:2025-03-26T15:16:14.000


Instruction: Please provide detailed information about CVE-2025-28855

CVE:CVE-2025-28855
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound Teleport allows Reflected XSS. This issue affects Teleport: from n/a through 1.2.4.
published:2025-03-26T15:16:14.167


Instruction: Please provide detailed information about CVE-2025-28858

CVE:CVE-2025-28858
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Arrow Plugins Arrow Maps allows Reflected XSS. This issue affects Arrow Maps: from n/a through 1.0.9.
published:2025-03-26T15:16:14.317


Instruction: Please provide detailed information about CVE-2025-28865

CVE:CVE-2025-28865
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in lionelroux WP Colorful Tag Cloud allows Reflected XSS. This issue affects WP Colorful Tag Cloud: from n/a through 2.0.1.
published:2025-03-26T15:16:14.460


Instruction: Please provide detailed information about CVE-2025-28869

CVE:CVE-2025-28869
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound NextGEN Gallery Voting allows Reflected XSS. This issue affects NextGEN Gallery Voting: from n/a through 2.7.6.
published:2025-03-26T15:16:14.617


Instruction: Please provide detailed information about CVE-2025-28873

CVE:CVE-2025-28873
Description:Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in NotFound Shuffle allows Blind SQL Injection. This issue affects Shuffle: from n/a through 0.5.
published:2025-03-26T15:16:14.767


Instruction: Please provide detailed information about CVE-2025-28877

CVE:CVE-2025-28877
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound Key4ce osTicket Bridge allows Reflected XSS. This issue affects Key4ce osTicket Bridge: from n/a through 1.4.0.
published:2025-03-26T15:16:14.917


Instruction: Please provide detailed information about CVE-2025-28880

CVE:CVE-2025-28880
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound Blue Captcha allows Reflected XSS. This issue affects Blue Captcha: from n/a through 1.7.4.
published:2025-03-26T15:16:15.070


Instruction: Please provide detailed information about CVE-2025-28882

CVE:CVE-2025-28882
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Omnify, Inc. Omnify allows Reflected XSS. This issue affects Omnify: from n/a through 2.0.3.
published:2025-03-26T15:16:15.227


Instruction: Please provide detailed information about CVE-2025-28885

CVE:CVE-2025-28885
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound Fiverr.com Official Search Box allows Stored XSS. This issue affects Fiverr.com Official Search Box: from n/a through 1.0.8.
published:2025-03-26T15:16:15.380


Instruction: Please provide detailed information about CVE-2025-28889

CVE:CVE-2025-28889
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound Custom Product Stickers for Woocommerce allows Reflected XSS. This issue affects Custom Product Stickers for Woocommerce: from n/a through 1.9.0.
published:2025-03-26T15:16:15.543


Instruction: Please provide detailed information about CVE-2025-28890

CVE:CVE-2025-28890
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound Lightview Plus allows Reflected XSS. This issue affects Lightview Plus: from n/a through 3.1.3.
published:2025-03-26T15:16:15.700


Instruction: Please provide detailed information about CVE-2025-28893

CVE:CVE-2025-28893
Description:Improper Control of Generation of Code ('Code Injection') vulnerability in NotFound Visual Text Editor allows Remote Code Inclusion. This issue affects Visual Text Editor: from n/a through 1.2.1.
published:2025-03-26T15:16:15.873


Instruction: Please provide detailed information about CVE-2025-28898

CVE:CVE-2025-28898
Description:Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in NotFound WP Multistore Locator allows SQL Injection. This issue affects WP Multistore Locator: from n/a through 2.5.2.
published:2025-03-26T15:16:16.030


Instruction: Please provide detailed information about CVE-2025-28899

CVE:CVE-2025-28899
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound WP Event Ticketing allows Reflected XSS. This issue affects WP Event Ticketing: from n/a through 1.3.4.
published:2025-03-26T15:16:16.190


Instruction: Please provide detailed information about CVE-2025-28903

CVE:CVE-2025-28903
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound Driving Directions allows Reflected XSS. This issue affects Driving Directions: from n/a through 1.4.4.
published:2025-03-26T15:16:16.340


Instruction: Please provide detailed information about CVE-2025-28911

CVE:CVE-2025-28911
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in gravity2pdf Gravity 2 PDF allows Reflected XSS. This issue affects Gravity 2 PDF: from n/a through 3.1.3.
published:2025-03-26T15:16:16.493


Instruction: Please provide detailed information about CVE-2025-28916

CVE:CVE-2025-28916
Description:Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in NotFound Docpro allows PHP Local File Inclusion. This issue affects Docpro: from n/a through 2.0.1.
published:2025-03-26T15:16:16.653


Instruction: Please provide detailed information about CVE-2025-28917

CVE:CVE-2025-28917
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound Custom Smilies allows Stored XSS. This issue affects Custom Smilies: from n/a through 2.9.2.
published:2025-03-26T15:16:16.803


Instruction: Please provide detailed information about CVE-2025-28921

CVE:CVE-2025-28921
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound SpatialMatch IDX allows Reflected XSS. This issue affects SpatialMatch IDX: from n/a through 3.0.9.
published:2025-03-26T15:16:16.943


Instruction: Please provide detailed information about CVE-2025-28924

CVE:CVE-2025-28924
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound ZenphotoPress allows Reflected XSS. This issue affects ZenphotoPress: from n/a through 1.8.
published:2025-03-26T15:16:17.100


Instruction: Please provide detailed information about CVE-2025-28928

CVE:CVE-2025-28928
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sureshdsk Are you robot google recaptcha for wordpress allows Reflected XSS. This issue affects Are you robot google recaptcha for wordpress: from n/a through 2.2.
published:2025-03-26T15:16:17.307


Instruction: Please provide detailed information about CVE-2025-28934

CVE:CVE-2025-28934
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound Simple Post Series allows Reflected XSS. This issue affects Simple Post Series: from n/a through 2.4.4.
published:2025-03-26T15:16:17.517


Instruction: Please provide detailed information about CVE-2025-28935

CVE:CVE-2025-28935
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in puzich Fancybox Plus allows Reflected XSS. This issue affects Fancybox Plus: from n/a through 1.0.1.
published:2025-03-26T15:16:17.727


Instruction: Please provide detailed information about CVE-2025-28939

CVE:CVE-2025-28939
Description:Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in NotFound WP Google Calendar Manager allows Blind SQL Injection. This issue affects WP Google Calendar Manager: from n/a through 2.1.
published:2025-03-26T15:16:17.923


Instruction: Please provide detailed information about CVE-2025-28942

CVE:CVE-2025-28942
Description:Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Trust Payments Trust Payments Gateway for WooCommerce allows SQL Injection. This issue affects Trust Payments Gateway for WooCommerce: from n/a through 1.1.4.
published:2025-03-26T15:16:18.107


Instruction: Please provide detailed information about CVE-2025-2819

CVE:CVE-2025-2819
Description:There is a risk of unauthorized file uploads in GT-SoftControl and potential file overwrites due to insufficient validation in the file selection process. This could lead to data integrity issues and unauthorized access by an authenticated privileged user.
published:2025-03-26T15:16:21.970


Instruction: Please provide detailed information about CVE-2025-2820

CVE:CVE-2025-2820
Description:An authenticated attacker can compromise the availability of the device via the network
published:2025-03-26T15:16:22.167


Instruction: Please provide detailed information about CVE-2025-30524

CVE:CVE-2025-30524
Description:Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in origincode Product Catalog allows SQL Injection. This issue affects Product Catalog: from n/a through 1.0.4.
published:2025-03-26T15:16:22.580


Instruction: Please provide detailed information about CVE-2025-27405

CVE:CVE-2025-27405
Description:Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. A vulnerability in versions prior to 2.11.5 and 2.12.13 allows an attacker to craft a URL that, once visited by any user, allows to embed arbitrary Javascript into Icinga Web and to act on behalf of that user. This issue has been resolved in versions 2.11.5 and 2.12.3 of Icinga Web 2. As a workaround, those who have Icinga Web 2.12.2 may enable a content security policy in the application settings.
published:2025-03-26T16:15:22.983