Instruction: Please provide detailed information about CVE-2025-0168

CVE:CVE-2025-0168
Description:A vulnerability classified as critical has been found in code-projects Job Recruitment 1.0. This affects an unknown part of the file /_parse/_feedback_system.php. The manipulation of the argument person leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
published:2025-01-01T14:15:23.590


Instruction: Please provide detailed information about CVE-2025-22214

CVE:CVE-2025-22214
Description:Landray EIS 2001 through 2006 allows Message/fi_message_receiver.aspx?replyid= SQL injection.
published:2025-01-02T04:15:06.277


Instruction: Please provide detailed information about CVE-2025-0171

CVE:CVE-2025-0171
Description:A vulnerability, which was classified as critical, was found in code-projects Chat System 1.0. Affected is an unknown function of the file /admin/deleteuser.php. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
published:2025-01-02T15:15:25.550


Instruction: Please provide detailed information about CVE-2025-0172

CVE:CVE-2025-0172
Description:A vulnerability has been found in code-projects Chat System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin/deleteroom.php. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
published:2025-01-02T16:15:09.103


Instruction: Please provide detailed information about CVE-2025-0173

CVE:CVE-2025-0173
Description:A vulnerability was found in SourceCodester Online Eyewear Shop 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /orders/view_order.php. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
published:2025-01-02T18:15:21.630


Instruction: Please provide detailed information about CVE-2025-0174

CVE:CVE-2025-0174
Description:A vulnerability was found in code-projects Point of Sales and Inventory Management System 1.0. It has been classified as critical. This affects an unknown part of the file /user/search_result2.php of the component Parameter Handler. The manipulation of the argument search leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
published:2025-01-03T01:15:08.100


Instruction: Please provide detailed information about CVE-2025-0175

CVE:CVE-2025-0175
Description:A vulnerability was found in code-projects Online Shop 1.0. It has been declared as problematic. This vulnerability affects unknown code of the file /view.php. The manipulation of the argument name/details leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
published:2025-01-03T01:15:08.263


Instruction: Please provide detailed information about CVE-2025-0176

CVE:CVE-2025-0176
Description:A vulnerability was found in code-projects Point of Sales and Inventory Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /user/add_cart.php. The manipulation of the argument id/qty leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
published:2025-01-03T02:15:07.870


Instruction: Please provide detailed information about CVE-2025-22275

CVE:CVE-2025-22275
Description:iTerm2 3.5.6 through 3.5.10 before 3.5.11 sometimes allows remote attackers to obtain sensitive information from terminal commands by reading the /tmp/framer.txt file. This can occur for certain it2ssh and SSH Integration configurations, during remote logins to hosts that have a common Python installation.
published:2025-01-03T05:15:08.243


Instruction: Please provide detailed information about CVE-2025-21609

CVE:CVE-2025-21609
Description:SiYuan is self-hosted, open source personal knowledge management software. SiYuan Note version 3.1.18 has an arbitrary file deletion vulnerability. The vulnerability exists in the `POST /api/history/getDocHistoryContent` endpoint. An attacker can craft a payload to exploit this vulnerability, resulting in the deletion of arbitrary files on the server. Commit d9887aeec1b27073bec66299a9a4181dc42969f3 fixes this vulnerability and is expected to be available in version 3.1.19.
published:2025-01-03T17:15:09.147


Instruction: Please provide detailed information about CVE-2025-21610

CVE:CVE-2025-21610
Description:Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Versions prior to 2.1.12 are vulnerable to cross-site scripting when pasting malicious code in the link field. An attacker could trick the user to copy&paste a malicious `javascript:` URL as a link that would execute arbitrary JavaScript code within the context of the user's session, potentially leading to unauthorized actions being performed or sensitive information being disclosed. Users should upgrade to Trix editor version 2.1.12 or later to receive a patch. In addition to upgrading, affected users can disallow browsers that don't support a Content Security Policy (CSP) as a workaround for this and other cross-site scripting vulnerabilities. Set CSP policies such as script-src 'self' to ensure that only scripts hosted on the same origin are executed, and explicitly prohibit inline scripts using script-src-elem.
published:2025-01-03T17:15:09.290


Instruction: Please provide detailed information about CVE-2025-0195

CVE:CVE-2025-0195
Description:A vulnerability was found in code-projects Point of Sales and Inventory Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /user/del_product.php. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
published:2025-01-03T18:15:17.317


Instruction: Please provide detailed information about CVE-2025-0196

CVE:CVE-2025-0196
Description:A vulnerability classified as critical has been found in code-projects Point of Sales and Inventory Management System 1.0. This affects an unknown part of the file /user/plist.php. The manipulation of the argument cat leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
published:2025-01-03T19:15:12.793


Instruction: Please provide detailed information about CVE-2025-0197

CVE:CVE-2025-0197
Description:A vulnerability classified as critical was found in code-projects Point of Sales and Inventory Management System 1.0. This vulnerability affects unknown code of the file /user/search.php. The manipulation of the argument name leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
published:2025-01-03T20:15:28.873


Instruction: Please provide detailed information about CVE-2025-0198

CVE:CVE-2025-0198
Description:A vulnerability, which was classified as critical, has been found in code-projects Point of Sales and Inventory Management System 1.0. This issue affects some unknown processing of the file /user/search_result.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
published:2025-01-03T21:15:14.053


Instruction: Please provide detailed information about CVE-2025-22376

CVE:CVE-2025-22376
Description:In Net::OAuth::Client in the Net::OAuth package before 0.29 for Perl, the default nonce is a 32-bit integer generated from the built-in rand() function, which is not cryptographically strong.
published:2025-01-03T22:15:07.917


Instruction: Please provide detailed information about CVE-2025-0199

CVE:CVE-2025-0199
Description:A vulnerability, which was classified as critical, was found in code-projects Point of Sales and Inventory Management System 1.0. Affected is an unknown function of the file /user/minus_cart.php. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
published:2025-01-03T23:15:08.707


Instruction: Please provide detailed information about CVE-2025-22383

CVE:CVE-2025-22383
Description:An issue was discovered in Optimizely Configured Commerce before 5.2.2408. A medium-severity input validation issue exists in the Commerce B2B application, affecting the Contact Us functionality. This allows visitors to send e-mail messages that could contain unfiltered HTML markup in specific scenarios.
published:2025-01-04T02:15:06.797


Instruction: Please provide detailed information about CVE-2025-22384

CVE:CVE-2025-22384
Description:An issue was discovered in Optimizely Configured Commerce before 5.2.2408. A medium-severity issue concerning business logic exists in the Commerce B2B application, which allows storefront visitors to purchase discontinued products in specific scenarios where requests are altered before reaching the server.
published:2025-01-04T02:15:06.937


Instruction: Please provide detailed information about CVE-2025-22385

CVE:CVE-2025-22385
Description:An issue was discovered in Optimizely Configured Commerce before 5.2.2408. For newly created accounts, the Commerce B2B application does not require email confirmation. This medium-severity issue allows the mass creation of accounts. This could affect database storage; also, non-requested storefront accounts can be created on behalf of visitors.
published:2025-01-04T02:15:07.080


Instruction: Please provide detailed information about CVE-2025-22386

CVE:CVE-2025-22386
Description:An issue was discovered in Optimizely Configured Commerce before 5.2.2408. A medium-severity session issue exists in the Commerce B2B application, affecting the longevity of active sessions in the storefront. This allows session tokens tied to logged-out sessions to still be active and usable.
published:2025-01-04T02:15:07.230


Instruction: Please provide detailed information about CVE-2025-22387

CVE:CVE-2025-22387
Description:An issue was discovered in Optimizely Configured Commerce before 5.2.2408. A medium-severity issue exists in requests for resources where the session token is submitted as a URL parameter. This exposes information about the authenticated session, which can be leveraged for session hijacking.
published:2025-01-04T02:15:07.343


Instruction: Please provide detailed information about CVE-2025-22388

CVE:CVE-2025-22388
Description:An issue was discovered in Optimizely EPiServer.CMS.Core before 12.22.0. A high-severity Stored Cross-Site Scripting (XSS) vulnerability exists in the CMS, allowing malicious actors to inject and execute arbitrary JavaScript code, potentially compromising user data, escalating privileges, or executing unauthorized actions. The issue exists in multiple areas, including content editing, link management, and file uploads.
published:2025-01-04T02:15:07.480


Instruction: Please provide detailed information about CVE-2025-22389

CVE:CVE-2025-22389
Description:An issue was discovered in Optimizely EPiServer.CMS.Core before 12.32.0. A medium-severity vulnerability exists in the CMS, where the application does not properly validate uploaded files. This allows the upload of potentially malicious file types, including .docm .html. When accessed by application users, these files can be used to execute malicious actions or compromise users' systems.
published:2025-01-04T02:15:07.600


Instruction: Please provide detailed information about CVE-2025-22390

CVE:CVE-2025-22390
Description:An issue was discovered in Optimizely EPiServer.CMS.Core before 12.32.0. A medium-severity vulnerability exists in the CMS due to insufficient enforcement of password complexity requirements. The application permits users to set passwords with a minimum length of 6 characters, lacking adequate complexity to resist modern attack techniques such as password spraying or offline password cracking.
published:2025-01-04T02:15:07.747


Instruction: Please provide detailed information about CVE-2025-0200

CVE:CVE-2025-0200
Description:A vulnerability has been found in code-projects Point of Sales and Inventory Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /user/search_num.php. The manipulation of the argument search leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
published:2025-01-04T03:15:07.020


Instruction: Please provide detailed information about CVE-2025-0201

CVE:CVE-2025-0201
Description:A vulnerability was found in code-projects Point of Sales and Inventory Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /user/update_account.php. The manipulation of the argument username leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
published:2025-01-04T04:15:05.620


Instruction: Please provide detailed information about CVE-2025-0202

CVE:CVE-2025-0202
Description:A vulnerability was found in TCS BaNCS 10. It has been classified as problematic. This affects an unknown part of the file /REPORTS/REPORTS_SHOW_FILE.jsp. The manipulation of the argument FilePath leads to file inclusion. The real existence of this vulnerability is still doubted at the moment.
published:2025-01-04T05:15:07.660


Instruction: Please provide detailed information about CVE-2025-0203

CVE:CVE-2025-0203
Description:A vulnerability was found in code-projects Student Management System 1.0. It has been declared as critical. This vulnerability affects the function showSubject1 of the file /config/DbFunction.php. The manipulation of the argument sid leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.
published:2025-01-04T07:15:18.153


Instruction: Please provide detailed information about CVE-2025-0204

CVE:CVE-2025-0204
Description:A vulnerability was found in code-projects Online Shoe Store 1.0. It has been rated as critical. This issue affects some unknown processing of the file /details.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
published:2025-01-04T08:15:06.923


Instruction: Please provide detailed information about CVE-2025-0205

CVE:CVE-2025-0205
Description:A vulnerability classified as critical has been found in code-projects Online Shoe Store 1.0. Affected is an unknown function of the file /details2.php. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
published:2025-01-04T09:15:06.280


Instruction: Please provide detailed information about CVE-2025-0206

CVE:CVE-2025-0206
Description:A vulnerability classified as critical was found in code-projects Online Shoe Store 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/index.php. The manipulation leads to improper access controls. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
published:2025-01-04T12:15:24.830


Instruction: Please provide detailed information about CVE-2025-0207

CVE:CVE-2025-0207
Description:A vulnerability, which was classified as critical, has been found in code-projects Online Shoe Store 1.0. Affected by this issue is some unknown functionality of the file /function/login.php. The manipulation of the argument password leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
published:2025-01-04T13:15:07.383


Instruction: Please provide detailed information about CVE-2025-0208

CVE:CVE-2025-0208
Description:A vulnerability, which was classified as critical, was found in code-projects Online Shoe Store 1.0. This affects an unknown part of the file /summary.php. The manipulation of the argument tid leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
published:2025-01-04T13:15:07.557


Instruction: Please provide detailed information about CVE-2025-0210

CVE:CVE-2025-0210
Description:A vulnerability has been found in Campcodes School Faculty Scheduling System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin/ajax.php?action=login. The manipulation of the argument username leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
published:2025-01-04T14:15:22.590


Instruction: Please provide detailed information about CVE-2025-0211

CVE:CVE-2025-0211
Description:A vulnerability was found in Campcodes School Faculty Scheduling System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/index.php. The manipulation of the argument page leads to file inclusion. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
published:2025-01-04T15:15:07.277


Instruction: Please provide detailed information about CVE-2025-0212

CVE:CVE-2025-0212
Description:A vulnerability was found in Campcodes Student Grading System 1.0. It has been classified as critical. This affects an unknown part of the file /view_students.php. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
published:2025-01-04T16:15:23.003


Instruction: Please provide detailed information about CVE-2025-0213

CVE:CVE-2025-0213
Description:A vulnerability was found in Campcodes Project Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /forms/update_forms.php?action=change_pic2&id=4. The manipulation of the argument file leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
published:2025-01-04T17:15:06.743


Instruction: Please provide detailed information about CVE-2025-0214

CVE:CVE-2025-0214
Description:A vulnerability was found in TMD Custom Header Menu 4.0.0.1 on OpenCart. It has been rated as problematic. This issue affects some unknown processing of the file /admin/index.php. The manipulation of the argument headermenu_id leads to sql injection. The attack may be initiated remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component.
published:2025-01-04T17:15:07.507


Instruction: Please provide detailed information about CVE-2025-0219

CVE:CVE-2025-0219
Description:A vulnerability, which was classified as problematic, has been found in Trimble SPS851 488.01. Affected by this issue is some unknown functionality of the component Receiver Status Identity Tab. The manipulation of the argument System Name leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-01-05T06:15:05.183


Instruction: Please provide detailed information about CVE-2025-0220

CVE:CVE-2025-0220
Description:A vulnerability, which was classified as problematic, was found in Trimble SPS851 488.01. This affects an unknown part of the component Ethernet Configuration Menu. The manipulation of the argument Hostname leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-01-05T13:15:05.850


Instruction: Please provide detailed information about CVE-2025-0221

CVE:CVE-2025-0221
Description:A vulnerability has been found in IOBit Protected Folder up to 1.3.0 and classified as problematic. This vulnerability affects the function 0x22200c in the library pffilter.sys of the component IOCTL Handler. The manipulation leads to null pointer dereference. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-01-05T15:15:17.473


Instruction: Please provide detailed information about CVE-2025-0222

CVE:CVE-2025-0222
Description:A vulnerability was found in IObit Protected Folder up to 13.6.0.5 and classified as problematic. This issue affects the function 0x8001E000/0x8001E004 in the library IUProcessFilter.sys of the component IOCTL Handler. The manipulation leads to null pointer dereference. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-01-05T16:15:05.217


Instruction: Please provide detailed information about CVE-2025-0223

CVE:CVE-2025-0223
Description:A vulnerability was found in IObit Protected Folder up to 13.6.0.5. It has been classified as problematic. Affected is the function 0x8001E000/0x8001E00C/0x8001E004/0x8001E010 in the library IURegistryFilter.sys of the component IOCTL Handler. The manipulation leads to null pointer dereference. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-01-05T16:15:05.497


Instruction: Please provide detailed information about CVE-2025-0224

CVE:CVE-2025-0224
Description:A vulnerability was found in Provision-ISR SH-4050A-2, SH-4100A-2L(MM), SH-8100A-2L(MM), SH-16200A-2(1U), SH-16200A-5(1U) and NVR5-8200PX up to 20241220. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /server.js. The manipulation leads to information disclosure. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
published:2025-01-05T17:15:06.027


Instruction: Please provide detailed information about CVE-2025-0225

CVE:CVE-2025-0225
Description:A vulnerability classified as problematic was found in Tsinghua Unigroup Electronic Archives System 3.2.210802(62532). Affected by this vulnerability is an unknown functionality of the file /setting/ClassFy/exampleDownload.html. The manipulation of the argument name leads to path traversal: '/../filedir'. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
published:2025-01-05T17:15:06.620


Instruction: Please provide detailed information about CVE-2025-0226

CVE:CVE-2025-0226
Description:A vulnerability, which was classified as problematic, has been found in Tsinghua Unigroup Electronic Archives System 3.2.210802(62532). Affected by this issue is the function download of the file /collect/PortV4/downLoad.html. The manipulation of the argument path leads to information disclosure. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
published:2025-01-05T18:15:05.573


Instruction: Please provide detailed information about CVE-2025-0227

CVE:CVE-2025-0227
Description:A vulnerability, which was classified as problematic, was found in Tsinghua Unigroup Electronic Archives System 3.2.210802(62532). This affects an unknown part of the file /Logs/Annals/downLoad.html. The manipulation of the argument path leads to information disclosure. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
published:2025-01-05T18:15:06.570


Instruction: Please provide detailed information about CVE-2025-0228

CVE:CVE-2025-0228
Description:A vulnerability has been found in code-projects Local Storage Todo App 1.0 and classified as problematic. This vulnerability affects unknown code of the file /js-todo-app/index.html. The manipulation of the argument Add leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
published:2025-01-05T19:15:06.320


Instruction: Please provide detailed information about CVE-2025-0229

CVE:CVE-2025-0229
Description:A vulnerability, which was classified as critical, has been found in code-projects Travel Management System 1.0. This issue affects some unknown processing of the file /enquiry.php. The manipulation of the argument pid/t1/t2/t3/t4/t5/t6/t7 leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
published:2025-01-05T20:15:05.383


Instruction: Please provide detailed information about CVE-2025-0230

CVE:CVE-2025-0230
Description:A vulnerability, which was classified as critical, was found in code-projects Responsive Hotel Site 1.0. Affected is an unknown function of the file /admin/print.php. The manipulation of the argument pid leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
published:2025-01-05T21:15:06.267


Instruction: Please provide detailed information about CVE-2025-0231

CVE:CVE-2025-0231
Description:A vulnerability has been found in Codezips Gym Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /dashboard/admin/submit_payments.php. The manipulation of the argument m_id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
published:2025-01-05T22:15:05.540


Instruction: Please provide detailed information about CVE-2025-0232

CVE:CVE-2025-0232
Description:A vulnerability was found in Codezips Blood Bank Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /successadmin.php. The manipulation of the argument psw leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
published:2025-01-05T22:15:05.767


Instruction: Please provide detailed information about CVE-2025-0233

CVE:CVE-2025-0233
Description:A vulnerability was found in Codezips Project Management System 1.0. It has been classified as critical. This affects an unknown part of the file /pages/forms/course.php. The manipulation of the argument course_name leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
published:2025-01-05T23:15:07.320


Instruction: Please provide detailed information about CVE-2025-21604

CVE:CVE-2025-21604
Description:LangChain4j-AIDeepin is a Retrieval enhancement generation (RAG) project. Prior to 3.5.0, LangChain4j-AIDeepin uses MD5 to hash files, which may cause file upload conflicts. This issue is fixed in 3.5.0.
published:2025-01-06T16:15:30.927


Instruction: Please provide detailed information about CVE-2025-21611

CVE:CVE-2025-21611
Description:tgstation-server is a production scale tool for BYOND server management. Prior to 6.12.3, roles used to authorize API methods were incorrectly OR'd instead of AND'ed with the role used to determine if a user was enabled. This allows enabled users access to most, but not all, authorized actions regardless of their permissions. Notably, the WriteUsers right is unaffected so users may not use this bug to permanently elevate their account permissions. The fix is release in tgstation-server-v6.12.3.
published:2025-01-06T16:15:31.413


Instruction: Please provide detailed information about CVE-2025-21612

CVE:CVE-2025-21612
Description:TabberNeue is a MediaWiki extension that allows the wiki to create tabs. Prior to 2.7.2, TabberTransclude.php doesn't escape the user-supplied page name when outputting, so an XSS payload as the page name can be used here. This vulnerability is fixed in 2.7.2.
published:2025-01-06T16:15:31.633


Instruction: Please provide detailed information about CVE-2025-21613

CVE:CVE-2025-21613
Description:go-git is a highly extensible git implementation library written in pure Go. An argument injection vulnerability was discovered in go-git versions prior to v5.13. Successful exploitation of this vulnerability could allow an attacker to set arbitrary values to git-upload-pack flags. This only happens when the file transport protocol is being used, as that is the only protocol that shells out to git binaries. This vulnerability is fixed in 5.13.0.
published:2025-01-06T17:15:47.043


Instruction: Please provide detailed information about CVE-2025-21614

CVE:CVE-2025-21614
Description:go-git is a highly extensible git implementation library written in pure Go. A denial of service (DoS) vulnerability was discovered in go-git versions prior to v5.13. This vulnerability allows an attacker to perform denial of service attacks by providing specially crafted responses from a Git server which triggers resource exhaustion in go-git clients. Users running versions of go-git from v4 and above are recommended to upgrade to v5.13 in order to mitigate this vulnerability.
published:2025-01-06T17:15:47.310


Instruction: Please provide detailed information about CVE-2025-21615

CVE:CVE-2025-21615
Description:AAT (Another Activity Tracker) is a GPS-tracking application for tracking sportive activities, with emphasis on cycling. Versions lower than v1.26 of AAT are vulnerable to data exfiltration from malicious apps installed on the same device.
published:2025-01-06T17:15:47.510


Instruction: Please provide detailed information about CVE-2025-21618

CVE:CVE-2025-21618
Description:NiceGUI is an easy-to-use, Python-based UI framework. Prior to 2.9.1, authenticating with NiceGUI logged in the user for all browsers, including browsers in incognito mode. This vulnerability is fixed in 2.9.1.
published:2025-01-06T17:15:47.660


Instruction: Please provide detailed information about CVE-2025-21617

CVE:CVE-2025-21617
Description:Guzzle OAuth Subscriber signs Guzzle requests using OAuth 1.0. Prior to 0.8.1, Nonce generation does not use sufficient entropy nor a cryptographically secure pseudorandom source. This can leave servers vulnerable to replay attacks when TLS is not used. This vulnerability is fixed in 0.8.1.
published:2025-01-06T20:15:39.453


Instruction: Please provide detailed information about CVE-2025-21616

CVE:CVE-2025-21616
Description:Plane is an open-source project management tool. A cross-site scripting (XSS) vulnerability has been identified in Plane versions prior to 0.23. The vulnerability allows authenticated users to upload SVG files containing malicious JavaScript code as profile images, which gets executed in victims' browsers when viewing the profile image.
published:2025-01-06T22:15:11.023


Instruction: Please provide detailed information about CVE-2025-21620

CVE:CVE-2025-21620
Description:Deno is a JavaScript, TypeScript, and WebAssembly runtime with secure defaults. When you send a request with the Authorization header to one domain, and the response asks to redirect to a different domain, Deno'sfetch() redirect handling creates a follow-up redirect request that keeps the original Authorization header, leaking its content to that second domain. This vulnerability is fixed in 2.1.2.
published:2025-01-06T23:15:07.770


Instruction: Please provide detailed information about CVE-2025-22395

CVE:CVE-2025-22395
Description:Dell Update Package Framework, versions prior to 22.01.02, contain(s) a Local Privilege Escalation Vulnerability. A local low privileged attacker could potentially exploit this vulnerability, leading to the execution of arbitrary remote scripts on the server. Exploitation may lead to a denial of service by an attacker.
published:2025-01-07T03:15:06.047


Instruction: Please provide detailed information about CVE-2025-22261

CVE:CVE-2025-22261
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pixelite WP FullCalendar wp-fullcalendar allows Stored XSS.This issue affects WP FullCalendar: from n/a through 1.5.
published:2025-01-07T11:15:13.290


Instruction: Please provide detailed information about CVE-2025-22293

CVE:CVE-2025-22293
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Gutentor Gutentor allows DOM-Based XSS.This issue affects Gutentor: from n/a through 3.4.0.
published:2025-01-07T11:15:13.473


Instruction: Please provide detailed information about CVE-2025-22297

CVE:CVE-2025-22297
Description:Cross-Site Request Forgery (CSRF) vulnerability in AIpost AI WP Writer allows Cross Site Request Forgery.This issue affects AI WP Writer: from n/a through 3.8.4.4.
published:2025-01-07T11:15:13.630


Instruction: Please provide detailed information about CVE-2025-22298

CVE:CVE-2025-22298
Description:Missing Authorization vulnerability in Hive Support Hive Support – WordPress Help Desk allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Hive Support – WordPress Help Desk: from n/a through 1.1.6.
published:2025-01-07T11:15:13.783


Instruction: Please provide detailed information about CVE-2025-22299

CVE:CVE-2025-22299
Description:Missing Authorization vulnerability in spacecodes AI for SEO allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AI for SEO: from n/a through 1.2.9.
published:2025-01-07T11:15:13.943


Instruction: Please provide detailed information about CVE-2025-22300

CVE:CVE-2025-22300
Description:Cross-Site Request Forgery (CSRF) vulnerability in PixelYourSite PixelYourSite – Your smart PIXEL (TAG) Manager allows Cross Site Request Forgery.This issue affects PixelYourSite – Your smart PIXEL (TAG) Manager: from n/a through 10.0.1.2.
published:2025-01-07T11:15:14.100


Instruction: Please provide detailed information about CVE-2025-22301

CVE:CVE-2025-22301
Description:Cross-Site Request Forgery (CSRF) vulnerability in Stormhill Media MyBookTable Bookstore allows Cross Site Request Forgery.This issue affects MyBookTable Bookstore: from n/a through 3.5.3.
published:2025-01-07T11:15:14.240


Instruction: Please provide detailed information about CVE-2025-22302

CVE:CVE-2025-22302
Description:Missing Authorization vulnerability in WP Wand WP Wand allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Wand: from n/a through 1.2.5.
published:2025-01-07T11:15:14.387


Instruction: Please provide detailed information about CVE-2025-22303

CVE:CVE-2025-22303
Description:Insertion of Sensitive Information Into Sent Data vulnerability in brandtoss WP Mailster allows Retrieve Embedded Sensitive Data.This issue affects WP Mailster: from n/a through 1.8.17.0.
published:2025-01-07T11:15:14.563


Instruction: Please provide detailed information about CVE-2025-22304

CVE:CVE-2025-22304
Description:Missing Authorization vulnerability in osamaesh WP Visitor Statistics (Real Time Traffic) allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Visitor Statistics (Real Time Traffic): from n/a through 7.3.
published:2025-01-07T11:15:14.740


Instruction: Please provide detailed information about CVE-2025-22305

CVE:CVE-2025-22305
Description:Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in WP OnlineSupport, Essential Plugin Hero Banner Ultimate allows PHP Local File Inclusion.This issue affects Hero Banner Ultimate: from n/a through 1.4.2.
published:2025-01-07T11:15:14.907


Instruction: Please provide detailed information about CVE-2025-22308

CVE:CVE-2025-22308
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in inc2734 Smart Custom Fields allows Stored XSS.This issue affects Smart Custom Fields: from n/a through 5.0.0.
published:2025-01-07T11:15:15.043


Instruction: Please provide detailed information about CVE-2025-22309

CVE:CVE-2025-22309
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Steve D SpeakOut! Email Petitions allows DOM-Based XSS.This issue affects SpeakOut! Email Petitions: from n/a through 4.4.2.
published:2025-01-07T11:15:15.190


Instruction: Please provide detailed information about CVE-2025-22310

CVE:CVE-2025-22310
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in TemplatesNext TemplatesNext ToolKit allows Stored XSS.This issue affects TemplatesNext ToolKit: from n/a through 3.2.9.
published:2025-01-07T11:15:15.320


Instruction: Please provide detailed information about CVE-2025-22312

CVE:CVE-2025-22312
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThimPress Thim Elementor Kit allows DOM-Based XSS.This issue affects Thim Elementor Kit: from n/a through 1.2.8.
published:2025-01-07T11:15:15.480


Instruction: Please provide detailed information about CVE-2025-22315

CVE:CVE-2025-22315
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPDeveloper Typing Text allows Stored XSS.This issue affects Typing Text: from n/a through 1.2.7.
published:2025-01-07T11:15:15.627


Instruction: Please provide detailed information about CVE-2025-22316

CVE:CVE-2025-22316
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPBits WPBITS Addons For Elementor Page Builder allows Stored XSS.This issue affects WPBITS Addons For Elementor Page Builder: from n/a through 1.5.1.
published:2025-01-07T11:15:15.763


Instruction: Please provide detailed information about CVE-2025-22320

CVE:CVE-2025-22320
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ProductDyno ProductDyno allows Reflected XSS.This issue affects ProductDyno: from n/a through 1.0.24.
published:2025-01-07T11:15:15.910


Instruction: Please provide detailed information about CVE-2025-22321

CVE:CVE-2025-22321
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in TheInnovs ElementsCSS Addons for Elementor allows Stored XSS.This issue affects ElementsCSS Addons for Elementor: from n/a through 1.0.8.7.
published:2025-01-07T11:15:16.073


Instruction: Please provide detailed information about CVE-2025-22323

CVE:CVE-2025-22323
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jewel Theme Image Hover Effects for Elementor allows Stored XSS.This issue affects Image Hover Effects for Elementor: from n/a through 1.0.2.3.
published:2025-01-07T11:15:16.297


Instruction: Please provide detailed information about CVE-2025-22324

CVE:CVE-2025-22324
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Andon Ivanov OZ Canonical allows Reflected XSS.This issue affects OZ Canonical: from n/a through 0.5.
published:2025-01-07T11:15:16.437


Instruction: Please provide detailed information about CVE-2025-22325

CVE:CVE-2025-22325
Description:Cross-Site Request Forgery (CSRF) vulnerability in Nik Chankov Autocompleter allows Stored XSS.This issue affects Autocompleter: from n/a through 1.3.5.2.
published:2025-01-07T11:15:16.577


Instruction: Please provide detailed information about CVE-2025-22326

CVE:CVE-2025-22326
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 5centsCDN 5centsCDN allows Reflected XSS.This issue affects 5centsCDN: from n/a through 24.8.16.
published:2025-01-07T11:15:16.730


Instruction: Please provide detailed information about CVE-2025-22327

CVE:CVE-2025-22327
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Olaf Lederer EO4WP allows Stored XSS.This issue affects EO4WP: from n/a through 1.0.7.
published:2025-01-07T11:15:16.870


Instruction: Please provide detailed information about CVE-2025-22328

CVE:CVE-2025-22328
Description:Cross-Site Request Forgery (CSRF) vulnerability in Elevio Elevio allows Stored XSS.This issue affects Elevio: from n/a through 4.4.1.
published:2025-01-07T11:15:17.020


Instruction: Please provide detailed information about CVE-2025-22333

CVE:CVE-2025-22333
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Piotnet Piotnet Addons For Elementor allows Stored XSS.This issue affects Piotnet Addons For Elementor: from n/a through 2.4.31.
published:2025-01-07T11:15:17.160


Instruction: Please provide detailed information about CVE-2025-22336

CVE:CVE-2025-22336
Description:Cross-Site Request Forgery (CSRF) vulnerability in WordPress 智库 Wizhi Multi Filters by Wenprise allows Stored XSS.This issue affects Wizhi Multi Filters by Wenprise: from n/a through 1.8.6.
published:2025-01-07T11:15:17.313


Instruction: Please provide detailed information about CVE-2025-22339

CVE:CVE-2025-22339
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in aThemeArt Store Commerce allows DOM-Based XSS.This issue affects Store Commerce: from n/a through 1.2.3.
published:2025-01-07T11:15:17.463


Instruction: Please provide detailed information about CVE-2025-22342

CVE:CVE-2025-22342
Description:Cross-Site Request Forgery (CSRF) vulnerability in Jens Törnell WP Simple Sitemap allows Stored XSS.This issue affects WP Simple Sitemap: from n/a through 0.2.
published:2025-01-07T11:15:17.610


Instruction: Please provide detailed information about CVE-2025-22343

CVE:CVE-2025-22343
Description:Cross-Site Request Forgery (CSRF) vulnerability in Dennis Koot wpSOL allows Stored XSS.This issue affects wpSOL: from n/a through 1.2.0.
published:2025-01-07T11:15:17.743


Instruction: Please provide detailed information about CVE-2025-22347

CVE:CVE-2025-22347
Description:Cross-Site Request Forgery (CSRF) vulnerability in BannerSky.com BSK Forms Blacklist allows Blind SQL Injection.This issue affects BSK Forms Blacklist: from n/a through 3.9.
published:2025-01-07T11:15:17.897


Instruction: Please provide detailed information about CVE-2025-22348

CVE:CVE-2025-22348
Description:Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in RTO GmbH DynamicTags allows Blind SQL Injection.This issue affects DynamicTags: from n/a through 1.4.0.
published:2025-01-07T11:15:18.037


Instruction: Please provide detailed information about CVE-2025-22349

CVE:CVE-2025-22349
Description:Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Owen Cutajar & Hyder Jaffari WordPress Auction Plugin allows SQL Injection.This issue affects WordPress Auction Plugin: from n/a through 3.7.
published:2025-01-07T11:15:18.183


Instruction: Please provide detailed information about CVE-2025-22351

CVE:CVE-2025-22351
Description:Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in PenguinArts Contact Form 7 Database – CFDB7 allows SQL Injection.This issue affects Contact Form 7 Database – CFDB7: from n/a through 1.0.0.
published:2025-01-07T11:15:18.330


Instruction: Please provide detailed information about CVE-2025-22352

CVE:CVE-2025-22352
Description:Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ELEXtensions ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes allows Blind SQL Injection.This issue affects ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes: from n/a through 1.4.8.
published:2025-01-07T11:15:18.527


Instruction: Please provide detailed information about CVE-2025-22353

CVE:CVE-2025-22353
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Balcom-Vetillo Design, Inc. BVD Easy Gallery Manager allows Reflected XSS.This issue affects BVD Easy Gallery Manager: from n/a through 1.0.6.
published:2025-01-07T11:15:18.693


Instruction: Please provide detailed information about CVE-2025-22355

CVE:CVE-2025-22355
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in kiKx Kikx Simple Post Author Filter allows Reflected XSS.This issue affects Kikx Simple Post Author Filter: from n/a through 1.0.
published:2025-01-07T11:15:18.857


Instruction: Please provide detailed information about CVE-2025-22357

CVE:CVE-2025-22357
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Simple Plugins Target Notifications allows Reflected XSS.This issue affects Target Notifications: from n/a through 1.1.1.
published:2025-01-07T11:15:19.013


Instruction: Please provide detailed information about CVE-2025-22358

CVE:CVE-2025-22358
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Marcon Simone Wp advertising management allows Reflected XSS.This issue affects Wp advertising management: from n/a through 1.0.3.
published:2025-01-07T11:15:19.167


Instruction: Please provide detailed information about CVE-2025-22359

CVE:CVE-2025-22359
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PJFC SyncFields allows Reflected XSS.This issue affects SyncFields: from n/a through 2.1.
published:2025-01-07T11:15:19.310


Instruction: Please provide detailed information about CVE-2025-22362

CVE:CVE-2025-22362
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Powerfusion WPAchievements Free allows Stored XSS.This issue affects WPAchievements Free: from n/a through 1.2.0.
published:2025-01-07T11:15:19.453


Instruction: Please provide detailed information about CVE-2025-22364

CVE:CVE-2025-22364
Description:Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Service Shogun Ach Invoice App allows PHP Local File Inclusion.This issue affects Ach Invoice App: from n/a through 1.0.1.
published:2025-01-07T11:15:19.600


Instruction: Please provide detailed information about CVE-2025-0294

CVE:CVE-2025-0294
Description:A vulnerability has been found in SourceCodester Home Clean Services Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /public_html/admin/process.php. The manipulation of the argument type/length/business leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.
published:2025-01-07T14:15:24.277


Instruction: Please provide detailed information about CVE-2025-0295

CVE:CVE-2025-0295
Description:A vulnerability was found in code-projects Online Book Shop 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /booklist.php?subcatid=1. The manipulation of the argument subcatnm leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
published:2025-01-07T15:15:12.320


Instruction: Please provide detailed information about CVE-2025-0296

CVE:CVE-2025-0296
Description:A vulnerability was found in code-projects Online Book Shop 1.0. It has been classified as critical. This affects an unknown part of the file /booklist.php. The manipulation of the argument subcatid leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
published:2025-01-07T15:15:12.530


Instruction: Please provide detailed information about CVE-2025-0237

CVE:CVE-2025-0237
Description:The WebChannel API, which is used to transport various information across processes, did not check the sending principal but rather accepted the principal being sent. This could have led to privilege escalation attacks. This vulnerability affects Firefox < 134, Firefox ESR < 128.6, Thunderbird < 134, and Thunderbird < 128.6.
published:2025-01-07T16:15:38.323


Instruction: Please provide detailed information about CVE-2025-0238

CVE:CVE-2025-0238
Description:Assuming a controlled failed memory allocation, an attacker could have caused a use-after-free, leading to a potentially exploitable crash. This vulnerability affects Firefox < 134, Firefox ESR < 128.6, Firefox ESR < 115.19, Thunderbird < 134, and Thunderbird < 128.6.
published:2025-01-07T16:15:38.470


Instruction: Please provide detailed information about CVE-2025-0239

CVE:CVE-2025-0239
Description:When using Alt-Svc, ALPN did not properly validate certificates when the original server is redirecting to an insecure site. This vulnerability affects Firefox < 134, Firefox ESR < 128.6, Thunderbird < 134, and Thunderbird < 128.6.
published:2025-01-07T16:15:38.563


Instruction: Please provide detailed information about CVE-2025-0240

CVE:CVE-2025-0240
Description:Parsing a JavaScript module as JSON could, under some circumstances, cause cross-compartment access, which may result in a use-after-free. This vulnerability affects Firefox < 134, Firefox ESR < 128.6, Thunderbird < 134, and Thunderbird < 128.6.
published:2025-01-07T16:15:38.663


Instruction: Please provide detailed information about CVE-2025-0241

CVE:CVE-2025-0241
Description:When segmenting specially crafted text, segmentation would corrupt memory leading to a potentially exploitable crash. This vulnerability affects Firefox < 134, Firefox ESR < 128.6, Thunderbird < 134, and Thunderbird < 128.6.
published:2025-01-07T16:15:38.767


Instruction: Please provide detailed information about CVE-2025-0242

CVE:CVE-2025-0242
Description:Memory safety bugs present in Firefox 133, Thunderbird 133, Firefox ESR 115.18, Firefox ESR 128.5, Thunderbird 115.18, and Thunderbird 128.5. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 134, Firefox ESR < 128.6, Firefox ESR < 115.19, Thunderbird < 134, and Thunderbird < 128.6.
published:2025-01-07T16:15:38.860


Instruction: Please provide detailed information about CVE-2025-0243

CVE:CVE-2025-0243
Description:Memory safety bugs present in Firefox 133, Thunderbird 133, Firefox ESR 128.5, and Thunderbird 128.5. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 134, Firefox ESR < 128.6, Thunderbird < 134, and Thunderbird < 128.6.
published:2025-01-07T16:15:38.973


Instruction: Please provide detailed information about CVE-2025-0244

CVE:CVE-2025-0244
Description:When redirecting to an invalid protocol scheme, an attacker could spoof the address bar.  *Note: This issue only affected Android operating systems. Other operating systems are unaffected.* This vulnerability affects Firefox < 134.
published:2025-01-07T16:15:39.073


Instruction: Please provide detailed information about CVE-2025-0245

CVE:CVE-2025-0245
Description:Under certain circumstances, a user opt-in setting that Focus should require authentication before use could have been be bypassed. This vulnerability affects Firefox < 134.
published:2025-01-07T16:15:39.167


Instruction: Please provide detailed information about CVE-2025-0246

CVE:CVE-2025-0246
Description:When using an invalid protocol scheme, an attacker could spoof the address bar.  *Note: This issue only affected Android operating systems. Other operating systems are unaffected.* *Note: This issue is a different issue from CVE-2025-0244. This vulnerability affects Firefox < 134.
published:2025-01-07T16:15:39.260


Instruction: Please provide detailed information about CVE-2025-0247

CVE:CVE-2025-0247
Description:Memory safety bugs present in Firefox 133 and Thunderbird 133. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 134 and Thunderbird < 134.
published:2025-01-07T16:15:39.357


Instruction: Please provide detailed information about CVE-2025-0297

CVE:CVE-2025-0297
Description:A vulnerability was found in code-projects Online Book Shop 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /detail.php. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
published:2025-01-07T16:15:39.887


Instruction: Please provide detailed information about CVE-2025-0298

CVE:CVE-2025-0298
Description:A vulnerability was found in code-projects Online Book Shop 1.0. It has been rated as critical. This issue affects some unknown processing of the file /process_login.php. The manipulation of the argument usernm leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
published:2025-01-07T16:15:40.167


Instruction: Please provide detailed information about CVE-2025-21622

CVE:CVE-2025-21622
Description:ClipBucket V5 provides open source video hosting with PHP. During the user avatar upload workflow, a user can choose to upload and change their avatar at any time. During deletion, ClipBucket checks for the avatar_url as a filepath within the avatars subdirectory. If the URL path exists within the avatars directory, ClipBucket will delete it. There is no check for path traversal sequences in the provided user input (stored in the DB as avatar_url) therefore the final $file variable could be tainted with path traversal sequences. This leads to file deletion outside of the intended scope of the avatars folder. This vulnerability is fixed in 5.5.1 - 237.
published:2025-01-07T16:15:40.510


Instruction: Please provide detailed information about CVE-2025-21623

CVE:CVE-2025-21623
Description:ClipBucket V5 provides open source video hosting with PHP. Prior to 5.5.1 - 238, ClipBucket V5 allows unauthenticated attackers to change the template directory via a directory traversal, which results in a denial of service.
published:2025-01-07T16:15:40.690


Instruction: Please provide detailed information about CVE-2025-21624

CVE:CVE-2025-21624
Description:ClipBucket V5 provides open source video hosting with PHP. Prior to 5.5.1 - 239, a file upload vulnerability exists in the Manage Playlist functionality of the application, specifically surrounding the uploading of playlist cover images. Without proper checks, an attacker can upload a PHP script file instead of an image file, thus allowing a webshell or other malicious files to be stored and executed on the server. This attack vector exists in both the admin area and low-level user area. This vulnerability is fixed in 5.5.1 - 239.
published:2025-01-07T16:15:40.853


Instruction: Please provide detailed information about CVE-2025-22294

CVE:CVE-2025-22294
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Gravity Master Custom Field For WP Job Manager allows Reflected XSS.This issue affects Custom Field For WP Job Manager: from n/a through 1.3.
published:2025-01-07T16:15:41.137


Instruction: Please provide detailed information about CVE-2025-22335

CVE:CVE-2025-22335
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Md. Rajib Dewan Opencart Product in WP allows Reflected XSS.This issue affects Opencart Product in WP: from n/a through 1.0.1.
published:2025-01-07T16:15:42.703


Instruction: Please provide detailed information about CVE-2025-22338

CVE:CVE-2025-22338
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in lich_wang WP-tagMaker allows Reflected XSS.This issue affects WP-tagMaker: from n/a through 0.2.2.
published:2025-01-07T16:15:44.117


Instruction: Please provide detailed information about CVE-2025-22502

CVE:CVE-2025-22502
Description:Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Mindvalley MindValley Super PageMash allows SQL Injection.This issue affects MindValley Super PageMash: from n/a through 1.1.
published:2025-01-07T16:15:45.717


Instruction: Please provide detailed information about CVE-2025-22503

CVE:CVE-2025-22503
Description:Cross-Site Request Forgery (CSRF) vulnerability in Digital Zoom Studio Admin debug wordpress – enable debug allows Cross Site Request Forgery.This issue affects Admin debug wordpress – enable debug: from n/a through 1.0.13.
published:2025-01-07T16:15:45.877


Instruction: Please provide detailed information about CVE-2025-22507

CVE:CVE-2025-22507
Description:Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Benjamin Santalucia (ben@woow-fr.com) WPMU Prefill Post allows SQL Injection.This issue affects WPMU Prefill Post: from n/a through 1.02.
published:2025-01-07T16:15:46.040


Instruction: Please provide detailed information about CVE-2025-22511

CVE:CVE-2025-22511
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ella van Durpe Slides & Presentations allows Stored XSS.This issue affects Slides & Presentations: from n/a through 0.0.39.
published:2025-01-07T16:15:46.180


Instruction: Please provide detailed information about CVE-2025-22512

CVE:CVE-2025-22512
Description:Missing Authorization vulnerability in Sprout Apps Help Scout allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Help Scout: from n/a through 6.5.1.
published:2025-01-07T16:15:46.320


Instruction: Please provide detailed information about CVE-2025-22515

CVE:CVE-2025-22515
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Simon Chuang Show Google Analytics widget allows Stored XSS.This issue affects Show Google Analytics widget: from n/a through 1.5.4.
published:2025-01-07T16:15:46.497


Instruction: Please provide detailed information about CVE-2025-22516

CVE:CVE-2025-22516
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Hitesh Patel Metadata SEO allows Stored XSS.This issue affects Metadata SEO: from n/a through 2.3.
published:2025-01-07T16:15:46.653


Instruction: Please provide detailed information about CVE-2025-22517

CVE:CVE-2025-22517
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ben Huson List Pages at Depth allows Stored XSS.This issue affects List Pages at Depth: from n/a through 1.5.
published:2025-01-07T16:15:46.820


Instruction: Please provide detailed information about CVE-2025-22518

CVE:CVE-2025-22518
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in KentoThemes Justified Image Gallery allows Stored XSS.This issue affects Justified Image Gallery: from n/a through 1.0.
published:2025-01-07T16:15:46.990


Instruction: Please provide detailed information about CVE-2025-22519

CVE:CVE-2025-22519
Description:Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in eDoc Intelligence LLC eDoc Easy Tables allows SQL Injection.This issue affects eDoc Easy Tables: from n/a through 1.29.
published:2025-01-07T16:15:47.140


Instruction: Please provide detailed information about CVE-2025-22520

CVE:CVE-2025-22520
Description:Cross-Site Request Forgery (CSRF) vulnerability in Tock Tock Widget allows Cross Site Request Forgery.This issue affects Tock Widget: from n/a through 1.1.
published:2025-01-07T16:15:47.310


Instruction: Please provide detailed information about CVE-2025-22522

CVE:CVE-2025-22522
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Roya Khosravi SingSong allows Stored XSS.This issue affects SingSong: from n/a through 1.2.
published:2025-01-07T16:15:47.513


Instruction: Please provide detailed information about CVE-2025-22524

CVE:CVE-2025-22524
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in instaform.ir فرم ساز فرم افزار allows Stored XSS.This issue affects فرم ساز فرم افزار: from n/a through 2.0.
published:2025-01-07T16:15:47.680


Instruction: Please provide detailed information about CVE-2025-22525

CVE:CVE-2025-22525
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bharatkambariya Donation Block For PayPal allows Stored XSS.This issue affects Donation Block For PayPal: from n/a through 2.2.0.
published:2025-01-07T16:15:47.830


Instruction: Please provide detailed information about CVE-2025-22528

CVE:CVE-2025-22528
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Huurkalender Huurkalender WP allows Stored XSS.This issue affects Huurkalender WP: from n/a through 1.5.6.
published:2025-01-07T16:15:47.987


Instruction: Please provide detailed information about CVE-2025-22529

CVE:CVE-2025-22529
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WORDPRESTEEM WE Blocks allows Stored XSS.This issue affects WE Blocks: from n/a through 1.3.5.
published:2025-01-07T16:15:48.180


Instruction: Please provide detailed information about CVE-2025-22530

CVE:CVE-2025-22530
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SIOT 아임포트 결제버튼 생성 플러그인 allows Stored XSS.This issue affects 아임포트 결제버튼 생성 플러그인: from n/a through 1.1.19.
published:2025-01-07T16:15:48.350


Instruction: Please provide detailed information about CVE-2025-22531

CVE:CVE-2025-22531
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in M Bilal M Urdu Formatter – Shamil allows Stored XSS.This issue affects Urdu Formatter – Shamil: from n/a through 0.1.
published:2025-01-07T16:15:48.520


Instruction: Please provide detailed information about CVE-2025-22532

CVE:CVE-2025-22532
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nagy Sandor Simple Photo Sphere allows Stored XSS.This issue affects Simple Photo Sphere: from n/a through 0.0.10.
published:2025-01-07T16:15:48.747


Instruction: Please provide detailed information about CVE-2025-22533

CVE:CVE-2025-22533
Description:Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WOOEXIM.COM WOOEXIM allows SQL Injection.This issue affects WOOEXIM: from n/a through 5.0.0.
published:2025-01-07T16:15:48.980


Instruction: Please provide detailed information about CVE-2025-22534

CVE:CVE-2025-22534
Description:Missing Authorization vulnerability in Ella van Durpe Slides & Presentations allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Slides & Presentations: from n/a through 0.0.39.
published:2025-01-07T16:15:49.130


Instruction: Please provide detailed information about CVE-2025-22536

CVE:CVE-2025-22536
Description:Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Hiren Patel WP Music Player allows SQL Injection.This issue affects WP Music Player: from n/a through 1.3.
published:2025-01-07T16:15:49.293


Instruction: Please provide detailed information about CVE-2025-22538

CVE:CVE-2025-22538
Description:Cross-Site Request Forgery (CSRF) vulnerability in Ofek Nakar Virtual Bot allows Stored XSS.This issue affects Virtual Bot: from n/a through 1.0.0.
published:2025-01-07T16:15:49.460


Instruction: Please provide detailed information about CVE-2025-22541

CVE:CVE-2025-22541
Description:Missing Authorization vulnerability in Etruel Developments LLC WP Delete Post Copies allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Delete Post Copies: from n/a through 5.5.
published:2025-01-07T16:15:49.670


Instruction: Please provide detailed information about CVE-2025-22543

CVE:CVE-2025-22543
Description:Missing Authorization vulnerability in Beautiful Templates ST Gallery WP allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ST Gallery WP: from n/a through 1.0.8.
published:2025-01-07T16:15:49.830


Instruction: Please provide detailed information about CVE-2025-22544

CVE:CVE-2025-22544
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mind Doodle Mind Doodle Visual Sitemaps & Tasks allows Stored XSS.This issue affects Mind Doodle Visual Sitemaps & Tasks: from n/a through 1.6.
published:2025-01-07T16:15:50.003


Instruction: Please provide detailed information about CVE-2025-22545

CVE:CVE-2025-22545
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sw-galati.ro iframe to embed allows Stored XSS.This issue affects iframe to embed: from n/a through 1.2.
published:2025-01-07T16:15:50.140


Instruction: Please provide detailed information about CVE-2025-22546

CVE:CVE-2025-22546
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in One Plus Solution jQuery TwentyTwenty allows Stored XSS.This issue affects jQuery TwentyTwenty: from n/a through 1.0.
published:2025-01-07T16:15:50.300


Instruction: Please provide detailed information about CVE-2025-22547

CVE:CVE-2025-22547
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jay Krishnan G JK Html To Pdf allows Stored XSS.This issue affects JK Html To Pdf: from n/a through 1.0.0.
published:2025-01-07T16:15:50.463


Instruction: Please provide detailed information about CVE-2025-22548

CVE:CVE-2025-22548
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Frank Koenen ldap_login_password_and_role_manager allows Stored XSS.This issue affects ldap_login_password_and_role_manager: from n/a through 1.0.12.
published:2025-01-07T16:15:50.623


Instruction: Please provide detailed information about CVE-2025-22549

CVE:CVE-2025-22549
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pablo Cornehl WP Github allows Stored XSS.This issue affects WP Github: from n/a through 1.3.3.
published:2025-01-07T16:15:50.790


Instruction: Please provide detailed information about CVE-2025-22550

CVE:CVE-2025-22550
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AddFunc AddFunc Mobile Detect allows Stored XSS.This issue affects AddFunc Mobile Detect: from n/a through 3.1.
published:2025-01-07T16:15:50.960


Instruction: Please provide detailed information about CVE-2025-22551

CVE:CVE-2025-22551
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Julien Crego Boot-Modal allows Stored XSS.This issue affects Boot-Modal: from n/a through 1.9.1.
published:2025-01-07T16:15:51.127


Instruction: Please provide detailed information about CVE-2025-22552

CVE:CVE-2025-22552
Description:Cross-Site Request Forgery (CSRF) vulnerability in Jason Keeley, Bryan Nielsen Affiliate Disclosure Statement allows Cross Site Request Forgery.This issue affects Affiliate Disclosure Statement: from n/a through 0.3.
published:2025-01-07T16:15:51.277


Instruction: Please provide detailed information about CVE-2025-22554

CVE:CVE-2025-22554
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Eric Franklin Video Embed Optimizer allows Stored XSS.This issue affects Video Embed Optimizer: from n/a through 1.0.0.
published:2025-01-07T16:15:51.443


Instruction: Please provide detailed information about CVE-2025-22555

CVE:CVE-2025-22555
Description:Cross-Site Request Forgery (CSRF) vulnerability in Noel Jarencio. Smoothness Slider Shortcode allows Cross Site Request Forgery.This issue affects Smoothness Slider Shortcode: from n/a through v1.2.2.
published:2025-01-07T16:15:51.627


Instruction: Please provide detailed information about CVE-2025-22556

CVE:CVE-2025-22556
Description:Cross-Site Request Forgery (CSRF) vulnerability in Greg Whitehead Norse Rune Oracle Plugin allows Cross Site Request Forgery.This issue affects Norse Rune Oracle Plugin: from n/a through 1.4.1.
published:2025-01-07T16:15:51.780


Instruction: Please provide detailed information about CVE-2025-22557

CVE:CVE-2025-22557
Description:Cross-Site Request Forgery (CSRF) vulnerability in WPMagic News Publisher Autopilot allows Cross Site Request Forgery.This issue affects News Publisher Autopilot: from n/a through 2.1.4.
published:2025-01-07T16:15:51.920


Instruction: Please provide detailed information about CVE-2025-22558

CVE:CVE-2025-22558
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Marcus C. J. Hartmann mcjh button shortcode allows Stored XSS.This issue affects mcjh button shortcode: from n/a through 1.6.4.
published:2025-01-07T16:15:52.080


Instruction: Please provide detailed information about CVE-2025-22559

CVE:CVE-2025-22559
Description:Cross-Site Request Forgery (CSRF) vulnerability in Mario Mansour and Geoff Peters TubePress.NET allows Cross Site Request Forgery.This issue affects TubePress.NET: from n/a through 4.0.1.
published:2025-01-07T16:15:52.243


Instruction: Please provide detailed information about CVE-2025-22560

CVE:CVE-2025-22560
Description:Missing Authorization vulnerability in Saoshyant.1994 Saoshyant Page Builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Saoshyant Page Builder: from n/a through 3.8.
published:2025-01-07T16:15:52.380


Instruction: Please provide detailed information about CVE-2025-22562

CVE:CVE-2025-22562
Description:Cross-Site Request Forgery (CSRF) vulnerability in Jason Funk Title Experiments Free allows Cross Site Request Forgery.This issue affects Title Experiments Free: from n/a through 9.0.4.
published:2025-01-07T16:15:52.540


Instruction: Please provide detailed information about CVE-2025-22563

CVE:CVE-2025-22563
Description:Cross-Site Request Forgery (CSRF) vulnerability in Faaiq Pretty Url allows Cross Site Request Forgery.This issue affects Pretty Url: from n/a through 1.5.4.
published:2025-01-07T16:15:52.940


Instruction: Please provide detailed information about CVE-2025-22571

CVE:CVE-2025-22571
Description:Cross-Site Request Forgery (CSRF) vulnerability in Instabot Instabot allows Cross Site Request Forgery.This issue affects Instabot: from n/a through 1.10.
published:2025-01-07T16:15:53.187


Instruction: Please provide detailed information about CVE-2025-22572

CVE:CVE-2025-22572
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in brianmiyaji Legacy ePlayer allows Stored XSS.This issue affects Legacy ePlayer: from n/a through 0.9.9.
published:2025-01-07T16:15:53.357


Instruction: Please provide detailed information about CVE-2025-22573

CVE:CVE-2025-22573
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in copist Icons Enricher allows Stored XSS.This issue affects Icons Enricher: from n/a through 1.0.8.
published:2025-01-07T16:15:53.520


Instruction: Please provide detailed information about CVE-2025-22574

CVE:CVE-2025-22574
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Joe Motacek ICS Button allows Stored XSS.This issue affects ICS Button: from n/a through 0.6.
published:2025-01-07T16:15:53.667


Instruction: Please provide detailed information about CVE-2025-22577

CVE:CVE-2025-22577
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Damion Armentrout Able Player allows DOM-Based XSS.This issue affects Able Player: from n/a through 1.0.
published:2025-01-07T16:15:53.823


Instruction: Please provide detailed information about CVE-2025-22578

CVE:CVE-2025-22578
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AazzTech WP Cookie allows Stored XSS.This issue affects WP Cookie: from n/a through 1.0.0.
published:2025-01-07T16:15:53.970


Instruction: Please provide detailed information about CVE-2025-22579

CVE:CVE-2025-22579
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Arefly WP Header Notification allows Stored XSS.This issue affects WP Header Notification: from n/a through 1.2.7.
published:2025-01-07T16:15:54.130


Instruction: Please provide detailed information about CVE-2025-22580

CVE:CVE-2025-22580
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Biltorvet A/S Biltorvet Dealer Tools allows Stored XSS.This issue affects Biltorvet Dealer Tools: from n/a through 1.0.22.
published:2025-01-07T16:15:54.303


Instruction: Please provide detailed information about CVE-2025-22581

CVE:CVE-2025-22581
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bytephp Arcade Ready allows Stored XSS.This issue affects Arcade Ready: from n/a through 1.1.
published:2025-01-07T16:15:54.467


Instruction: Please provide detailed information about CVE-2025-22582

CVE:CVE-2025-22582
Description:Cross-Site Request Forgery (CSRF) vulnerability in Scott Nellé Uptime Robot allows Stored XSS.This issue affects Uptime Robot: from n/a through 0.1.3.
published:2025-01-07T16:15:54.640


Instruction: Please provide detailed information about CVE-2025-22584

CVE:CVE-2025-22584
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pluginspoint Timeline Pro allows DOM-Based XSS.This issue affects Timeline Pro: from n/a through 1.3.
published:2025-01-07T16:15:54.780


Instruction: Please provide detailed information about CVE-2025-22585

CVE:CVE-2025-22585
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themebon Ultimate Image Hover Effects allows DOM-Based XSS.This issue affects Ultimate Image Hover Effects: from n/a through 1.1.2.
published:2025-01-07T16:15:54.923


Instruction: Please provide detailed information about CVE-2025-22589

CVE:CVE-2025-22589
Description:Cross-Site Request Forgery (CSRF) vulnerability in bozdoz Quote Tweet allows Stored XSS.This issue affects Quote Tweet: from n/a through 0.7.
published:2025-01-07T16:15:55.053


Instruction: Please provide detailed information about CVE-2025-22590

CVE:CVE-2025-22590
Description:Cross-Site Request Forgery (CSRF) vulnerability in mmrs151 Prayer Times Anywhere allows Stored XSS.This issue affects Prayer Times Anywhere: from n/a through 2.0.1.
published:2025-01-07T16:15:55.200


Instruction: Please provide detailed information about CVE-2025-22591

CVE:CVE-2025-22591
Description:Missing Authorization vulnerability in Lenderd 1003 Mortgage Application allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects 1003 Mortgage Application: from n/a through 1.87.
published:2025-01-07T16:15:55.337


Instruction: Please provide detailed information about CVE-2025-22592

CVE:CVE-2025-22592
Description:Missing Authorization vulnerability in Lenderd 1003 Mortgage Application allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects 1003 Mortgage Application: from n/a through 1.87.
published:2025-01-07T16:15:55.470


Instruction: Please provide detailed information about CVE-2025-22593

CVE:CVE-2025-22593
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Burria Laika Pedigree Tree allows Stored XSS.This issue affects Laika Pedigree Tree: from n/a through 1.4.
published:2025-01-07T16:15:55.627


Instruction: Please provide detailed information about CVE-2025-0299

CVE:CVE-2025-0299
Description:A vulnerability classified as critical has been found in code-projects Online Book Shop 1.0. Affected is an unknown function of the file /search_result.php. The manipulation of the argument s leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
published:2025-01-07T17:15:31.903


Instruction: Please provide detailed information about CVE-2025-0300

CVE:CVE-2025-0300
Description:A vulnerability classified as critical was found in code-projects Online Book Shop 1.0. Affected by this vulnerability is an unknown functionality of the file /subcat.php. The manipulation of the argument cat leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
published:2025-01-07T17:15:32.090


Instruction: Please provide detailed information about CVE-2025-22296

CVE:CVE-2025-22296
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HashThemes Hash Elements.This issue affects Hash Elements: from n/a through 1.4.9.
published:2025-01-07T17:15:32.520


Instruction: Please provide detailed information about CVE-2025-22306

CVE:CVE-2025-22306
Description:Insertion of Sensitive Information into Externally-Accessible File or Directory vulnerability in Link Whisper Link Whisper Free.This issue affects Link Whisper Free: from n/a through 0.7.7.
published:2025-01-07T17:15:32.663


Instruction: Please provide detailed information about CVE-2025-22319

CVE:CVE-2025-22319
Description:Missing Authorization vulnerability in DearHive Social Media Share Buttons | MashShare.This issue affects Social Media Share Buttons | MashShare: from n/a through 4.0.47.
published:2025-01-07T17:15:32.810


Instruction: Please provide detailed information about CVE-2025-22334

CVE:CVE-2025-22334
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FilaThemes Education LMS allows Stored XSS.This issue affects Education LMS: from n/a through 0.0.7.
published:2025-01-07T17:15:32.953


Instruction: Please provide detailed information about CVE-2025-22350

CVE:CVE-2025-22350
Description:Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WpIndeed Ultimate Learning Pro allows SQL Injection.This issue affects Ultimate Learning Pro: from n/a through 3.9.
published:2025-01-07T17:15:33.093


Instruction: Please provide detailed information about CVE-2025-22354

CVE:CVE-2025-22354
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Code Themes Digi Store allows DOM-Based XSS.This issue affects Digi Store: from n/a through 1.1.4.
published:2025-01-07T17:15:33.230


Instruction: Please provide detailed information about CVE-2025-22363

CVE:CVE-2025-22363
Description:Missing Authorization vulnerability in ORION Allada T-shirt Designer for Woocommerce.This issue affects Allada T-shirt Designer for Woocommerce: from n/a through 1.1.
published:2025-01-07T17:15:33.377


Instruction: Please provide detailed information about CVE-2025-22365

CVE:CVE-2025-22365
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Eric McNiece EMC2 Alert Boxes allows Stored XSS.This issue affects EMC2 Alert Boxes: from n/a through 1.3.
published:2025-01-07T17:15:33.510


Instruction: Please provide detailed information about CVE-2025-22500

CVE:CVE-2025-22500
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ali Ali Alpha Price Table For Elementor allows DOM-Based XSS.This issue affects Alpha Price Table For Elementor: from n/a through 1.0.8.
published:2025-01-07T17:15:33.657


Instruction: Please provide detailed information about CVE-2025-22621

CVE:CVE-2025-22621
Description:In versions 1.0.67 and lower of the Splunk App for SOAR, the Splunk documentation for that app recommended adding the `admin_all_objects` capability to the `splunk_app_soar` role. This addition could lead to improper access control for a low-privileged user that does not hold the "admin"  Splunk roles.
published:2025-01-07T17:15:35.710


Instruction: Please provide detailed information about CVE-2025-0301

CVE:CVE-2025-0301
Description:A vulnerability, which was classified as problematic, has been found in code-projects Online Book Shop 1.0. Affected by this issue is some unknown functionality of the file /subcat.php. The manipulation of the argument catnm leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
published:2025-01-07T18:15:21.460


Instruction: Please provide detailed information about CVE-2025-0218

CVE:CVE-2025-0218
Description:When batch jobs are executed by pgAgent, a script is created in a temporary directory and then executed. In versions of pgAgent prior to 4.2.3, an insufficiently seeded random number generator is used when generating the directory name, leading to the possibility for a local attacker to pre-create the directory and thus prevent pgAgent from executing jobs, disrupting scheduled tasks.
published:2025-01-07T20:15:30.710


Instruction: Please provide detailed information about CVE-2025-22132

CVE:CVE-2025-22132
Description:WeGIA is a web manager for charitable institutions. A Cross-Site Scripting (XSS) vulnerability was identified in the file upload functionality of the WeGIA/html/socio/sistema/controller/controla_xlsx.php endpoint. By uploading a file containing malicious JavaScript code, an attacker can execute arbitrary scripts in the context of a victim's browser. This can lead to information theft, session hijacking, and other forms of client-side exploitation. This vulnerability is fixed in 3.2.7.
published:2025-01-07T22:15:31.590


Instruction: Please provide detailed information about CVE-2025-22133

CVE:CVE-2025-22133
Description:WeGIA is a web manager for charitable institutions. Prior to 3.2.8, a critical vulnerability was identified in the /WeGIA/html/socio/sistema/controller/controla_xlsx.php endpoint. The endpoint accepts file uploads without proper validation, allowing the upload of malicious files, such as .phar, which can then be executed by the server. This vulnerability is fixed in 3.2.8.
published:2025-01-07T22:15:31.740


Instruction: Please provide detailed information about CVE-2025-21603

CVE:CVE-2025-21603
Description:Cross-site scripting vulnerability exists in MZK-DP300N firmware versions 1.05 and earlier. If an attacker logs in to the affected product and manipulates the device settings, an arbitrary script may be executed on the logged-in user's web browser when accessing a crafted URL.
published:2025-01-08T04:15:08.407


Instruction: Please provide detailed information about CVE-2024-9673

CVE:CVE-2024-9673
Description:Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2025-22333. Reason: This candidate is a reservation duplicate of CVE-2025-22333. Notes: All CVE users should reference CVE-2025-22333 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
published:2025-01-08T07:15:27.980


Instruction: Please provide detailed information about CVE-2025-22215

CVE:CVE-2025-22215
Description:VMware Aria Automation contains a server-side request forgery (SSRF) vulnerability. A malicious actor with "Organization Member" access to Aria Automation may exploit this vulnerability enumerate internal services running on the host/network.
published:2025-01-08T07:15:28.180


Instruction: Please provide detailed information about CVE-2025-21102

CVE:CVE-2025-21102
Description:Dell VxRail, versions 7.0.000 through 7.0.532, contain(s) a Plaintext Storage of a Password vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Information exposure.
published:2025-01-08T12:15:22.850


Instruction: Please provide detailed information about CVE-2025-20123

CVE:CVE-2025-20123
Description:Multiple vulnerabilities in the web-based management interface of Cisco Crosswork Network Controller could allow an authenticated, remote attacker to conduct cross-site scripting (XSS) attacks against users of the interface of an affected system.

 These vulnerabilities exist because the web-based management interface does not properly validate user-supplied input. An attacker could exploit these vulnerabilities by inserting malicious data into specific data fields in the interface. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. To exploit these vulnerabilities, the attacker must have valid administrative credentials.
 Cisco has released software updates that address these vulnerabilities. There are no workarounds that address these vulnerabilities.
published:2025-01-08T16:15:38.150


Instruction: Please provide detailed information about CVE-2025-20126

CVE:CVE-2025-20126
Description:A vulnerability in certification validation routines of Cisco ThousandEyes Endpoint Agent for macOS and RoomOS could allow an unauthenticated, remote attacker to intercept or manipulate metrics information.

 This vulnerability exists because the affected software does not properly validate certificates for hosted metrics services. An on-path attacker could exploit this vulnerability by intercepting network traffic using a crafted certificate. A successful exploit could allow the attacker to masquerade as a trusted host and monitor or change communications between the remote metrics service and the vulnerable client.
published:2025-01-08T16:15:38.357


Instruction: Please provide detailed information about CVE-2025-22130

CVE:CVE-2025-22130
Description:Soft Serve is a self-hostable Git server for the command line. Prior to 0.8.2 , a path traversal attack allows existing non-admin users to access and take over other user's repositories. A malicious user then can modify, delete, and arbitrarily repositories as if they were an admin user without explicitly giving them permissions. This is patched in v0.8.2.
published:2025-01-08T16:15:38.543


Instruction: Please provide detailed information about CVE-2025-22136

CVE:CVE-2025-22136
Description:Tabby (formerly Terminus) is a highly configurable terminal emulator. Prior to 1.0.217 , Tabby enables several high-risk Electron Fuses, including RunAsNode, EnableNodeCliInspectArguments, and EnableNodeOptionsEnvironmentVariable. These fuses create potential code injection vectors even though the application is signed with hardened runtime and lacks dangerous entitlements such as com.apple.security.cs.disable-library-validation and com.apple.security.cs.allow-dyld-environment-variables. This vulnerability is fixed in 1.0.217.
published:2025-01-08T16:15:38.770


Instruction: Please provide detailed information about CVE-2025-22137

CVE:CVE-2025-22137
Description:Pingvin Share is a self-hosted file sharing platform and an alternative for WeTransfer. This vulnerability allows an authenticated or unauthenticated (if anonymous shares are allowed) user to overwrite arbitrary files on the server, including sensitive system files, via HTTP POST requests. The issue has been patched in version 1.4.0.
published:2025-01-08T16:15:38.920


Instruction: Please provide detailed information about CVE-2025-20166

CVE:CVE-2025-20166
Description:A vulnerability in the web-based management interface of Cisco Common Services Platform Collector (CSPC) could allow an authenticated, remote attacker to conduct cross-site scripting (XSS) attacks against a user of the interface.

 This vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affected system. An attacker could exploit this vulnerability by injecting malicious code into specific pages of the interface. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. To exploit this vulnerability, the attacker must have at least a low-privileged account on an affected device.
 Cisco has not released software updates that address this vulnerability. There are no workarounds that address this vulnerability.
published:2025-01-08T17:15:16.990


Instruction: Please provide detailed information about CVE-2025-20167

CVE:CVE-2025-20167
Description:A vulnerability in the web-based management interface of Cisco Common Services Platform Collector (CSPC) could allow an authenticated, remote attacker to conduct cross-site scripting (XSS) attacks against a user of the interface.

 This vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affected system. An attacker could exploit this vulnerability by injecting malicious code into specific pages of the interface. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. To exploit this vulnerability, the attacker must have at least a low-privileged account on an affected device.
 Cisco has not released software updates that address this vulnerability. There are no workarounds that address this vulnerability.
published:2025-01-08T17:15:17.163


Instruction: Please provide detailed information about CVE-2025-20168

CVE:CVE-2025-20168
Description:A vulnerability in the web-based management interface of Cisco Common Services Platform Collector (CSPC) could allow an authenticated, remote attacker to conduct cross-site scripting (XSS) attacks against a user of the interface.

 This vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affected system. An attacker could exploit this vulnerability by injecting malicious code into specific pages of the interface. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. To exploit this vulnerability, the attacker must have at least a low-privileged account on an affected device.
 Cisco has not released software updates that address this vulnerability. There are no workarounds that address this vulnerability.
published:2025-01-08T17:15:17.323


Instruction: Please provide detailed information about CVE-2025-21111

CVE:CVE-2025-21111
Description:Dell VxRail, versions 8.0.000 through 8.0.311, contain(s) a Plaintext Storage of a Password vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Information exposure.
published:2025-01-08T18:15:20.157


Instruction: Please provide detailed information about CVE-2025-0291

CVE:CVE-2025-0291
Description:Type Confusion in V8 in Google Chrome prior to 131.0.6778.264 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
published:2025-01-08T19:15:38.420


Instruction: Please provide detailed information about CVE-2025-22139

CVE:CVE-2025-22139
Description:WeGIA is a web manager for charitable institutions. A Reflected Cross-Site Scripting (XSS) vulnerability was identified in the configuracao_geral.php endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts in the msg_c parameter. This vulnerability is fixed in 3.2.8.
published:2025-01-08T19:15:38.717


Instruction: Please provide detailed information about CVE-2025-22140

CVE:CVE-2025-22140
Description:WeGIA is a web manager for charitable institutions. A SQL Injection vulnerability was identified in the /html/funcionario/dependente_listar_um.php endpoint, specifically in the id_dependente parameter. This vulnerability allows attackers to execute arbitrary SQL commands, compromising the confidentiality, integrity, and availability of the database. This vulnerability is fixed in 3.2.8.
published:2025-01-08T19:15:38.863


Instruction: Please provide detailed information about CVE-2025-22141

CVE:CVE-2025-22141
Description:WeGIA is a web manager for charitable institutions. A SQL Injection vulnerability was identified in the /dao/verificar_recursos_cargo.php endpoint, specifically in the cargo parameter. This vulnerability allows attackers to execute arbitrary SQL commands, compromising the confidentiality, integrity, and availability of the database. This vulnerability is fixed in 3.2.8.
published:2025-01-08T19:15:39.017


Instruction: Please provide detailed information about CVE-2025-0194

CVE:CVE-2025-0194
Description:An issue was discovered in GitLab CE/EE affecting all versions starting from 17.4 prior to 17.5.5, starting from 17.6 prior to 17.6.3, and starting from 17.7 prior to 17.7.1. Under certain conditions, access tokens may have been logged when API requests were made in a specific manner.
published:2025-01-08T20:15:29.193


Instruction: Please provide detailed information about CVE-2025-22143

CVE:CVE-2025-22143
Description:WeGIA is a web manager for charitable institutions. A Reflected Cross-Site Scripting (XSS) vulnerability was identified in the listar_permissoes.php endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts in the msg_e parameter. This vulnerability is fixed in 3.2.8.
published:2025-01-08T20:15:30.003


Instruction: Please provide detailed information about CVE-2025-22145

CVE:CVE-2025-22145
Description:Carbon is an international PHP extension for DateTime. Application passing unsanitized user input to Carbon::setLocale are at risk of arbitrary file include, if the application allows users to upload files with .php extension in an folder that allows include or require to read it, then they are at risk of arbitrary code ran on their servers. This vulnerability is fixed in 3.8.4 and 2.72.6.
published:2025-01-08T21:15:13.480


Instruction: Please provide detailed information about CVE-2025-0282

CVE:CVE-2025-0282
Description:A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7R1.2, and Ivanti Neurons for ZTA gateways before version 22.7R2.3 allows a remote unauthenticated attacker to achieve remote code execution.
published:2025-01-08T23:15:09.763


Instruction: Please provide detailed information about CVE-2025-0283

CVE:CVE-2025-0283
Description:A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7R1.2, and Ivanti Neurons for ZTA gateways before version 22.7R2.3 allows a local authenticated attacker to escalate their privileges.
published:2025-01-08T23:15:09.920


Instruction: Please provide detailed information about CVE-2025-0306

CVE:CVE-2025-0306
Description:A vulnerability was found in Ruby. The Ruby interpreter is vulnerable to the Marvin Attack. This attack allows the attacker to decrypt previously encrypted messages or forge signatures by exchanging a large number of messages with the vulnerable service.
published:2025-01-09T04:15:13.000


Instruction: Please provide detailed information about CVE-2025-0328

CVE:CVE-2025-0328
Description:A vulnerability, which was classified as critical, has been found in KaiYuanTong ECT Platform up to 2.0.0. Affected by this issue is some unknown functionality of the file /public/server/runCode.php of the component HTTP POST Request Handler. The manipulation of the argument code leads to command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-01-09T05:15:07.997


Instruction: Please provide detailed information about CVE-2025-0331

CVE:CVE-2025-0331
Description:A vulnerability, which was classified as critical, has been found in YunzMall up to 2.4.2. This issue affects the function changePwd of the file /app/platform/controllers/ResetpwdController.php of the component HTTP POST Request Handler. The manipulation of the argument pwd leads to weak password recovery. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-01-09T05:15:08.237


Instruction: Please provide detailed information about CVE-2025-0333

CVE:CVE-2025-0333
Description:A vulnerability, which was classified as critical, was found in leiyuxi cy-fast 1.0. Affected is the function listData of the file /sys/role/listData. The manipulation of the argument order leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
published:2025-01-09T05:15:08.453


Instruction: Please provide detailed information about CVE-2025-0334

CVE:CVE-2025-0334
Description:A vulnerability has been found in leiyuxi cy-fast 1.0 and classified as critical. Affected by this vulnerability is the function listData of the file /sys/user/listData. The manipulation of the argument order leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
published:2025-01-09T06:15:15.610