Instruction: Please provide detailed information about CVE-2025-29927

CVE:CVE-2025-29927
Description:Next.js is a React framework for building full-stack web applications. Starting in version 1.11.4 and prior to versions 12.3.5, 13.5.9, 14.2.25, and 15.2.3, it is possible to bypass authorization checks within a Next.js application, if the authorization check occurs in middleware. If patching to a safe version is infeasible, it is recommend that you prevent external user requests which contain the x-middleware-subrequest header from reaching your Next.js application. This vulnerability is fixed in 12.3.5, 13.5.9, 14.2.25, and 15.2.3.
published:2025-03-21T15:15:42.660


Instruction: Please provide detailed information about CVE-2025-2593

CVE:CVE-2025-2593
Description:A vulnerability has been found in FastCMS up to 0.1.5 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /api/client/article/list. The manipulation of the argument orderBy leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
published:2025-03-21T15:15:42.943


Instruction: Please provide detailed information about CVE-2025-2598

CVE:CVE-2025-2598
Description:When the AWS Cloud Development Kit (AWS CDK) Command Line Interface (AWS CDK CLI) is used with a credential plugin which returns an expiration property with the retrieved AWS credentials, the credentials are printed to the console output. To mitigate this issue, users should upgrade to version 2.178.2 or later and ensure any forked or derivative code is patched to incorporate the new fixes.
published:2025-03-21T15:15:43.120


Instruction: Please provide detailed information about CVE-2025-30157

CVE:CVE-2025-30157
Description:Envoy is a cloud-native high-performance edge/middle/service proxy. Prior to 1.33.1, 1.32.4, 1.31.6, and 1.30.10, Envoy's ext_proc HTTP filter is at risk of crashing if a local reply is sent to the external server due to the filter's life time issue. A known situation is the failure of a websocket handshake will trigger a local reply leading to the crash of Envoy. This vulnerability is fixed in 1.33.1, 1.32.4, 1.31.6, and 1.30.10.
published:2025-03-21T15:15:43.290


Instruction: Please provide detailed information about CVE-2025-30168

CVE:CVE-2025-30168
Description:Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 7.5.2 and 8.0.2, the 3rd party authentication handling of Parse Server allows the authentication credentials of some specific authentication providers to be used across multiple Parse Server apps. For example, if a user signed up using the same authentication provider in two unrelated Parse Server apps, the credentials stored by one app can be used to authenticate the same user in the other app. Note that this only affects Parse Server apps that specifically use an affected 3rd party authentication provider for user authentication, for example by setting the Parse Server option auth to configure a Parse Server authentication adapter. The fix of this vulnerability requires to upgrade Parse Server to a version that includes the bug fix, as well as upgrade the client app to send a secure payload, which is different from the previous insecure payload. This vulnerability is fixed in 7.5.2 and 8.0.2.
published:2025-03-21T15:15:43.440


Instruction: Please provide detailed information about CVE-2025-29223

CVE:CVE-2025-29223
Description:Linksys E5600 v1.1.0.26 was discovered to contain a command injection vulnerability via the pt parameter in the traceRoute function.
published:2025-03-21T17:15:39.450


Instruction: Please provide detailed information about CVE-2025-29226

CVE:CVE-2025-29226
Description:In Linksys E5600 V1.1.0.26, the \usr\share\lua\runtime.lua file contains a command injection vulnerability in the runtime.pingTest function via the pt["count"] parameter.
published:2025-03-21T17:15:39.583


Instruction: Please provide detailed information about CVE-2025-29227

CVE:CVE-2025-29227
Description:In Linksys E5600 V1.1.0.26, the \usr\share\lua\runtime.lua file contains a command injection vulnerability in the runtime.pingTest function via the pt["pkgsize"] parameter.
published:2025-03-21T17:15:39.777


Instruction: Please provide detailed information about CVE-2025-29230

CVE:CVE-2025-29230
Description:Linksys E5600 v1.1.0.26 was discovered to contain a command injection vulnerability in the runtime.emailReg function. The vulnerability can be triggered via the `pt["email"]` parameter.
published:2025-03-21T17:15:39.897


Instruction: Please provide detailed information about CVE-2025-30349

CVE:CVE-2025-30349
Description:Horde IMP through 6.2.27, as used with Horde Application Framework through 5.2.23, allows XSS that leads to account takeover via a crafted text/html e-mail message with an onerror attribute (that may use base64-encoded JavaScript code), as exploited in the wild in March 2025.
published:2025-03-21T17:15:40.853


Instruction: Please provide detailed information about CVE-2025-25035

CVE:CVE-2025-25035
Description:Improper Neutralization of Input During Web Page Generation Cross-site Scripting vulnerability in Jalios JPlatform 10 allows for Reflected XSS and Stored XSS.This issue affects JPlatform 10: before 10.0.8 (SP8), before 10.0.7 (SP7), before 10.0.6 (SP6) and Jalios Workplace 6.2, Jalios Workplace 6.1, Jalios Workplace 6.0, and Jalios Workplace 5.3 to 5.5
published:2025-03-21T19:15:45.437


Instruction: Please provide detailed information about CVE-2025-25036

CVE:CVE-2025-25036
Description:Improper Restriction of XML External Entity Reference vulnerability in Jalios JPlatform allows XML Injection.This issue affects all versions of JPlatform 10 before 10.0.8 (SP8).
published:2025-03-21T20:15:15.293


Instruction: Please provide detailed information about CVE-2025-2601

CVE:CVE-2025-2601
Description:A vulnerability, which was classified as critical, was found in SourceCodester Kortex Lite Advocate Office Management System 1.0. This affects an unknown part of the file activate_reg.php. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
published:2025-03-21T20:15:15.683


Instruction: Please provide detailed information about CVE-2025-2602

CVE:CVE-2025-2602
Description:A vulnerability has been found in SourceCodester Kortex Lite Advocate Office Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file deactivate_reg.php. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
published:2025-03-21T20:15:15.863


Instruction: Please provide detailed information about CVE-2025-2603

CVE:CVE-2025-2603
Description:A vulnerability was found in SourceCodester Kortex Lite Advocate Office Management System 1.0 and classified as critical. This issue affects some unknown processing of the file deactivate.php. The manipulation of the argument ID leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
published:2025-03-21T20:15:16.033


Instruction: Please provide detailed information about CVE-2025-2604

CVE:CVE-2025-2604
Description:A vulnerability was found in SourceCodester Kortex Lite Advocate Office Management System 1.0. It has been classified as critical. Affected is an unknown function of the file edit_act.php. The manipulation of the argument ID leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
published:2025-03-21T21:15:37.087


Instruction: Please provide detailed information about CVE-2025-2606

CVE:CVE-2025-2606
Description:A vulnerability was found in SourceCodester Best Church Management Software 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /admin/app/soulwinning_crud.php. The manipulation of the argument photo/photo1 leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
published:2025-03-21T21:15:37.260


Instruction: Please provide detailed information about CVE-2025-2607

CVE:CVE-2025-2607
Description:A vulnerability was found in phplaozhang LzCMS-LaoZhangBoKeXiTong up to 1.1.4. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin/upload/upimage.html of the component HTTP POST Request Handler. The manipulation of the argument File leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
published:2025-03-21T21:15:37.430


Instruction: Please provide detailed information about CVE-2025-2608

CVE:CVE-2025-2608
Description:A vulnerability classified as critical has been found in PHPGurukul Banquet Booking System 1.2. This affects an unknown part of the file /admin/view-user-queries.php. The manipulation of the argument viewid leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
published:2025-03-21T22:15:26.250


Instruction: Please provide detailed information about CVE-2025-30204

CVE:CVE-2025-30204
Description:golang-jwt is a Go implementation of JSON Web Tokens. Prior to  5.2.2 and 4.5.2, the function parse.ParseUnverified splits (via a call to strings.Split) its argument (which is untrusted data) on periods. As a result, in the face of a malicious request whose Authorization header consists of Bearer  followed by many period characters, a call to that function incurs allocations to the tune of O(n) bytes (where n stands for the length of the function's argument), with a constant factor of about 16. This issue is fixed in 5.2.2 and 4.5.2.
published:2025-03-21T22:15:26.420


Instruction: Please provide detailed information about CVE-2025-26500

CVE:CVE-2025-26500
Description:: Uncontrolled Resource Consumption vulnerability in Wind River Systems VxWorks 7 on VxWorks allows Excessive Allocation.    Specifically crafted USB packets may lead to the system becoming unavailable  This issue affects VxWorks 7: from 22.06 through 24.03.
published:2025-03-21T23:15:21.327


Instruction: Please provide detailed information about CVE-2025-2609

CVE:CVE-2025-2609
Description:Improper neutralization of input during web page generation vulnerability in MagnusSolution MagnusBilling login logging allows unauthenticated users to store HTML content in the viewable log component accessible at /mbilling/index.php/logUsers/read" cross-site scripting This vulnerability is associated with program files protected/components/MagnusLog.Php.  This issue affects MagnusBilling: through 7.3.0.
published:2025-03-21T23:15:21.493


Instruction: Please provide detailed information about CVE-2025-2610

CVE:CVE-2025-2610
Description:Improper neutralization of input during web page generation vulnerability in MagnusSolution MagnusBilling (Alarm Module modules) allows authenticated stored cross-site scripting. This vulnerability is associated with program files protected/components/MagnusLog.Php.  This issue affects MagnusBilling: through 7.3.0.
published:2025-03-21T23:15:21.613


Instruction: Please provide detailed information about CVE-2025-30472

CVE:CVE-2025-30472
Description:Corosync through 3.1.9, if encryption is disabled or the attacker knows the encryption key, has a stack-based buffer overflow in orf_token_endian_convert in exec/totemsrp.c via a large UDP packet.
published:2025-03-22T02:15:16.620


Instruction: Please provide detailed information about CVE-2025-0723

CVE:CVE-2025-0723
Description:The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to blind and time-based SQL Injections via the rid and search parameters in all versions up to, and including, 5.9.4.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
published:2025-03-22T05:15:38.053


Instruction: Please provide detailed information about CVE-2025-0724

CVE:CVE-2025-0724
Description:The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 5.9.4.5 via deserialization of untrusted input in the get_user_meta_fields_html function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present.
published:2025-03-22T05:15:38.200


Instruction: Please provide detailed information about CVE-2025-1408

CVE:CVE-2025-1408
Description:The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the pm_decline_join_group_request and pm_approve_join_group_request functions in all versions up to, and including, 5.9.4.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to approve or decline join group requests which is normally should be available to administrators only.
published:2025-03-22T05:15:38.353


Instruction: Please provide detailed information about CVE-2025-0807

CVE:CVE-2025-0807
Description:The CITS Support svg, webp Media and TTF,OTF File Upload, Use Custom Fonts plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.2. This is due to missing or incorrect nonce validation on the cits_settings_tab() function. This makes it possible for unauthenticated attackers to update the plugin's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
published:2025-03-22T07:15:24.260


Instruction: Please provide detailed information about CVE-2025-1311

CVE:CVE-2025-1311
Description:The WooCommerce Multivendor Marketplace – REST API plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter in the update_delivery_status() function in all versions up to, and including, 1.6.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
published:2025-03-22T07:15:24.433


Instruction: Please provide detailed information about CVE-2025-2303

CVE:CVE-2025-2303
Description:The Block Logic – Full Gutenberg Block Display Control plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.0.8 via the block_logic_check_logic function. This is due to the unsafe evaluation of user-controlled input. This makes it possible for authenticated attackers, with Contributor-level access and above, to execute code on the server.
published:2025-03-22T07:15:24.613


Instruction: Please provide detailed information about CVE-2025-2477

CVE:CVE-2025-2477
Description:The CryoKey plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘ckemail’ parameter in all versions up to, and including, 2.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
published:2025-03-22T07:15:24.780


Instruction: Please provide detailed information about CVE-2025-2478

CVE:CVE-2025-2478
Description:The Code Clone plugin for WordPress is vulnerable to time-based SQL Injection via the ‘snippetId’ parameter in all versions up to, and including, 0.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
published:2025-03-22T07:15:24.963


Instruction: Please provide detailed information about CVE-2025-2479

CVE:CVE-2025-2479
Description:The Easy Custom Admin Bar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘msg’ parameter in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
published:2025-03-22T07:15:25.123


Instruction: Please provide detailed information about CVE-2025-2482

CVE:CVE-2025-2482
Description:The Gotcha | Gesture-based Captcha plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'menu' parameter in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
published:2025-03-22T07:15:25.307


Instruction: Please provide detailed information about CVE-2025-2484

CVE:CVE-2025-2484
Description:The Multi Video Box plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'video_id' and 'group_id' parameters in all versions up to, and including, 1.5.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
published:2025-03-22T07:15:25.470


Instruction: Please provide detailed information about CVE-2025-2616

CVE:CVE-2025-2616
Description:A vulnerability classified as problematic has been found in yangyouwang 杨有旺 crud 简约后台管理系统 1.0.0. Affected is an unknown function of the component Role Management Page. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
published:2025-03-22T10:15:16.533


Instruction: Please provide detailed information about CVE-2025-1970

CVE:CVE-2025-1970
Description:The Export and Import Users and Customers plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.6.2 via the validate_file() function. This makes it possible for authenticated attackers, with Administrator-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
published:2025-03-22T12:15:25.797


Instruction: Please provide detailed information about CVE-2025-1971

CVE:CVE-2025-1971
Description:The Export and Import Users and Customers plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.6.2 via deserialization of untrusted input from the 'form_data' parameter. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present.
published:2025-03-22T12:15:26.250


Instruction: Please provide detailed information about CVE-2025-1972

CVE:CVE-2025-1972
Description:The Export and Import Users and Customers plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the admin_log_page() function in all versions up to, and including, 2.6.2. This makes it possible for authenticated attackers, with Administrator-level access and above, to delete arbitrary log files on the server.
published:2025-03-22T12:15:26.453


Instruction: Please provide detailed information about CVE-2025-1973

CVE:CVE-2025-1973
Description:The Export and Import Users and Customers plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 2.6.2 via the download_file() function. This makes it possible for authenticated attackers, with Administrator-level access and above, to read the contents of arbitrary log files on the server, which can contain sensitive information.
published:2025-03-22T12:15:26.653


Instruction: Please provide detailed information about CVE-2025-2331

CVE:CVE-2025-2331
Description:The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.22.1 via a misconfigured capability check in the 'permissionsCheck' function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to extract sensitive data including reports detailing donors and donation amounts.
published:2025-03-22T12:15:26.833


Instruction: Please provide detailed information about CVE-2025-2577

CVE:CVE-2025-2577
Description:The Bitspecter Suite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
published:2025-03-22T12:15:27.013


Instruction: Please provide detailed information about CVE-2025-26796

CVE:CVE-2025-26796
Description:** UNSUPPORTED WHEN ASSIGNED ** Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Oozie.  This issue affects Apache Oozie: all versions.  As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users.  NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
published:2025-03-22T13:15:35.513


Instruction: Please provide detailed information about CVE-2025-2186

CVE:CVE-2025-2186
Description:The Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit plugin for WordPress is vulnerable to SQL Injection via the ‘automationId’ parameter in all versions up to, and including, 3.5.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
published:2025-03-22T13:15:35.683


Instruction: Please provide detailed information about CVE-2025-2617

CVE:CVE-2025-2617
Description:A vulnerability classified as problematic was found in yangyouwang 杨有旺 crud 简约后台管理系统 1.0.0. Affected by this vulnerability is an unknown functionality of the component Department Page. The manipulation leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
published:2025-03-22T13:15:35.837


Instruction: Please provide detailed information about CVE-2025-2618

CVE:CVE-2025-2618
Description:A vulnerability, which was classified as critical, has been found in D-Link DAP-1620 1.03. Affected by this issue is the function set_ws_action of the file /dws/api/ of the component Path Handler. The manipulation leads to heap-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
published:2025-03-22T14:15:16.650


Instruction: Please provide detailed information about CVE-2025-2619

CVE:CVE-2025-2619
Description:A vulnerability, which was classified as critical, was found in D-Link DAP-1620 1.03. This affects the function check_dws_cookie of the file /storage of the component Cookie Handler. The manipulation leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
published:2025-03-22T14:15:16.867


Instruction: Please provide detailed information about CVE-2025-2620

CVE:CVE-2025-2620
Description:A vulnerability has been found in D-Link DAP-1620 1.03 and classified as critical. This vulnerability affects the function mod_graph_auth_uri_handler of the file /storage of the component Authentication Handler. The manipulation leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
published:2025-03-22T15:15:38.860


Instruction: Please provide detailed information about CVE-2025-2621

CVE:CVE-2025-2621
Description:A vulnerability was found in D-Link DAP-1620 1.03 and classified as critical. This issue affects the function check_dws_cookie of the file /storage. The manipulation of the argument uid leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
published:2025-03-22T17:15:34.790


Instruction: Please provide detailed information about CVE-2025-2622

CVE:CVE-2025-2622
Description:A vulnerability was found in aizuda snail-job 1.4.0. It has been classified as critical. Affected is the function getRuntime of the file /snail-job/workflow/check-node-expression of the component Workflow-Task Management Module. The manipulation of the argument nodeExpression leads to deserialization. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
published:2025-03-22T17:15:35.213


Instruction: Please provide detailed information about CVE-2025-2623

CVE:CVE-2025-2623
Description:A vulnerability was found in westboy CicadasCMS 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /system/cms/content/save. The manipulation of the argument title/content/laiyuan leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
published:2025-03-22T18:15:12.497


Instruction: Please provide detailed information about CVE-2025-2624

CVE:CVE-2025-2624
Description:A vulnerability was found in westboy CicadasCMS 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /system/cms/content/save. The manipulation of the argument content/fujian/laiyuan leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
published:2025-03-22T19:15:34.450


Instruction: Please provide detailed information about CVE-2025-2625

CVE:CVE-2025-2625
Description:A vulnerability classified as critical has been found in westboy CicadasCMS 1.0. This affects an unknown part of the file /system/cms/content/page. The manipulation of the argument orderField/orderDirection leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
published:2025-03-22T20:15:12.470


Instruction: Please provide detailed information about CVE-2025-2626

CVE:CVE-2025-2626
Description:A vulnerability classified as critical was found in SourceCodester Kortex Lite Advocate Office Management System 1.0. This vulnerability affects unknown code of the file edit_case.php. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
published:2025-03-22T21:15:36.817


Instruction: Please provide detailed information about CVE-2025-2627

CVE:CVE-2025-2627
Description:A vulnerability, which was classified as critical, has been found in PHPGurukul Art Gallery Management System 1.0. This issue affects some unknown processing of the file /admin/contactus.php. The manipulation of the argument pagetitle leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
published:2025-03-22T21:15:36.997


Instruction: Please provide detailed information about CVE-2025-2628

CVE:CVE-2025-2628
Description:A vulnerability, which was classified as critical, was found in PHPGurukul Art Gallery Management System 1.1. Affected is an unknown function of the file /art-enquiry.php. The manipulation of the argument eid leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
published:2025-03-22T22:15:12.160


Instruction: Please provide detailed information about CVE-2025-2637

CVE:CVE-2025-2637
Description:A vulnerability, which was classified as problematic, has been found in JIZHICMS up to 1.7.0. Affected by this issue is some unknown functionality of the file /user/userinfo.html of the component Account Profile Page. The manipulation of the argument jifen leads to improper authorization. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
published:2025-03-23T00:15:26.223


Instruction: Please provide detailed information about CVE-2025-2638

CVE:CVE-2025-2638
Description:A vulnerability, which was classified as problematic, was found in JIZHICMS up to 1.7.0. This affects an unknown part of the file /user/release.html of the component Article Handler. The manipulation of the argument ishot with the input 1 leads to improper authorization. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
published:2025-03-23T02:15:24.877


Instruction: Please provide detailed information about CVE-2025-2639

CVE:CVE-2025-2639
Description:A vulnerability has been found in JIZHICMS up to 1.7.0 and classified as problematic. This vulnerability affects unknown code of the file /user/release.html of the component Article Handler. The manipulation leads to improper authorization. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
published:2025-03-23T03:15:11.807


Instruction: Please provide detailed information about CVE-2025-2640

CVE:CVE-2025-2640
Description:A vulnerability was found in PHPGurukul Doctor Appointment Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /doctor/appointment-bwdates-reports-details.php. The manipulation of the argument fromdate/todate leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
published:2025-03-23T04:15:14.120


Instruction: Please provide detailed information about CVE-2025-2641

CVE:CVE-2025-2641
Description:A vulnerability, which was classified as critical, has been found in PHPGurukul Art Gallery Management System 1.0. Affected by this issue is some unknown functionality of the file /admin/edit-artist-detail.php?editid=1. The manipulation of the argument Name leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
published:2025-03-23T05:15:12.020


Instruction: Please provide detailed information about CVE-2025-0718

CVE:CVE-2025-0718
Description:The Nested Pages WordPress plugin before 3.2.13 does not sanitise and escape some of its settings, which could allow high privilege users such as contributors to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
published:2025-03-23T06:15:11.860


Instruction: Please provide detailed information about CVE-2025-1446

CVE:CVE-2025-1446
Description:The Pods  WordPress plugin before 3.2.8.2 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks
published:2025-03-23T06:15:12.110


Instruction: Please provide detailed information about CVE-2025-2642

CVE:CVE-2025-2642
Description:A vulnerability, which was classified as critical, was found in PHPGurukul Art Gallery Management System 1.0. This affects an unknown part of the file /admin/edit-art-product-detail.php?editid=2. The manipulation of the argument editide/sprice/description leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
published:2025-03-23T07:15:12.103


Instruction: Please provide detailed information about CVE-2025-2643

CVE:CVE-2025-2643
Description:A vulnerability has been found in PHPGurukul Art Gallery Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file /admin/edit-art-type-detail.php?editid=1. The manipulation of the argument arttype leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
published:2025-03-23T08:15:11.860


Instruction: Please provide detailed information about CVE-2025-2644

CVE:CVE-2025-2644
Description:A vulnerability was found in PHPGurukul Art Gallery Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /admin/add-art-product.php. The manipulation of the argument arttype leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
published:2025-03-23T08:15:12.743


Instruction: Please provide detailed information about CVE-2025-2645

CVE:CVE-2025-2645
Description:A vulnerability was found in PHPGurukul Art Gallery Management System 1.0. It has been classified as problematic. Affected is an unknown function of the file /product.php. The manipulation of the argument artname leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
published:2025-03-23T09:15:16.060


Instruction: Please provide detailed information about CVE-2025-2646

CVE:CVE-2025-2646
Description:A vulnerability was found in PHPGurukul Art Gallery Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /admin/admin-profile.php. The manipulation of the argument contactnumber leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.
published:2025-03-23T10:15:12.810


Instruction: Please provide detailed information about CVE-2025-2647

CVE:CVE-2025-2647
Description:A vulnerability was found in PHPGurukul Art Gallery Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /search.php. The manipulation of the argument Search leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
published:2025-03-23T11:15:34.133


Instruction: Please provide detailed information about CVE-2025-2648

CVE:CVE-2025-2648
Description:A vulnerability classified as critical has been found in PHPGurukul Art Gallery Management System 1.0. This affects an unknown part of the file /admin/view-enquiry-detail.php. The manipulation of the argument viewid leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
published:2025-03-23T12:15:12.110


Instruction: Please provide detailed information about CVE-2025-2649

CVE:CVE-2025-2649
Description:A vulnerability classified as critical was found in PHPGurukul Doctor Appointment Management System 1.0. This vulnerability affects unknown code of the file /check-appointment.php. The manipulation of the argument searchdata leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
published:2025-03-23T12:15:13.083


Instruction: Please provide detailed information about CVE-2025-2650

CVE:CVE-2025-2650
Description:A vulnerability, which was classified as problematic, has been found in PHPGurukul Medical Card Generation System 1.0. This issue affects some unknown processing of the file /download-medical-cards.php. The manipulation of the argument searchdata leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
published:2025-03-23T14:15:13.797


Instruction: Please provide detailed information about CVE-2025-0927

CVE:CVE-2025-0927
Description:Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. Filesystem bugs due to corrupt images are not considered a CVE for any filesystem that is only mountable by CAP_SYS_ADMIN in the initial user namespace. That includes delegated mounting.
published:2025-03-23T15:15:12.537


Instruction: Please provide detailed information about CVE-2025-27553

CVE:CVE-2025-27553
Description:Relative Path Traversal vulnerability in Apache Commons VFS before 2.10.0.  The FileObject API in Commons VFS has a 'resolveFile' method that takes a 'scope' parameter. Specifying 'NameScope.DESCENDENT' promises that "an exception is thrown if the resolved file is not a descendent of the base file". However, when the path contains encoded ".." characters (for example, "%2E%2E/bar.txt"), it might return file objects that are not a descendent of the base file, without throwing an exception. This issue affects Apache Commons VFS: before 2.10.0.  Users are recommended to upgrade to version 2.10.0, which fixes the issue.
published:2025-03-23T15:15:13.377


Instruction: Please provide detailed information about CVE-2025-2651

CVE:CVE-2025-2651
Description:A vulnerability, which was classified as problematic, was found in SourceCodester Online Eyewear Shop 1.0. Affected is an unknown function of the file /oews/admin/. The manipulation leads to exposure of information through directory listing. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. It is recommended to change the configuration settings. Multiple sub-directories are affected.
published:2025-03-23T15:15:13.523


Instruction: Please provide detailed information about CVE-2025-2652

CVE:CVE-2025-2652
Description:A vulnerability has been found in SourceCodester Employee and Visitor Gate Pass Logging System 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality. The manipulation leads to exposure of information through directory listing. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. It is recommended to change the configuration settings. Multiple sub-directories are affected.
published:2025-03-23T15:15:13.737


Instruction: Please provide detailed information about CVE-2025-2691

CVE:CVE-2025-2691
Description:Versions of the package nossrf before 1.0.4 are vulnerable to Server-Side Request Forgery (SSRF) where an attacker can provide a hostname that resolves to a local or reserved IP address space and bypass the SSRF protection mechanism.
published:2025-03-23T15:15:13.940


Instruction: Please provide detailed information about CVE-2025-30474

CVE:CVE-2025-30474
Description:Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Commons VFS.  The FtpFileObject class can throw an exception when a file is not found, revealing the original URI in its message, which may include a password. The fix is to mask the password in the exception message This issue affects Apache Commons VFS: before 2.10.0.  Users are recommended to upgrade to version 2.10.0, which fixes the issue.
published:2025-03-23T15:15:14.103


Instruction: Please provide detailed information about CVE-2025-2653

CVE:CVE-2025-2653
Description:A vulnerability was found in FoxCMS 1.25 and classified as problematic. Affected by this issue is some unknown functionality. The manipulation leads to improper authorization. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
published:2025-03-23T16:15:13.240


Instruction: Please provide detailed information about CVE-2025-2654

CVE:CVE-2025-2654
Description:A vulnerability was found in SourceCodester AC Repair and Services System 1.0. It has been classified as critical. This affects an unknown part of the file /admin/services/manage_service.php. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
published:2025-03-23T16:15:13.840


Instruction: Please provide detailed information about CVE-2025-29795

CVE:CVE-2025-29795
Description:Improper link resolution before file access ('link following') in Microsoft Edge (Chromium-based) allows an authorized attacker to elevate privileges locally.
published:2025-03-23T17:15:28.920


Instruction: Please provide detailed information about CVE-2025-29806

CVE:CVE-2025-29806
Description:No cwe for this issue in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
published:2025-03-23T17:15:29.450


Instruction: Please provide detailed information about CVE-2025-2655

CVE:CVE-2025-2655
Description:A vulnerability was found in SourceCodester AC Repair and Services System 1.0. It has been declared as critical. This vulnerability affects the function save_users of the file /classes/Users.php. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.
published:2025-03-23T17:15:29.687


Instruction: Please provide detailed information about CVE-2025-2656

CVE:CVE-2025-2656
Description:A vulnerability classified as critical has been found in PHPGurukul Zoo Management System 2.1. Affected is an unknown function of the file /admin/login.php. The manipulation of the argument Username leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
published:2025-03-23T17:15:29.867


Instruction: Please provide detailed information about CVE-2025-2657

CVE:CVE-2025-2657
Description:A vulnerability classified as critical was found in projectworlds Apartment Visitors Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /front.php. The manipulation of the argument rid leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
published:2025-03-23T18:15:13.607


Instruction: Please provide detailed information about CVE-2025-2658

CVE:CVE-2025-2658
Description:A vulnerability, which was classified as critical, has been found in PHPGurukul Online Security Guards Hiring System 1.0. Affected by this issue is some unknown functionality of the file /search-request.php. The manipulation of the argument searchdata leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
published:2025-03-23T18:15:14.533


Instruction: Please provide detailed information about CVE-2025-2659

CVE:CVE-2025-2659
Description:A vulnerability, which was classified as critical, was found in Project Worlds Online Time Table Generator 1.0. This affects an unknown part of the file /student/index.php. The manipulation of the argument e leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
published:2025-03-23T19:15:14.570


Instruction: Please provide detailed information about CVE-2025-2660

CVE:CVE-2025-2660
Description:A vulnerability has been found in Project Worlds Online Time Table Generator 1.0 and classified as critical. This vulnerability affects unknown code of the file /admin/index.php. The manipulation of the argument e leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
published:2025-03-23T19:15:14.770


Instruction: Please provide detailed information about CVE-2025-2661

CVE:CVE-2025-2661
Description:A vulnerability was found in Project Worlds Online Time Table Generator 1.0 and classified as critical. This issue affects some unknown processing of the file /staff/index.php. The manipulation of the argument e leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
published:2025-03-23T20:15:12.500


Instruction: Please provide detailed information about CVE-2025-2662

CVE:CVE-2025-2662
Description:A vulnerability was found in Project Worlds Online Time Table Generator 1.0. It has been classified as critical. Affected is an unknown function of the file student/studentdashboard.php. The manipulation of the argument course leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
published:2025-03-23T20:15:12.697


Instruction: Please provide detailed information about CVE-2025-2663

CVE:CVE-2025-2663
Description:A vulnerability has been found in PHPGurukul Bank Locker Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /search-locker-details.php. The manipulation of the argument searchinput leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
published:2025-03-23T21:15:14.603


Instruction: Please provide detailed information about CVE-2025-2664

CVE:CVE-2025-2664
Description:A vulnerability was found in CodeZips Hospital Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /suadpeted.php. The manipulation of the argument ID leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
published:2025-03-23T21:15:14.790


Instruction: Please provide detailed information about CVE-2025-2665

CVE:CVE-2025-2665
Description:A vulnerability was found in PHPGurukul Online Security Guards Hiring System 1.0. It has been classified as critical. This affects an unknown part of the file /admin/bwdates-reports-details.php. The manipulation of the argument fromdate/todate leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
published:2025-03-23T22:15:13.340


Instruction: Please provide detailed information about CVE-2025-2671

CVE:CVE-2025-2671
Description:A vulnerability was found in Yue Lao Blind Box 月老盲盒 up to 4.0. It has been declared as critical. This vulnerability affects the function base64image of the file /app/controller/Upload.php. The manipulation of the argument data leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
published:2025-03-23T22:15:13.513


Instruction: Please provide detailed information about CVE-2025-2672

CVE:CVE-2025-2672
Description:A vulnerability was found in code-projects Payroll Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /add_deductions.php. The manipulation of the argument bir leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.
published:2025-03-23T23:15:13.847


Instruction: Please provide detailed information about CVE-2025-2673

CVE:CVE-2025-2673
Description:A vulnerability classified as problematic has been found in code-projects Payroll Management System 1.0. Affected is an unknown function of the file /home_employee.php. The manipulation of the argument division leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.
published:2025-03-24T00:15:12.467


Instruction: Please provide detailed information about CVE-2025-2674

CVE:CVE-2025-2674
Description:A vulnerability classified as critical was found in PHPGurukul Bank Locker Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /aboutus.php. The manipulation of the argument pagetitle leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
published:2025-03-24T00:15:13.533


Instruction: Please provide detailed information about CVE-2025-2675

CVE:CVE-2025-2675
Description:A vulnerability, which was classified as critical, has been found in PHPGurukul Bank Locker Management System 1.0. Affected by this issue is some unknown functionality of the file /add-lockertype.php. The manipulation of the argument lockerprice leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
published:2025-03-24T01:15:16.490


Instruction: Please provide detailed information about CVE-2025-2676

CVE:CVE-2025-2676
Description:A vulnerability, which was classified as critical, was found in PHPGurukul Bank Locker Management System 1.0. This affects an unknown part of the file /add-subadmin.php. The manipulation of the argument sadminusername leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
published:2025-03-24T01:15:17.177


Instruction: Please provide detailed information about CVE-2025-2677

CVE:CVE-2025-2677
Description:A vulnerability has been found in PHPGurukul Bank Locker Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file /changeidproof.php. The manipulation of the argument editid leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
published:2025-03-24T02:15:15.540


Instruction: Please provide detailed information about CVE-2025-2678

CVE:CVE-2025-2678
Description:A vulnerability was found in PHPGurukul Bank Locker Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /changeimage1.php. The manipulation of the argument editid leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
published:2025-03-24T03:15:14.573


Instruction: Please provide detailed information about CVE-2025-2679

CVE:CVE-2025-2679
Description:A vulnerability was found in PHPGurukul Bank Locker Management System 1.0. It has been classified as critical. Affected is an unknown function of the file /contact-us.php. The manipulation of the argument pagetitle leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
published:2025-03-24T03:15:15.553


Instruction: Please provide detailed information about CVE-2025-2680

CVE:CVE-2025-2680
Description:A vulnerability was found in PHPGurukul Bank Locker Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /edit-assign-locker.php?ltid=1. The manipulation of the argument mobilenumber leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
published:2025-03-24T03:15:15.727


Instruction: Please provide detailed information about CVE-2025-2681

CVE:CVE-2025-2681
Description:A vulnerability was found in PHPGurukul Bank Locker Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /edit-locker.php?ltid=6. The manipulation of the argument lockersize leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
published:2025-03-24T04:15:13.510


Instruction: Please provide detailed information about CVE-2025-2682

CVE:CVE-2025-2682
Description:A vulnerability classified as critical has been found in PHPGurukul Bank Locker Management System 1.0. This affects an unknown part of the file /edit-subadmin.php?said=3. The manipulation of the argument mobilenumber leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
published:2025-03-24T04:15:14.643


Instruction: Please provide detailed information about CVE-2025-2683

CVE:CVE-2025-2683
Description:A vulnerability classified as critical was found in PHPGurukul Bank Locker Management System 1.0. This vulnerability affects unknown code of the file /profile.php. The manipulation of the argument mobilenumber leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
published:2025-03-24T05:15:13.037


Instruction: Please provide detailed information about CVE-2025-2684

CVE:CVE-2025-2684
Description:A vulnerability, which was classified as critical, has been found in PHPGurukul Bank Locker Management System 1.0. This issue affects some unknown processing of the file /search-report-details.php. The manipulation of the argument searchinput leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
published:2025-03-24T05:15:13.373


Instruction: Please provide detailed information about CVE-2025-1062

CVE:CVE-2025-1062
Description:The Slider, Gallery, and Carousel by MetaSlider  WordPress plugin before 3.95.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
published:2025-03-24T06:15:12.910


Instruction: Please provide detailed information about CVE-2025-1203

CVE:CVE-2025-1203
Description:The Slider, Gallery, and Carousel by MetaSlider  WordPress plugin before 3.95.0 does not sanitise and escape some of its settings, which could allow high privilege users such as editor to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
published:2025-03-24T06:15:13.013


Instruction: Please provide detailed information about CVE-2025-2686

CVE:CVE-2025-2686
Description:A vulnerability has been found in mingyuefusu 明月复苏 tushuguanlixitong 图书管理系统 up to d4836f6b49cd0ac79a4021b15ce99ff7229d4694 and classified as critical. Affected by this vulnerability is the function doFilter of the file /admin/ of the component Backend. The manipulation of the argument Request leads to improper access controls. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
published:2025-03-24T06:15:13.127


Instruction: Please provide detailed information about CVE-2025-2687

CVE:CVE-2025-2687
Description:A vulnerability classified as critical has been found in PHPGurukul eLearning System 1.0. Affected is an unknown function of the file /user/index.php of the component Image Handler. The manipulation leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
published:2025-03-24T06:15:13.397


Instruction: Please provide detailed information about CVE-2025-2688

CVE:CVE-2025-2688
Description:A vulnerability classified as problematic was found in TOTOLINK A3000RU up to 5.9c.5185. Affected by this vulnerability is an unknown functionality of the file /cgi-bin/ExportSyslog.sh of the component Syslog Configuration File Handler. The manipulation leads to improper access controls. The attack needs to be done within the local network. The exploit has been disclosed to the public and may be used.
published:2025-03-24T07:15:12.760


Instruction: Please provide detailed information about CVE-2025-2689

CVE:CVE-2025-2689
Description:A vulnerability, which was classified as critical, has been found in yiisoft Yii2 up to 2.0.45. Affected by this issue is the function getIterator of the file symfony\finder\Iterator\SortableIterator.php. The manipulation leads to deserialization. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
published:2025-03-24T07:15:14.010


Instruction: Please provide detailed information about CVE-2025-2690

CVE:CVE-2025-2690
Description:A vulnerability, which was classified as critical, was found in yiisoft Yii2 up to 2.0.39. This affects the function Generate of the file phpunit\src\Framework\MockObject\MockClass.php. The manipulation leads to deserialization. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
published:2025-03-24T08:15:12.793


Instruction: Please provide detailed information about CVE-2025-2699

CVE:CVE-2025-2699
Description:A vulnerability was found in GetmeUK ContentTools up to 1.6.16. It has been rated as problematic. Affected by this issue is some unknown functionality of the component Image Handler. The manipulation of the argument onload leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-03-24T08:15:12.967


Instruction: Please provide detailed information about CVE-2025-2700

CVE:CVE-2025-2700
Description:A vulnerability classified as problematic has been found in michelson Dante Editor up to 0.4.4. This affects an unknown part of the component Insert Link Handler. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-03-24T09:15:12.930


Instruction: Please provide detailed information about CVE-2025-2701

CVE:CVE-2025-2701
Description:A vulnerability classified as critical was found in AMTT Hotel Broadband Operation System 1.0. This vulnerability affects the function popen of the file /manager/network/port_setup.php. The manipulation of the argument SwitchVersion/SwitchWrite/SwitchIP/SwitchIndex/SwitchState leads to os command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-03-24T09:15:13.950


Instruction: Please provide detailed information about CVE-2025-2702

CVE:CVE-2025-2702
Description:A vulnerability, which was classified as critical, has been found in Softwin WMX3 3.1. This issue affects the function ImageAdd of the file /ImageAdd.ashx. The manipulation of the argument File leads to unrestricted upload. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-03-24T10:15:12.943


Instruction: Please provide detailed information about CVE-2025-0478

CVE:CVE-2025-0478
Description:Software installed and run as a non-privileged user may conduct improper GPU system calls to issue reads and writes to arbitrary physical memory pages.  Under certain circumstances this exploit could be used to corrupt data pages not allocated by the GPU driver but memory pages in use by the kernel and drivers running on the platform, altering their behaviour.
published:2025-03-24T12:15:13.227


Instruction: Please provide detailed information about CVE-2025-0835

CVE:CVE-2025-0835
Description:Software installed and run as a non-privileged user may conduct improper GPU system calls to corrupt kernel heap memory.
published:2025-03-24T12:15:13.597


Instruction: Please provide detailed information about CVE-2025-30521

CVE:CVE-2025-30521
Description:Cross-Site Request Forgery (CSRF) vulnerability in giangmd93 GP Back To Top allows Cross Site Request Forgery. This issue affects GP Back To Top: from n/a through 3.0.
published:2025-03-24T14:15:20.170


Instruction: Please provide detailed information about CVE-2025-30522

CVE:CVE-2025-30522
Description:Cross-Site Request Forgery (CSRF) vulnerability in Damian Orzol Contact Form 7 Material Design allows Stored XSS. This issue affects Contact Form 7 Material Design: from n/a through 1.0.0.
published:2025-03-24T14:15:20.397


Instruction: Please provide detailed information about CVE-2025-30523

CVE:CVE-2025-30523
Description:Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Marcel-NL Super Simple Subscriptions allows SQL Injection. This issue affects Super Simple Subscriptions: from n/a through 1.1.0.
published:2025-03-24T14:15:20.593


Instruction: Please provide detailed information about CVE-2025-30525

CVE:CVE-2025-30525
Description:Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ProfitShare.ro WP Profitshare allows SQL Injection. This issue affects WP Profitshare: from n/a through 1.4.9.
published:2025-03-24T14:15:20.757


Instruction: Please provide detailed information about CVE-2025-30526

CVE:CVE-2025-30526
Description:Cross-Site Request Forgery (CSRF) vulnerability in lucksy Typekit plugin for WordPress allows Cross Site Request Forgery. This issue affects Typekit plugin for WordPress: from n/a through 1.2.3.
published:2025-03-24T14:15:20.920


Instruction: Please provide detailed information about CVE-2025-30527

CVE:CVE-2025-30527
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in codetoolbox My Bootstrap Menu allows Stored XSS. This issue affects My Bootstrap Menu: from n/a through 1.2.1.
published:2025-03-24T14:15:21.083


Instruction: Please provide detailed information about CVE-2025-30528

CVE:CVE-2025-30528
Description:Cross-Site Request Forgery (CSRF) vulnerability in wpshopee Awesome Logos allows SQL Injection. This issue affects Awesome Logos: from n/a through 1.2.
published:2025-03-24T14:15:21.240


Instruction: Please provide detailed information about CVE-2025-30529

CVE:CVE-2025-30529
Description:Cross-Site Request Forgery (CSRF) vulnerability in Sébastien Dumont Auto Load Next Post allows Cross Site Request Forgery. This issue affects Auto Load Next Post: from n/a through 1.5.14.
published:2025-03-24T14:15:21.397


Instruction: Please provide detailed information about CVE-2025-30530

CVE:CVE-2025-30530
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Atikul AI Preloader allows Stored XSS. This issue affects AI Preloader: from n/a through 1.0.2.
published:2025-03-24T14:15:21.543


Instruction: Please provide detailed information about CVE-2025-30531

CVE:CVE-2025-30531
Description:Cross-Site Request Forgery (CSRF) vulnerability in GBS Developer WP Ride Booking allows Cross Site Request Forgery. This issue affects WP Ride Booking: from n/a through 2.4.
published:2025-03-24T14:15:21.693


Instruction: Please provide detailed information about CVE-2025-30532

CVE:CVE-2025-30532
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MorganF Weather Layer allows Stored XSS. This issue affects Weather Layer: from n/a through 4.2.1.
published:2025-03-24T14:15:21.850


Instruction: Please provide detailed information about CVE-2025-30533

CVE:CVE-2025-30533
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in gopiplus Message ticker allows Stored XSS. This issue affects Message ticker: from n/a through 9.3.
published:2025-03-24T14:15:21.993


Instruction: Please provide detailed information about CVE-2025-30534

CVE:CVE-2025-30534
Description:Cross-Site Request Forgery (CSRF) vulnerability in captcha.soft Image Captcha allows Cross Site Request Forgery. This issue affects Image Captcha: from n/a through 1.2.
published:2025-03-24T14:15:22.143


Instruction: Please provide detailed information about CVE-2025-30535

CVE:CVE-2025-30535
Description:Cross-Site Request Forgery (CSRF) vulnerability in muro External image replace allows Cross Site Request Forgery. This issue affects External image replace: from n/a through 1.0.8.
published:2025-03-24T14:15:22.297


Instruction: Please provide detailed information about CVE-2025-30536

CVE:CVE-2025-30536
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in zeitwesentech Beautiful Link Preview allows Stored XSS. This issue affects Beautiful Link Preview: from n/a through 1.5.0.
published:2025-03-24T14:15:22.450


Instruction: Please provide detailed information about CVE-2025-30537

CVE:CVE-2025-30537
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cristian Sarov Upload Quota per User allows Stored XSS. This issue affects Upload Quota per User: from n/a through 1.3.
published:2025-03-24T14:15:22.593


Instruction: Please provide detailed information about CVE-2025-30538

CVE:CVE-2025-30538
Description:Cross-Site Request Forgery (CSRF) vulnerability in ChrisHurst Simple Optimizer allows Cross Site Request Forgery. This issue affects Simple Optimizer: from n/a through 1.2.7.
published:2025-03-24T14:15:22.743


Instruction: Please provide detailed information about CVE-2025-30539

CVE:CVE-2025-30539
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Benedikt Mo BMo Expo allows Stored XSS. This issue affects BMo Expo: from n/a through 1.0.15.
published:2025-03-24T14:15:22.887


Instruction: Please provide detailed information about CVE-2025-30540

CVE:CVE-2025-30540
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in avaibook AvaiBook allows Stored XSS. This issue affects AvaiBook: from n/a through 1.2.
published:2025-03-24T14:15:23.030


Instruction: Please provide detailed information about CVE-2025-30541

CVE:CVE-2025-30541
Description:Cross-Site Request Forgery (CSRF) vulnerability in OTWthemes Info Boxes Shortcode and Widget allows Cross Site Request Forgery. This issue affects Info Boxes Shortcode and Widget: from n/a through 1.15.
published:2025-03-24T14:15:23.180


Instruction: Please provide detailed information about CVE-2025-30542

CVE:CVE-2025-30542
Description:Cross-Site Request Forgery (CSRF) vulnerability in wpsolutions SoundCloud Ultimate allows Cross Site Request Forgery. This issue affects SoundCloud Ultimate: from n/a through 1.5.
published:2025-03-24T14:15:23.337


Instruction: Please provide detailed information about CVE-2025-30543

CVE:CVE-2025-30543
Description:Missing Authorization vulnerability in swayam.tejwani Menu Duplicator allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Menu Duplicator: from n/a through 1.0.
published:2025-03-24T14:15:23.483


Instruction: Please provide detailed information about CVE-2025-30545

CVE:CVE-2025-30545
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pixeline issuuPress allows Stored XSS. This issue affects issuuPress: from n/a through 1.3.2.
published:2025-03-24T14:15:23.653


Instruction: Please provide detailed information about CVE-2025-30546

CVE:CVE-2025-30546
Description:Cross-Site Request Forgery (CSRF) vulnerability in boroV Cackle allows Cross Site Request Forgery. This issue affects Cackle: from n/a through 4.33.
published:2025-03-24T14:15:23.820


Instruction: Please provide detailed information about CVE-2025-30549

CVE:CVE-2025-30549
Description:Cross-Site Request Forgery (CSRF) vulnerability in Yummly Yummly Rich Recipes allows Cross Site Request Forgery. This issue affects Yummly Rich Recipes: from n/a through 4.2.
published:2025-03-24T14:15:23.970


Instruction: Please provide detailed information about CVE-2025-30550

CVE:CVE-2025-30550
Description:Cross-Site Request Forgery (CSRF) vulnerability in WPShop.ru CallPhone'r allows Stored XSS. This issue affects CallPhone'r: from n/a through 1.1.1.
published:2025-03-24T14:15:24.117


Instruction: Please provide detailed information about CVE-2025-30551

CVE:CVE-2025-30551
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in smartredfox Pretty file links allows Stored XSS. This issue affects Pretty file links: from n/a through 0.9.
published:2025-03-24T14:15:24.260


Instruction: Please provide detailed information about CVE-2025-30552

CVE:CVE-2025-30552
Description:Cross-Site Request Forgery (CSRF) vulnerability in Donald Gilbert WordPress Admin Bar Improved allows Stored XSS. This issue affects WordPress Admin Bar Improved: from n/a through 3.3.5.
published:2025-03-24T14:15:24.407


Instruction: Please provide detailed information about CVE-2025-30553

CVE:CVE-2025-30553
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Z.com byGMO GMO Font Agent allows Stored XSS. This issue affects GMO Font Agent: from n/a through 1.6.
published:2025-03-24T14:15:24.547


Instruction: Please provide detailed information about CVE-2025-30555

CVE:CVE-2025-30555
Description:Cross-Site Request Forgery (CSRF) vulnerability in iiiryan WordPres 同步微博 allows Stored XSS. This issue affects WordPres 同步微博: from n/a through 1.1.0.
published:2025-03-24T14:15:24.690


Instruction: Please provide detailed information about CVE-2025-30556

CVE:CVE-2025-30556
Description:Cross-Site Request Forgery (CSRF) vulnerability in flyaga Fix Rss Feeds allows Cross Site Request Forgery. This issue affects Fix Rss Feeds: from n/a through 3.1.
published:2025-03-24T14:15:24.837


Instruction: Please provide detailed information about CVE-2025-30557

CVE:CVE-2025-30557
Description:Cross-Site Request Forgery (CSRF) vulnerability in odihost Easy 301 Redirects allows Cross Site Request Forgery. This issue affects Easy 301 Redirects: from n/a through 1.33.
published:2025-03-24T14:15:24.973


Instruction: Please provide detailed information about CVE-2025-30558

CVE:CVE-2025-30558
Description:Cross-Site Request Forgery (CSRF) vulnerability in EnzoCostantini55 ANAC XML Render allows Stored XSS. This issue affects ANAC XML Render: from n/a through 1.5.7.
published:2025-03-24T14:15:25.113


Instruction: Please provide detailed information about CVE-2025-30560

CVE:CVE-2025-30560
Description:Cross-Site Request Forgery (CSRF) vulnerability in Sana Ullah jQuery Dropdown Menu allows Stored XSS. This issue affects jQuery Dropdown Menu: from n/a through 3.0.
published:2025-03-24T14:15:26.910


Instruction: Please provide detailed information about CVE-2025-30561

CVE:CVE-2025-30561
Description:Cross-Site Request Forgery (CSRF) vulnerability in Henrique Mouta CAS Maestro allows Stored XSS. This issue affects CAS Maestro: from n/a through 1.1.3.
published:2025-03-24T14:15:27.460


Instruction: Please provide detailed information about CVE-2025-30564

CVE:CVE-2025-30564
Description:Cross-Site Request Forgery (CSRF) vulnerability in wpwox Custom Script Integration allows Stored XSS. This issue affects Custom Script Integration: from n/a through 2.1.
published:2025-03-24T14:15:28.200


Instruction: Please provide detailed information about CVE-2025-30565

CVE:CVE-2025-30565
Description:Cross-Site Request Forgery (CSRF) vulnerability in karrikas banner-manager allows Stored XSS. This issue affects banner-manager: from n/a through 16.04.19.
published:2025-03-24T14:15:28.347


Instruction: Please provide detailed information about CVE-2025-30566

CVE:CVE-2025-30566
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Aryan Themes Clink allows DOM-Based XSS. This issue affects Clink: from n/a through 1.2.2.
published:2025-03-24T14:15:28.490


Instruction: Please provide detailed information about CVE-2025-30568

CVE:CVE-2025-30568
Description:Cross-Site Request Forgery (CSRF) vulnerability in hitoy Super Static Cache allows Cross Site Request Forgery. This issue affects Super Static Cache: from n/a through 3.3.5.
published:2025-03-24T14:15:28.630


Instruction: Please provide detailed information about CVE-2025-30569

CVE:CVE-2025-30569
Description:Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Jahertor WP Featured Entries allows SQL Injection. This issue affects WP Featured Entries: from n/a through 1.0.
published:2025-03-24T14:15:28.780


Instruction: Please provide detailed information about CVE-2025-30570

CVE:CVE-2025-30570
Description:Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AliRezaMohammadi دکمه، شبکه اجتماعی خرید allows SQL Injection. This issue affects دکمه، شبکه اجتماعی خرید: from n/a through 2.0.6.
published:2025-03-24T14:15:28.937


Instruction: Please provide detailed information about CVE-2025-30571

CVE:CVE-2025-30571
Description:Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in STEdb Corp. STEdb Forms allows SQL Injection. This issue affects STEdb Forms: from n/a through 1.0.4.
published:2025-03-24T14:15:29.077


Instruction: Please provide detailed information about CVE-2025-30572

CVE:CVE-2025-30572
Description:Cross-Site Request Forgery (CSRF) vulnerability in Igor Yavych Simple Rating allows Stored XSS. This issue affects Simple Rating: from n/a through 1.4.
published:2025-03-24T14:15:29.217


Instruction: Please provide detailed information about CVE-2025-30573

CVE:CVE-2025-30573
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mrdenny My Default Post Content allows Stored XSS. This issue affects My Default Post Content: from n/a through 0.7.3.
published:2025-03-24T14:15:29.360


Instruction: Please provide detailed information about CVE-2025-30574

CVE:CVE-2025-30574
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jenst Mobile Navigation allows Stored XSS. This issue affects Mobile Navigation: from n/a through 1.5.
published:2025-03-24T14:15:29.507


Instruction: Please provide detailed information about CVE-2025-30575

CVE:CVE-2025-30575
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Arefly Login Redirect allows Stored XSS. This issue affects Login Redirect: from n/a through 1.0.5.
published:2025-03-24T14:15:29.650


Instruction: Please provide detailed information about CVE-2025-30576

CVE:CVE-2025-30576
Description:Cross-Site Request Forgery (CSRF) vulnerability in HuangYe WuDeng Hacklog Remote Image Autosave allows Cross Site Request Forgery. This issue affects Hacklog Remote Image Autosave: from n/a through 2.1.0.
published:2025-03-24T14:15:29.790


Instruction: Please provide detailed information about CVE-2025-30577

CVE:CVE-2025-30577
Description:Cross-Site Request Forgery (CSRF) vulnerability in mendibass Browser Address Bar Color allows Stored XSS. This issue affects Browser Address Bar Color: from n/a through 3.3.
published:2025-03-24T14:15:29.923


Instruction: Please provide detailed information about CVE-2025-30578

CVE:CVE-2025-30578
Description:Cross-Site Request Forgery (CSRF) vulnerability in hotvanrod AdSense Privacy Policy allows Stored XSS. This issue affects AdSense Privacy Policy: from n/a through 1.1.1.
published:2025-03-24T14:15:30.073


Instruction: Please provide detailed information about CVE-2025-30581

CVE:CVE-2025-30581
Description:Missing Authorization vulnerability in PluginOps Top Bar allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Top Bar: from n/a through 3.3.
published:2025-03-24T14:15:30.217


Instruction: Please provide detailed information about CVE-2025-30583

CVE:CVE-2025-30583
Description:Cross-Site Request Forgery (CSRF) vulnerability in ProRankTracker Pro Rank Tracker allows Stored XSS. This issue affects Pro Rank Tracker: from n/a through 1.0.0.
published:2025-03-24T14:15:30.353


Instruction: Please provide detailed information about CVE-2025-30584

CVE:CVE-2025-30584
Description:Cross-Site Request Forgery (CSRF) vulnerability in alphaomegaplugins AlphaOmega Captcha & Anti-Spam Filter allows Stored XSS. This issue affects AlphaOmega Captcha & Anti-Spam Filter: from n/a through 3.3.
published:2025-03-24T14:15:30.490


Instruction: Please provide detailed information about CVE-2025-30585

CVE:CVE-2025-30585
Description:Cross-Site Request Forgery (CSRF) vulnerability in marynixie Generate Post Thumbnails allows Cross Site Request Forgery. This issue affects Generate Post Thumbnails: from n/a through 0.8.
published:2025-03-24T14:15:30.630


Instruction: Please provide detailed information about CVE-2025-30586

CVE:CVE-2025-30586
Description:Cross-Site Request Forgery (CSRF) vulnerability in bbodine1 cTabs allows Stored XSS. This issue affects cTabs: from n/a through 1.3.
published:2025-03-24T14:15:30.767


Instruction: Please provide detailed information about CVE-2025-30587

CVE:CVE-2025-30587
Description:Cross-Site Request Forgery (CSRF) vulnerability in shawfactor LH OGP Meta allows Stored XSS. This issue affects LH OGP Meta: from n/a through 1.73.
published:2025-03-24T14:15:30.910


Instruction: Please provide detailed information about CVE-2025-30588

CVE:CVE-2025-30588
Description:Cross-Site Request Forgery (CSRF) vulnerability in ryan_xantoo Map Contact allows Stored XSS. This issue affects Map Contact: from n/a through 3.0.4.
published:2025-03-24T14:15:31.057


Instruction: Please provide detailed information about CVE-2025-30590

CVE:CVE-2025-30590
Description:Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Dourou Flickr set slideshows allows SQL Injection. This issue affects Flickr set slideshows: from n/a through 0.9.
published:2025-03-24T14:15:31.197


Instruction: Please provide detailed information about CVE-2025-30591

CVE:CVE-2025-30591
Description:Missing Authorization vulnerability in tuyennv Music Press Pro allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Music Press Pro: from n/a through 1.4.6.
published:2025-03-24T14:15:31.333


Instruction: Please provide detailed information about CVE-2025-30592

CVE:CVE-2025-30592
Description:Missing Authorization vulnerability in westerndeal Advanced Dewplayer allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Advanced Dewplayer: from n/a through 1.6.
published:2025-03-24T14:15:31.477


Instruction: Please provide detailed information about CVE-2025-30593

CVE:CVE-2025-30593
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in samsk Include URL allows Stored XSS. This issue affects Include URL: from n/a through 0.3.5.
published:2025-03-24T14:15:31.620


Instruction: Please provide detailed information about CVE-2025-30595

CVE:CVE-2025-30595
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tstafford include-file allows Stored XSS. This issue affects include-file: from n/a through 1.
published:2025-03-24T14:15:31.770


Instruction: Please provide detailed information about CVE-2025-30597

CVE:CVE-2025-30597
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in iografica IG Shortcodes allows DOM-Based XSS. This issue affects IG Shortcodes: from n/a through 3.1.
published:2025-03-24T14:15:31.910


Instruction: Please provide detailed information about CVE-2025-30598

CVE:CVE-2025-30598
Description:Cross-Site Request Forgery (CSRF) vulnerability in Link OSS Upload allows Cross Site Request Forgery. This issue affects OSS Upload: from n/a through 4.8.9.
published:2025-03-24T14:15:32.067


Instruction: Please provide detailed information about CVE-2025-30599

CVE:CVE-2025-30599
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wp-maverick WP Parallax Content Slider allows Stored XSS. This issue affects WP Parallax Content Slider: from n/a through 0.9.8.
published:2025-03-24T14:15:32.227


Instruction: Please provide detailed information about CVE-2025-30600

CVE:CVE-2025-30600
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in thiagogsrwp WP Hotjar allows Stored XSS. This issue affects WP Hotjar: from n/a through 0.0.3.
published:2025-03-24T14:15:32.370


Instruction: Please provide detailed information about CVE-2025-30601

CVE:CVE-2025-30601
Description:Cross-Site Request Forgery (CSRF) vulnerability in flipdish Flipdish Ordering System allows Cross Site Request Forgery. This issue affects Flipdish Ordering System: from n/a through 1.4.16.
published:2025-03-24T14:15:32.520


Instruction: Please provide detailed information about CVE-2025-30602

CVE:CVE-2025-30602
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in alphasis Related Posts via Categories allows Stored XSS. This issue affects Related Posts via Categories: from n/a through 2.1.2.
published:2025-03-24T14:15:32.667


Instruction: Please provide detailed information about CVE-2025-30603

CVE:CVE-2025-30603
Description:Cross-Site Request Forgery (CSRF) vulnerability in DEJAN CopyLink allows Stored XSS. This issue affects CopyLink: from n/a through 1.1.
published:2025-03-24T14:15:32.810


Instruction: Please provide detailed information about CVE-2025-30604

CVE:CVE-2025-30604
Description:Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in jiangqie JiangQie Official Website Mini Program allows Blind SQL Injection. This issue affects JiangQie Official Website Mini Program: from n/a through 1.8.2.
published:2025-03-24T14:15:32.953


Instruction: Please provide detailed information about CVE-2025-30605

CVE:CVE-2025-30605
Description:Missing Authorization vulnerability in ldwin79 sourceplay-navermap allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects sourceplay-navermap: from n/a through 0.0.2.
published:2025-03-24T14:15:33.103


Instruction: Please provide detailed information about CVE-2025-30606

CVE:CVE-2025-30606
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Logan Carlile Easy Page Transition allows Stored XSS. This issue affects Easy Page Transition: from n/a through 1.0.1.
published:2025-03-24T14:15:33.247


Instruction: Please provide detailed information about CVE-2025-30608

CVE:CVE-2025-30608
Description:Cross-Site Request Forgery (CSRF) vulnerability in Anthony WordPress SQL Backup allows Stored XSS. This issue affects WordPress SQL Backup: from n/a through 3.5.2.
published:2025-03-24T14:15:33.383


Instruction: Please provide detailed information about CVE-2025-30609

CVE:CVE-2025-30609
Description:Insertion of Sensitive Information Into Sent Data vulnerability in AppExperts AppExperts – WordPress to Mobile App – WooCommerce to iOs and Android Apps allows Retrieve Embedded Sensitive Data. This issue affects AppExperts – WordPress to Mobile App – WooCommerce to iOs and Android Apps: from n/a through 1.4.3.
published:2025-03-24T14:15:33.533


Instruction: Please provide detailed information about CVE-2025-30610

CVE:CVE-2025-30610
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in catchsquare WP Social Widget allows Stored XSS. This issue affects WP Social Widget: from n/a through 2.2.6.
published:2025-03-24T14:15:33.680


Instruction: Please provide detailed information about CVE-2025-30612

CVE:CVE-2025-30612
Description:Cross-Site Request Forgery (CSRF) vulnerability in mandegarweb Replace Default Words allows Stored XSS. This issue affects Replace Default Words: from n/a through 1.3.
published:2025-03-24T14:15:33.823


Instruction: Please provide detailed information about CVE-2025-30615

CVE:CVE-2025-30615
Description:Cross-Site Request Forgery (CSRF) vulnerability in Jacob Schwartz WP e-Commerce Style Email allows Code Injection. This issue affects WP e-Commerce Style Email: from n/a through 0.6.2.
published:2025-03-24T14:15:34.040


Instruction: Please provide detailed information about CVE-2025-30617

CVE:CVE-2025-30617
Description:Cross-Site Request Forgery (CSRF) vulnerability in takien Rewrite allows Cross Site Request Forgery. This issue affects Rewrite: from n/a through 0.2.1.
published:2025-03-24T14:15:34.223


Instruction: Please provide detailed information about CVE-2025-30619

CVE:CVE-2025-30619
Description:Cross-Site Request Forgery (CSRF) vulnerability in SpeakPipe SpeakPipe allows Cross Site Request Forgery. This issue affects SpeakPipe: from n/a through 0.2.
published:2025-03-24T14:15:34.370


Instruction: Please provide detailed information about CVE-2025-30620

CVE:CVE-2025-30620
Description:Cross-Site Request Forgery (CSRF) vulnerability in coderscom WP Odoo Form Integrator allows Stored XSS. This issue affects WP Odoo Form Integrator: from n/a through 1.1.0.
published:2025-03-24T14:15:34.520


Instruction: Please provide detailed information about CVE-2025-30621

CVE:CVE-2025-30621
Description:Cross-Site Request Forgery (CSRF) vulnerability in kornelly Translator allows Stored XSS. This issue affects Translator: from n/a through 0.3.
published:2025-03-24T14:15:34.660


Instruction: Please provide detailed information about CVE-2025-30623

CVE:CVE-2025-30623
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rachel Cherry wA11y – The Web Accessibility Toolbox allows Stored XSS. This issue affects wA11y – The Web Accessibility Toolbox: from n/a through 1.0.3.
published:2025-03-24T14:15:34.797


Instruction: Please provide detailed information about CVE-2025-1558

CVE:CVE-2025-1558
Description:Mattermost Mobile Apps versions <=2.25.0 fail to properly validate GIF images prior to rendering which allows a malicious user to cause the Android application to crash via message containing a maliciously crafted GIF.
published:2025-03-24T15:15:16.060


Instruction: Please provide detailed information about CVE-2025-2326

CVE:CVE-2025-2326
Description:Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate was issued in error. Notes: All references and descriptions in this candidate have been removed to prevent accidental usage.
published:2025-03-24T15:15:16.830


Instruction: Please provide detailed information about CVE-2025-0256

CVE:CVE-2025-0256
Description:HCL DevOps Deploy / HCL Launch could allow an authenticated user to obtain sensitive information about other users on the system due to missing authorization for a function.
published:2025-03-24T16:15:33.120


Instruction: Please provide detailed information about CVE-2025-23204

CVE:CVE-2025-23204
Description:API Platform Core is a system to create hypermedia-driven REST and GraphQL APIs. Starting in version 3.3.8, a security check that gets called after GraphQl resolvers is always replaced by another one as there's no break in a clause. As this falls back to `security`, the impact is there only when there's only a security after resolver and none inside security. Version 3.3.15 contains a patch for the issue.
published:2025-03-24T16:15:56.040


Instruction: Please provide detailed information about CVE-2025-29294

CVE:CVE-2025-29294
Description:Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
published:2025-03-24T16:15:56.460


Instruction: Please provide detailed information about CVE-2025-2705

CVE:CVE-2025-2705
Description:A vulnerability classified as critical has been found in Digiwin ERP 5.1. Affected is the function DoUpload/DoWebUpload of the file /Api/FileUploadApi.ashx. The manipulation of the argument File leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-03-24T16:15:57.350


Instruction: Please provide detailed information about CVE-2025-0255

CVE:CVE-2025-0255
Description:HCL DevOps Deploy / HCL Launch could allow a remote privileged authenticated attacker to execute arbitrary commands on the system by sending specially crafted input containing special elements.
published:2025-03-24T17:15:20.110


Instruction: Please provide detailed information about CVE-2025-29778

CVE:CVE-2025-29778
Description:Kyverno is a policy engine designed for cloud native platform engineering teams. Prior to version 1.14.0-alpha.1, Kyverno ignores subjectRegExp and IssuerRegExp while verifying artifact's sign with keyless mode. It allows the attacker to deploy kubernetes resources with the artifacts that were signed by unexpected certificate. Deploying these unauthorized kubernetes resources can lead to full compromise of kubernetes cluster. Version 1.14.0-alpha.1 contains a patch for the issue.
published:2025-03-24T17:15:20.970


Instruction: Please provide detailed information about CVE-2025-30112

CVE:CVE-2025-30112
Description:On 70mai Dash Cam 1S devices, by connecting directly to the dashcam's network and accessing the API on port 80 and RTSP on port 554, an attacker can bypass the device authorization mechanism from the official mobile app that requires a user to physically press on the power button during a connection.
published:2025-03-24T17:15:21.550


Instruction: Please provide detailed information about CVE-2025-30205

CVE:CVE-2025-30205
Description:kanidim-provision is a helper utility that uses kanidm's API to provision users, groups and oauth2 systems. Prior to version 1.2.0, a faulty function intrumentation in the (optional) kanidm patches provided by kandim-provision will cause the provisioned admin credentials to be leaked to the system log. This only impacts users which both use the provided patches and provision their `admin` or `idm_admin` account credentials this way. No other credentials are affected. Users should recompile kanidm with the newest patchset from tag `v1.2.0` or higher. As a workaround, the user can set the log level `KANIDM_LOG_LEVEL` to any level higher than `info`, for example `warn`.
published:2025-03-24T17:15:21.667


Instruction: Please provide detailed information about CVE-2025-30208

CVE:CVE-2025-30208
Description:Vite, a provider of frontend development tooling, has a vulnerability in versions prior to 6.2.3, 6.1.2, 6.0.12, 5.4.15, and 4.5.10. `@fs` denies access to files outside of Vite serving allow list. Adding `?raw??` or `?import&raw??` to the URL bypasses this limitation and returns the file content if it exists. This bypass exists because trailing separators such as `?` are removed in several places, but are not accounted for in query string regexes. The contents of arbitrary files can be returned to the browser. Only apps explicitly exposing the Vite dev server to the network (using `--host` or `server.host` config option) are affected. Versions 6.2.3, 6.1.2, 6.0.12, 5.4.15, and 4.5.10 fix the issue.
published:2025-03-24T17:15:21.820


Instruction: Please provide detailed information about CVE-2025-22223

CVE:CVE-2025-22223
Description:Spring Security 6.4.0 - 6.4.3 may not correctly locate method security annotations on parameterized types or methods. This may cause an authorization bypass.   You are not affected if you are not using @EnableMethodSecurity, or you do not have method security annotations on parameterized types or methods, or all method security annotations are attached to target methods
published:2025-03-24T18:15:22.673


Instruction: Please provide detailed information about CVE-2025-2706

CVE:CVE-2025-2706
Description:A vulnerability classified as critical was found in Digiwin ERP 5.0.1. Affected by this vulnerability is an unknown functionality of the file /Api/TinyMce/UploadAjaxAPI.ashx. The manipulation of the argument File leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-03-24T19:15:50.497


Instruction: Please provide detailed information about CVE-2025-2707

CVE:CVE-2025-2707
Description:A vulnerability, which was classified as critical, has been found in zhijiantianya ruoyi-vue-pro 2.4.1. Affected by this issue is some unknown functionality of the file /app-api/infra/file/upload of the component Front-End Store Interface. The manipulation of the argument path leads to path traversal. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-03-24T19:15:50.963


Instruction: Please provide detailed information about CVE-2025-2746

CVE:CVE-2025-2746
Description:An authentication bypass vulnerability in Kentico Xperience allows authentication bypass via the Staging Sync Server password handling of empty SHA1 usernames in digest authentication. Authentication bypass allows an attacker to control administrative objects.This issue affects Xperience through 13.0.172.
published:2025-03-24T19:15:51.460


Instruction: Please provide detailed information about CVE-2025-2747

CVE:CVE-2025-2747
Description:An authentication bypass vulnerability in Kentico Xperience allows authentication bypass via the Staging Sync Server component password handling for the server defined None type. Authentication bypass allows an attacker to control administrative objects.This issue affects Xperience through 13.0.178.
published:2025-03-24T19:15:51.967


Instruction: Please provide detailed information about CVE-2025-2748

CVE:CVE-2025-2748
Description:The Kentico Xperience application does not fully validate or filter files uploaded via the multiple-file upload functionality, which allows for stored XSS.This issue affects Kentico Xperience through 13.0.178.
published:2025-03-24T19:15:52.270


Instruction: Please provide detailed information about CVE-2025-2749

CVE:CVE-2025-2749
Description:An authenticated remote code execution in Kentico Xperience allows authenticated users Staging Sync Server to upload arbitrary data to path relative locations. This results in path traversal and arbitrary file upload, including content that can be executed server side leading to remote code execution.This issue affects Kentico Xperience through 13.0.178.
published:2025-03-24T19:15:52.400


Instruction: Please provide detailed information about CVE-2025-30162

CVE:CVE-2025-30162
Description:Cilium is a networking, observability, and security solution with an eBPF-based dataplane. For Cilium users who use Gateway API for Ingress for some services and use LB-IPAM or BGP for LB Service implementation and use network policies to block egress traffic from workloads in a namespace to workloads in other namespaces, egress traffic from workloads covered by such network policies to LoadBalancers configured by `Gateway` resources will incorrectly be allowed. LoadBalancer resources not deployed via a Gateway API configuration are not affected by this issue. This issue affects: Cilium v1.15 between v1.15.0 and v1.15.14 inclusive, v1.16 between v1.16.0 and v1.16.7 inclusive, and v1.17 between v1.17.0 and v1.17.1 inclusive. This issue is fixed in Cilium v1.15.15, v1.16.8, and v1.17.2. A Clusterwide Cilium Network Policy can be used to work around this issue for users who are unable to upgrade.
published:2025-03-24T19:15:52.767


Instruction: Please provide detailed information about CVE-2025-30163

CVE:CVE-2025-30163
Description:Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Node based network policies (`fromNodes` and `toNodes`) will incorrectly permit traffic to/from non-node endpoints that share the labels specified in `fromNodes` and `toNodes` sections of network policies. Node based network policy is disabled by default in Cilium. This issue affects: Cilium v1.16 between v1.16.0 and v1.16.7 inclusive and v1.17 between v1.17.0 and v1.17.1 inclusive. This issue is fixed in Cilium v1.16.8 and v1.17.2. Users can work around this issue by ensuring that the labels used in `fromNodes` and `toNodes` fields are used exclusively by nodes and not by other endpoints.
published:2025-03-24T19:15:52.937


Instruction: Please provide detailed information about CVE-2025-2231

CVE:CVE-2025-2231
Description:PDF-XChange Editor RTF File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.  The specific flaw exists within the parsing of RTF files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-25473.
published:2025-03-24T20:15:18.370