Instruction: Please provide detailed information about CVE-2025-24401

CVE:CVE-2025-24401
Description:Jenkins Folder-based Authorization Strategy Plugin 217.vd5b_18537403e and earlier does not verify that permissions configured to be granted are enabled, potentially allowing users formerly granted (typically optional permissions, like Overall/Manage) to access functionality they're no longer entitled to.
published:2025-01-22T17:15:14.027


Instruction: Please provide detailed information about CVE-2025-24402

CVE:CVE-2025-24402
Description:A cross-site request forgery (CSRF) vulnerability in Jenkins Azure Service Fabric Plugin 1.6 and earlier allows attackers to connect to a Service Fabric URL using attacker-specified credentials IDs obtained through another method.
published:2025-01-22T17:15:14.123


Instruction: Please provide detailed information about CVE-2025-24403

CVE:CVE-2025-24403
Description:A missing permission check in Jenkins Azure Service Fabric Plugin 1.6 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of Azure credentials stored in Jenkins.
published:2025-01-22T17:15:14.220


Instruction: Please provide detailed information about CVE-2025-0651

CVE:CVE-2025-0651
Description:Improper Privilege Management vulnerability in Cloudflare WARP on Windows allows File Manipulation.  User with a low system privileges  can create a set of symlinks inside the C:\ProgramData\Cloudflare\warp-diag-partials folder. After triggering the 'Reset all settings" option the WARP service will delete the files that the symlink was pointing to. Given the WARP service operates with System privileges this might lead to deleting files owned by the System user. This issue affects WARP: before 2024.12.492.0.
published:2025-01-22T18:15:20.363


Instruction: Please provide detailed information about CVE-2025-23047

CVE:CVE-2025-23047
Description:Cilium is a networking, observability, and security solution with an eBPF-based dataplane. An insecure default `Access-Control-Allow-Origin` header value could lead to sensitive data exposure for users of Cilium versions 1.14.0 through 1.14.7, 1.15.0 through 1.15.11, and 1.16.0 through 1.16.4 who deploy Hubble UI using either Cilium CLI or via the Cilium Helm chart. A user with access to a Hubble UI instance affected by this issue could leak configuration details about the Kubernetes cluster which Hubble UI is monitoring, including node names, IP addresses, and other metadata about workloads and the cluster networking configuration. In order for this vulnerability to be exploited, a victim would have to first visit a malicious page. This issue is fixed in Cilium v1.14.18, v1.15.12, and v1.16.5. As a workaround, users who deploy Hubble UI using the Cilium Helm chart directly can remove the CORS headers from the Helm template as shown in the patch from commit a3489f190ba6e87b5336ee685fb6c80b1270d06d.
published:2025-01-22T18:15:21.893


Instruction: Please provide detailed information about CVE-2025-0611

CVE:CVE-2025-0611
Description:Object corruption in V8 in Google Chrome prior to 132.0.6834.110 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
published:2025-01-22T20:15:30.860


Instruction: Please provide detailed information about CVE-2025-0612

CVE:CVE-2025-0612
Description:Out of bounds memory access in V8 in Google Chrome prior to 132.0.6834.110 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
published:2025-01-22T20:15:30.957


Instruction: Please provide detailed information about CVE-2025-24030

CVE:CVE-2025-24030
Description:Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. A user with access to the Kubernetes cluster can use a path traversal attack to execute Envoy Admin interface commands on proxies managed by any version of Envoy Gateway prior to 1.2.6. The admin interface can be used to terminate the Envoy process and extract the Envoy configuration (possibly containing confidential data). Version 1.2.6 fixes the issue. As a workaround, the `EnvoyProxy` API can be used to apply a bootstrap config patch that restricts access strictly to the prometheus stats endpoint. Find below an example of such a bootstrap patch.
published:2025-01-23T04:15:07.100


Instruction: Please provide detailed information about CVE-2025-24529

CVE:CVE-2025-24529
Description:An issue was discovered in phpMyAdmin 5.x before 5.2.2. An XSS vulnerability has been discovered for the Insert tab.
published:2025-01-23T06:15:27.710


Instruction: Please provide detailed information about CVE-2025-24530

CVE:CVE-2025-24530
Description:An issue was discovered in phpMyAdmin 5.x before 5.2.2. An XSS vulnerability has been discovered for the check tables feature. A crafted table or database name could be used for XSS.
published:2025-01-23T06:15:27.893


Instruction: Please provide detailed information about CVE-2025-0619

CVE:CVE-2025-0619
Description:Unsafe password recovery from configuration in M-Files Server before 25.1 allows a highly privileged user to recover external connector passwords
published:2025-01-23T11:15:10.700


Instruction: Please provide detailed information about CVE-2025-0635

CVE:CVE-2025-0635
Description:Denial of service condition in M-Files Server in versions before   25.1.14445.5 allows an unauthenticated user to consume computing resources in certain conditions.
published:2025-01-23T11:15:10.890


Instruction: Please provide detailed information about CVE-2025-0648

CVE:CVE-2025-0648
Description:Unexpected server crash in database driver in M-Files Server before 25.1.14445.5 and before 24.8 LTS SR3  allows a highly privileged attacker to cause denial of service via configuration change.
published:2025-01-23T11:15:11.030


Instruction: Please provide detailed information about CVE-2025-23006

CVE:CVE-2025-23006
Description:Pre-authentication deserialization of untrusted data vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) and Central Management Console (CMC), which in specific conditions could potentially enable a remote unauthenticated attacker to execute arbitrary OS commands.
published:2025-01-23T12:15:28.523


Instruction: Please provide detailed information about CVE-2025-0637

CVE:CVE-2025-0637
Description:It has been found that the Beta10 software does not provide for proper authorisation control in multiple areas of the application. This deficiency could allow a malicious actor, without authentication, to access private areas and/or areas intended for other roles. The vulnerability has been identified at least in the file or path ‘/app/tools.html’.
published:2025-01-23T16:15:36.617


Instruction: Please provide detailed information about CVE-2025-22264

CVE:CVE-2025-22264
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tarak Patel WP Query Creator allows Reflected XSS. This issue affects WP Query Creator: from n/a through 1.0.
published:2025-01-23T16:15:37.257


Instruction: Please provide detailed information about CVE-2025-22768

CVE:CVE-2025-22768
Description:Cross-Site Request Forgery (CSRF) vulnerability in Qwerty23 Rocket Media Library Mime Type allows Stored XSS. This issue affects Rocket Media Library Mime Type: from n/a through 2.1.0.
published:2025-01-23T16:15:37.403


Instruction: Please provide detailed information about CVE-2025-23540

CVE:CVE-2025-23540
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mohsin khan WP Front-end login and register allows Reflected XSS. This issue affects WP Front-end login and register: from n/a through 2.1.0.
published:2025-01-23T16:15:37.577


Instruction: Please provide detailed information about CVE-2025-23541

CVE:CVE-2025-23541
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in edmon Download, Downloads  allows Reflected XSS. This issue affects Download, Downloads : from n/a through 1.4.2.
published:2025-01-23T16:15:37.737


Instruction: Please provide detailed information about CVE-2025-23544

CVE:CVE-2025-23544
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in heart5 StatPressCN allows Reflected XSS. This issue affects StatPressCN: from n/a through 1.9.1.
published:2025-01-23T16:15:37.897


Instruction: Please provide detailed information about CVE-2025-23545

CVE:CVE-2025-23545
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Navnish Bhardwaj WP Social Broadcast allows Reflected XSS. This issue affects WP Social Broadcast: from n/a through 1.0.0.
published:2025-01-23T16:15:38.070


Instruction: Please provide detailed information about CVE-2025-23624

CVE:CVE-2025-23624
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Alessandro Benoit WpDevTool allows Reflected XSS. This issue affects WpDevTool: from n/a through 0.1.1.
published:2025-01-23T16:15:38.223


Instruction: Please provide detailed information about CVE-2025-23626

CVE:CVE-2025-23626
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Hidetoshi Fukushima Kumihimo allows Reflected XSS. This issue affects Kumihimo: from n/a through 1.0.2.
published:2025-01-23T16:15:38.390


Instruction: Please provide detailed information about CVE-2025-23628

CVE:CVE-2025-23628
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in New Media One GeoDigs allows Reflected XSS. This issue affects GeoDigs: from n/a through 3.4.1.
published:2025-01-23T16:15:38.547


Instruction: Please provide detailed information about CVE-2025-23629

CVE:CVE-2025-23629
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Subhasis Laha Gallerio allows Reflected XSS. This issue affects Gallerio: from n/a through 1.0.1.
published:2025-01-23T16:15:38.690


Instruction: Please provide detailed information about CVE-2025-23634

CVE:CVE-2025-23634
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound Youtube Video Grid allows Reflected XSS. This issue affects Youtube Video Grid: from n/a through 1.9.
published:2025-01-23T16:15:38.840


Instruction: Please provide detailed information about CVE-2025-23636

CVE:CVE-2025-23636
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dimitar Atanasov My Favorite Car allows Reflected XSS. This issue affects My Favorite Car: from n/a through 1.0.
published:2025-01-23T16:15:38.983


Instruction: Please provide detailed information about CVE-2025-23722

CVE:CVE-2025-23722
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound Mind3doM RyeBread Widgets allows Reflected XSS. This issue affects Mind3doM RyeBread Widgets: from n/a through 1.0.
published:2025-01-23T16:15:39.117


Instruction: Please provide detailed information about CVE-2025-23723

CVE:CVE-2025-23723
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Plestar Inc Plestar Directory Listing allows Reflected XSS. This issue affects Plestar Directory Listing: from n/a through 1.0.
published:2025-01-23T16:15:39.260


Instruction: Please provide detailed information about CVE-2025-23724

CVE:CVE-2025-23724
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Oleksandr Ustymenko University Quizzes Online allows Reflected XSS. This issue affects University Quizzes Online: from n/a through 1.4.
published:2025-01-23T16:15:39.387


Instruction: Please provide detailed information about CVE-2025-23725

CVE:CVE-2025-23725
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in TaskMeister Accessibility Task Manager allows Reflected XSS. This issue affects Accessibility Task Manager: from n/a through 1.2.1.
published:2025-01-23T16:15:39.530


Instruction: Please provide detailed information about CVE-2025-23727

CVE:CVE-2025-23727
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound AZ Content Finder allows Reflected XSS. This issue affects AZ Content Finder: from n/a through 0.1.
published:2025-01-23T16:15:39.660


Instruction: Please provide detailed information about CVE-2025-23729

CVE:CVE-2025-23729
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in fures XTRA Settings allows Reflected XSS. This issue affects XTRA Settings: from n/a through 2.1.8.
published:2025-01-23T16:15:39.790


Instruction: Please provide detailed information about CVE-2025-23730

CVE:CVE-2025-23730
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound FLX Dashboard Groups allows Reflected XSS. This issue affects FLX Dashboard Groups: from n/a through 0.0.7.
published:2025-01-23T16:15:39.933


Instruction: Please provide detailed information about CVE-2025-23733

CVE:CVE-2025-23733
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sayocode SC Simple Zazzle allows Reflected XSS. This issue affects SC Simple Zazzle: from n/a through 1.1.6.
published:2025-01-23T16:15:40.073


Instruction: Please provide detailed information about CVE-2025-23834

CVE:CVE-2025-23834
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound Links/Problem Reporter allows Reflected XSS. This issue affects Links/Problem Reporter: from n/a through 2.6.0.
published:2025-01-23T16:15:40.203


Instruction: Please provide detailed information about CVE-2025-23835

CVE:CVE-2025-23835
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound Legal + allows Reflected XSS. This issue affects Legal +: from n/a through 1.0.
published:2025-01-23T16:15:40.353


Instruction: Please provide detailed information about CVE-2025-23836

CVE:CVE-2025-23836
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SuryaBhan Custom Coming Soon allows Reflected XSS. This issue affects Custom Coming Soon: from n/a through 2.2.
published:2025-01-23T16:15:40.497


Instruction: Please provide detailed information about CVE-2025-23894

CVE:CVE-2025-23894
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tatsuya Fukata, Alexander Ovsov wp-flickr-press allows Reflected XSS. This issue affects wp-flickr-press: from n/a through 2.6.4.
published:2025-01-23T16:15:40.637


Instruction: Please provide detailed information about CVE-2025-23960

CVE:CVE-2025-23960
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in basteln3rk Save & Import Image from URL allows Reflected XSS. This issue affects Save & Import Image from URL: from n/a through 0.7.
published:2025-01-23T16:15:40.777


Instruction: Please provide detailed information about CVE-2025-0650

CVE:CVE-2025-0650
Description:A flaw was found in the Open Virtual Network (OVN). Specially crafted UDP packets may bypass egress access control lists (ACLs) in OVN installations configured with a logical switch with DNS records set on it and if the same switch has any egress ACLs configured. This issue can lead to unauthorized access to virtual machines and containers running on the OVN network.
published:2025-01-23T17:15:22.163


Instruction: Please provide detailed information about CVE-2025-22153

CVE:CVE-2025-22153
Description:RestrictedPython is a tool that helps to define a subset of the Python language which allows to provide a program input into a trusted environment. Via a type confusion bug in versions of the CPython interpreter starting in 3.11 and prior to 3.13.2 when using `try/except*`, RestrictedPython starting in version 6.0 and prior to version 8.0 could be bypassed. The issue is patched in version 8.0 of RestrictedPython by removing support for `try/except*` clauses. No known workarounds are available.
published:2025-01-23T18:15:33.267


Instruction: Please provide detailed information about CVE-2025-23227

CVE:CVE-2025-23227
Description:IBM Tivoli Application Dependency Discovery Manager 7.3.0.0 through 7.3.0.11 is vulnerable to stored cross-site scripting. This vulnerability allows authenticated users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
published:2025-01-23T18:15:33.440


Instruction: Please provide detailed information about CVE-2025-24033

CVE:CVE-2025-24033
Description:@fastify/multipart is a Fastify plugin for parsing the multipart content-type. Prior to versions 8.3.1 and 9.0.3, the `saveRequestFiles` function does not delete the uploaded temporary files when user cancels the request. The issue is fixed in versions 8.3.1 and 9.0.3. As a workaround, do not use `saveRequestFiles`.
published:2025-01-23T18:15:33.610


Instruction: Please provide detailed information about CVE-2025-24034

CVE:CVE-2025-24034
Description:Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. Starting in version 0.7.0 and prior to versions 0.7.15 and 0.8.3, Himmelblau is vulnerable to leaking credentials in debug logs. When debug logging is enabled, user access tokens are inadvertently logged, potentially exposing sensitive authentication data. Similarly, Kerberos Ticket-Granting Tickets (TGTs) are logged when debug logging is enabled. Both issues pose a risk of exposing sensitive credentials, particularly in environments where debug logging is enabled. Himmelblau versions 0.7.15 and 0.8.3 contain a patch that fixes both issues. Some workarounds are available for users who are unable to upgrade. For the **logon compliance script issue**, disable the `logon_script` option in `/etc/himmelblau/himmelblau.conf`, and avoid using the `-d` flag when starting the `himmelblaud` daemon. For the Kerberos CCache issue, one may disable debug logging globally by setting the `debug` option in `/etc/himmelblau/himmelblau.conf` to `false` and avoiding the `-d` parameter when starting `himmelblaud`.
published:2025-01-23T18:15:33.793


Instruction: Please provide detailed information about CVE-2025-24353

CVE:CVE-2025-24353
Description:Directus is a real-time API and App dashboard for managing SQL database content. Prior to version 11.2.0, when sharing an item, a typical user can specify an arbitrary role. It allows the user to use a higher-privileged role to see fields that otherwise the user should not be able to see. Instances that are impacted are those that use the share feature and have specific roles hierarchy and fields that are not visible for certain roles. Version 11.2.0 contains a patch the issue.
published:2025-01-23T18:15:33.990


Instruction: Please provide detailed information about CVE-2025-23011

CVE:CVE-2025-23011
Description:Fedora Repository 3.8.1 allows path traversal when extracting uploaded archives ("Zip Slip"). A remote, authenticated attacker can upload a specially crafted archive that will extract an arbitrary JSP file to a location that can be executed by an unauthenticated GET request. Fedora Repository 3.8.1 was released on 2015-06-11 and is no longer maintained. Migrate to a currently supported version (6.5.1 as of 2025-01-23).
published:2025-01-23T21:15:15.010


Instruction: Please provide detailed information about CVE-2025-23012

CVE:CVE-2025-23012
Description:Fedora Repository 3.8.x includes a service account (fedoraIntCallUser) with default credentials and privileges to read read local files by manipulating datastreams. Fedora Repository 3.8.1 was released on 2015-06-11 and is no longer maintained. Migrate to a currently supported version (6.5.1 as of 2025-01-23).
published:2025-01-23T21:15:15.173


Instruction: Please provide detailed information about CVE-2025-0693

CVE:CVE-2025-0693
Description:Variable response times in the AWS Sign-in IAM user login flow allowed for the use of brute force enumeration techniques to identify valid IAM usernames in an arbitrary AWS account.
published:2025-01-23T22:15:15.397


Instruction: Please provide detailed information about CVE-2025-0314

CVE:CVE-2025-0314
Description:An issue has been discovered in GitLab CE/EE affecting all versions from 17.2 before 17.6.4, 17.7 before 17.7.3, and 17.8 before 17.8.1. Improper rendering of certain file types lead to cross-site scripting.
published:2025-01-24T03:15:07.320


Instruction: Please provide detailed information about CVE-2025-22714

CVE:CVE-2025-22714
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MDJM MDJM Event Management allows Reflected XSS. This issue affects MDJM Event Management: from n/a through 1.7.5.5.
published:2025-01-24T11:15:09.823


Instruction: Please provide detailed information about CVE-2025-23422

CVE:CVE-2025-23422
Description:Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in NotFound Store Locator allows PHP Local File Inclusion. This issue affects Store Locator: from n/a through 3.98.10.
published:2025-01-24T11:15:09.987


Instruction: Please provide detailed information about CVE-2025-23427

CVE:CVE-2025-23427
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dovy Paukstys Redux Converter allows Reflected XSS. This issue affects Redux Converter: from n/a through 1.1.3.1.
published:2025-01-24T11:15:10.140


Instruction: Please provide detailed information about CVE-2025-23522

CVE:CVE-2025-23522
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in humanmade limited, Joe Hoyle, Tom Wilmott, Matthew Haines-Young HM Portfolio allows Reflected XSS. This issue affects HM Portfolio: from n/a through 1.1.1.
published:2025-01-24T11:15:10.290


Instruction: Please provide detailed information about CVE-2025-23621

CVE:CVE-2025-23621
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound Causes – Donation Plugin allows Reflected XSS. This issue affects Causes – Donation Plugin: from n/a through 1.0.01.
published:2025-01-24T11:15:10.473


Instruction: Please provide detailed information about CVE-2025-23622

CVE:CVE-2025-23622
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound CBX Accounting & Bookkeeping allows Reflected XSS. This issue affects CBX Accounting & Bookkeeping: from n/a through 1.3.14.
published:2025-01-24T11:15:10.660


Instruction: Please provide detailed information about CVE-2025-23711

CVE:CVE-2025-23711
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound Quote me allows Reflected XSS. This issue affects Quote me: from n/a through 1.0.
published:2025-01-24T11:15:10.813


Instruction: Please provide detailed information about CVE-2025-23734

CVE:CVE-2025-23734
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound Gigaom Sphinx allows Reflected XSS. This issue affects Gigaom Sphinx: from n/a through 0.1.
published:2025-01-24T11:15:10.967


Instruction: Please provide detailed information about CVE-2025-23737

CVE:CVE-2025-23737
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound Network-Favorites allows Reflected XSS. This issue affects Network-Favorites: from n/a through 1.1.
published:2025-01-24T11:15:11.103


Instruction: Please provide detailed information about CVE-2025-23837

CVE:CVE-2025-23837
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound One Backend Language allows Reflected XSS. This issue affects One Backend Language: from n/a through 1.0.
published:2025-01-24T11:15:11.240


Instruction: Please provide detailed information about CVE-2025-23838

CVE:CVE-2025-23838
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound Bauernregeln allows Reflected XSS. This issue affects Bauernregeln: from n/a through 1.0.1.
published:2025-01-24T11:15:11.390


Instruction: Please provide detailed information about CVE-2025-23839

CVE:CVE-2025-23839
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound Sticky Button allows Stored XSS. This issue affects Sticky Button: from n/a through 1.0.
published:2025-01-24T11:15:11.523


Instruction: Please provide detailed information about CVE-2025-23885

CVE:CVE-2025-23885
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound MJ Contact us allows Reflected XSS. This issue affects MJ Contact us: from n/a through 5.2.3.
published:2025-01-24T11:15:11.660


Instruction: Please provide detailed information about CVE-2025-23888

CVE:CVE-2025-23888
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound Custom Page Extensions allows Reflected XSS. This issue affects Custom Page Extensions: from n/a through 0.6.
published:2025-01-24T11:15:11.797


Instruction: Please provide detailed information about CVE-2025-23889

CVE:CVE-2025-23889
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound FooGallery Captions allows Reflected XSS. This issue affects FooGallery Captions: from n/a through 1.0.2.
published:2025-01-24T11:15:11.950


Instruction: Please provide detailed information about CVE-2025-0697

CVE:CVE-2025-0697
Description:A vulnerability, which was classified as problematic, was found in Telstra Smart Modem Gen 2 up to 20250115. This affects an unknown part of the component HTTP Header Handler. The manipulation of the argument Content-Disposition leads to injection. It is possible to initiate the attack remotely. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-01-24T15:15:12.130


Instruction: Please provide detailed information about CVE-2025-22605

CVE:CVE-2025-22605
Description:Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Starting in version 4.0.0-beta.18 and prior to 4.0.0-beta.253, a vulnerability in the execution of commands on remote servers allows an authenticated user to execute arbitrary code on the local Coolify container, gaining access to data and private keys or tokens of other users/teams. The ability to inject malicious commands into the Coolify container gives authenticated attackers the ability to fully retrieve and control the data and availability of the software. Centrally hosted Coolify instances (open registration and/or multiple teams with potentially untrustworthy users) are especially at risk, as sensitive data of all users and connected servers can be leaked by any user. Additionally, attackers are able to modify the running software, potentially deploying malicious images to remote nodes or generally changing its behavior. Version 4.0.0-beta.253 patches this issue.
published:2025-01-24T15:15:12.330


Instruction: Please provide detailed information about CVE-2025-0698

CVE:CVE-2025-0698
Description:A vulnerability was found in JoeyBling bootplus up to 247d5f6c209be1a5cf10cd0fa18e1d8cc63cf55d. It has been classified as critical. Affected is an unknown function of the file /admin/sys/menu/list. The manipulation of the argument sort/order leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available.
published:2025-01-24T16:15:37.717


Instruction: Please provide detailed information about CVE-2025-0699

CVE:CVE-2025-0699
Description:A vulnerability was found in JoeyBling bootplus up to 247d5f6c209be1a5cf10cd0fa18e1d8cc63cf55d. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /admin/sys/role/list. The manipulation of the argument sort leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable.
published:2025-01-24T16:15:37.977


Instruction: Please provide detailed information about CVE-2025-22606

CVE:CVE-2025-22606
Description:Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. In version 4.0.0-beta.358 and possibly earlier versions, when creating or updating a "project," it is possible to inject arbitrary shell commands by altering the project name. If a name includes unescaped characters, such as single quotes (`'`), it breaks out of the intended command structure, allowing attackers to execute arbitrary commands on the host system. This vulnerability allows attackers to execute arbitrary commands on the host server, which could result in full system compromise; create, modify, or delete sensitive system files; and escalate privileges depending on the permissions of the executed process. Attackers with access to project management features could exploit this flaw to gain unauthorized control over the host environment. Version 4.0.0-beta.359 fixes this issue.
published:2025-01-24T16:15:38.307


Instruction: Please provide detailed information about CVE-2025-22607

CVE:CVE-2025-22607
Description:Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.361, the missing authorization allows any authenticated user to fetch the details page for any GitHub / GitLab configuration on a Coolify instance by only knowing the UUID of the model. This exposes the "client id", "client secret" and "webhook secret." Version 4.0.0-beta.361 fixes this issue.
published:2025-01-24T16:15:38.470


Instruction: Please provide detailed information about CVE-2025-23991

CVE:CVE-2025-23991
Description:Missing Authorization vulnerability in theDotstore Product Size Charts Plugin for WooCommerce.This issue affects Product Size Charts Plugin for WooCommerce: from n/a through 2.4.5.
published:2025-01-24T16:15:38.723


Instruction: Please provide detailed information about CVE-2025-0700

CVE:CVE-2025-0700
Description:A vulnerability was found in JoeyBling bootplus up to 247d5f6c209be1a5cf10cd0fa18e1d8cc63cf55d. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin/sys/log/list. The manipulation of the argument logId leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available.
published:2025-01-24T17:15:14.517


Instruction: Please provide detailed information about CVE-2025-0701

CVE:CVE-2025-0701
Description:A vulnerability classified as critical has been found in JoeyBling bootplus up to 247d5f6c209be1a5cf10cd0fa18e1d8cc63cf55d. This affects an unknown part of the file /admin/sys/user/list. The manipulation of the argument sort leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available.
published:2025-01-24T17:15:14.730


Instruction: Please provide detailed information about CVE-2025-22608

CVE:CVE-2025-22608
Description:Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.361, the missing authorization allows any authenticated user to revoke any team invitations on a Coolify instance by only providing a predictable and incrementing ID, resulting in a Denial-of-Service attack (DOS). Version 4.0.0-beta.361 fixes the issue.
published:2025-01-24T17:15:14.960


Instruction: Please provide detailed information about CVE-2025-22609

CVE:CVE-2025-22609
Description:Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.361, the missing authorization allows any authenticated user to attach any existing private key on a coolify instance to his own server. If the server configuration of IP / domain, port (most likely 22) and user (root) matches with the victim's server configuration, then the attacker can use the `Terminal` feature and execute arbitrary commands on the victim's server. Version 4.0.0-beta.361 fixes the issue.
published:2025-01-24T17:15:15.100


Instruction: Please provide detailed information about CVE-2025-22610

CVE:CVE-2025-22610
Description:Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.361, the missing authorization allows any authenticated user to fetch the global coolify instance OAuth configuration. This exposes the "client id" and "client secret" for every custom OAuth provider. The attacker can also modify the global OAuth configuration. Version 4.0.0-beta.361 fixes the issue.
published:2025-01-24T17:15:15.237


Instruction: Please provide detailed information about CVE-2025-22611

CVE:CVE-2025-22611
Description:Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.361, the missing authorization allows any authenticated user to escalate his or any other team members privileges to any role, including the owner role. He's also able to kick every other member out of the team, including admins and owners. This allows the attacker to access the `Terminal` feature and execute remote commands. Version 4.0.0-beta.361 fixes the issue.
published:2025-01-24T17:15:15.410


Instruction: Please provide detailed information about CVE-2025-22612

CVE:CVE-2025-22612
Description:Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.374, the missing authorization allows an authenticated user to retrieve any existing private keys on a coolify instance in plain text. If the server configuration of IP / domain, port (most likely 22) and user (root) matches with the victim's server configuration, then the attacker can execute arbitrary commands on the remote server. Version 4.0.0-beta.374 fixes the issue.
published:2025-01-24T17:15:15.570


Instruction: Please provide detailed information about CVE-2025-23222

CVE:CVE-2025-23222
Description:An issue was discovered in Deepin dde-api-proxy through 1.0.19 in which unprivileged users can access D-Bus services as root. Specifically, dde-api-proxy runs as root and forwards messages from arbitrary local users to legacy D-Bus methods in the actual D-Bus services, and the actual D-Bus services don't know about the proxy situation (they believe that root is asking them to do things). Consequently several proxied methods, that shouldn't be accessible to non-root users, are accessible to non-root users. In situations where Polkit is involved, the caller would be treated as admin, resulting in a similar escalation of privileges.
published:2025-01-24T17:15:15.730


Instruction: Please provide detailed information about CVE-2025-24025

CVE:CVE-2025-24025
Description:Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.380, the tags page allows users to search for tags. If the search does not return any results, the query gets reflected on the error modal, which leads to cross-site scripting. Version 4.0.0-beta.380 fixes the issue.
published:2025-01-24T17:15:15.900


Instruction: Please provide detailed information about CVE-2025-24355

CVE:CVE-2025-24355
Description:Updatecli is a tool used to apply file update strategies. Prior to version 0.93.0, private maven repository credentials may be leaked in application logs in case of unsuccessful retrieval operation. During the execution of an updatecli pipeline which contains a `maven` source configured with basic auth credentials, the credentials are being leaked in the application execution logs in case of failure. Credentials are properly sanitized when the operation is successful but not when for whatever reason there is a failure in the maven repository, e.g. wrong coordinates provided, not existing artifact or version. Version 0.93.0 contains a patch for the issue.
published:2025-01-24T17:15:16.047


Instruction: Please provide detailed information about CVE-2025-24359

CVE:CVE-2025-24359
Description:ASTEVAL is an evaluator of Python expressions and statements. Prior to version 1.0.6, if an attacker can control the input to the `asteval` library, they can bypass asteval's restrictions and execute arbitrary Python code in the context of the application using the library. The vulnerability is rooted in how `asteval` performs handling of `FormattedValue` AST nodes. In particular, the `on_formattedvalue` value uses the dangerous format method of the str class. The code allows an attacker to manipulate the value of the string used in the dangerous call `fmt.format(__fstring__=val)`. This vulnerability can be exploited to access protected attributes by intentionally triggering an `AttributeError` exception. The attacker can then catch the exception and use its `obj` attribute to gain arbitrary access to sensitive or protected object properties. Version 1.0.6 fixes this issue.
published:2025-01-24T17:15:16.197


Instruction: Please provide detailed information about CVE-2025-0702

CVE:CVE-2025-0702
Description:A vulnerability classified as critical was found in JoeyBling bootplus up to 247d5f6c209be1a5cf10cd0fa18e1d8cc63cf55d. This vulnerability affects unknown code of the file src/main/java/io/github/controller/SysFileController.java. The manipulation of the argument portraitFile leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available.
published:2025-01-24T18:15:32.087


Instruction: Please provide detailed information about CVE-2025-24362

CVE:CVE-2025-24362
Description:In some circumstances, debug artifacts uploaded by the CodeQL Action after a failed code scanning workflow run may contain the environment variables from the workflow run, including any secrets that were exposed as environment variables to the workflow. Users with read access to the repository would be able to access this artifact, containing any secrets from the environment. This vulnerability is patched in CodeQL Action version 3.28.3 or later, or CodeQL CLI version 2.20.3 or later.  For some affected workflow runs, the exposed environment variables in the debug artifacts included a valid `GITHUB_TOKEN` for the workflow run, which has access to the repository in which the workflow ran, and all the permissions specified in the workflow or job. The `GITHUB_TOKEN` is valid until the job completes or 24 hours has elapsed, whichever comes first.  Environment variables are exposed only from workflow runs that satisfy all of the following conditions: - Code scanning workflow configured to scan the Java/Kotlin languages. - Running in a repository containing Kotlin source code. - Running with debug artifacts enabled. - Using CodeQL Action versions <= 3.28.2, and CodeQL CLI versions >= 2.9.2 (May 2022) and <= 2.20.2. - The workflow run fails before the CodeQL database is finalized within the `github/codeql-action/analyze` step. - Running in any GitHub environment: GitHub.com, GitHub Enterprise Cloud, and GitHub Enterprise Server. Note: artifacts are only accessible to users within the same GitHub environment with access to the scanned repo.  The `GITHUB_TOKEN` exposed in this way would only have been valid for workflow runs that satisfy all of the following conditions, in addition to the conditions above: - Using CodeQL Action versions >= 3.26.11 (October 2024) and <= 3.28.2, or >= 2.26.11 and < 3. - Running in GitHub.com or GitHub Enterprise Cloud only (not valid on GitHub Enterprise Server).  In rare cases during advanced setup, logging of environment variables may also occur during database creation of Java, Swift, and C/C++. Please read the corresponding CodeQL CLI advisory GHSA-gqh3-9prg-j95m for more details.  In CodeQL CLI versions >= 2.9.2 and <= 2.20.2, the CodeQL Kotlin extractor logs all environment variables by default into an intermediate file during the process of creating a CodeQL database for Kotlin code. This is a part of the CodeQL CLI and is invoked by the CodeQL Action for analyzing Kotlin repositories.   On Actions, the environment variables logged include GITHUB_TOKEN, which grants permissions to the repository being scanned. The intermediate file containing environment variables is deleted when finalizing the database, so it is not included in a successfully created database. It is, however, included in the debug artifact that is uploaded on a failed analysis run if the CodeQL Action was invoked in debug mode.  Therefore, under these specific circumstances (incomplete database creation using the CodeQL Action in debug mode) an attacker with access to the debug artifact would gain unauthorized access to repository secrets from the environment, including both the `GITHUB_TOKEN` and any user-configured secrets made available via environment variables.  The impact of the `GITHUB_TOKEN` leaked in this environment is limited: - For workflows on GitHub.com and GitHub Enterprise Cloud using CodeQL Action versions >= 3.26.11 and <= 3.28.2, or >= 2.26.11 and < 3, which in turn use the `actions/artifacts v4` library, the debug artifact is uploaded before the workflow job completes. During this time the `GITHUB_TOKEN` is still valid, providing an opportunity for attackers to gain access to the repository. - For all other workflows, the debug artifact is uploaded after the workflow job completes, at which point the leaked `GITHUB_TOKEN` has been revoked and cannot be used to access the repository.
published:2025-01-24T18:15:32.383


Instruction: Please provide detailed information about CVE-2025-24542

CVE:CVE-2025-24542
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in icegram Icegram allows Stored XSS. This issue affects Icegram: from n/a through 3.1.31.
published:2025-01-24T18:15:32.550


Instruction: Please provide detailed information about CVE-2025-24543

CVE:CVE-2025-24543
Description:Cross-Site Request Forgery (CSRF) vulnerability in RSTheme Ultimate Coming Soon & Maintenance allows Cross Site Request Forgery. This issue affects Ultimate Coming Soon & Maintenance: from n/a through 1.0.9.
published:2025-01-24T18:15:32.703


Instruction: Please provide detailed information about CVE-2025-24546

CVE:CVE-2025-24546
Description:Cross-Site Request Forgery (CSRF) vulnerability in RSTheme Ultimate Coming Soon & Maintenance allows Cross Site Request Forgery. This issue affects Ultimate Coming Soon & Maintenance: from n/a through 1.0.9.
published:2025-01-24T18:15:32.893


Instruction: Please provide detailed information about CVE-2025-24547

CVE:CVE-2025-24547
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Matthias Wagner - FALKEmedia Caching Compatible Cookie Opt-In and JavaScript allows Stored XSS. This issue affects Caching Compatible Cookie Opt-In and JavaScript: from n/a through 0.0.10.
published:2025-01-24T18:15:33.063


Instruction: Please provide detailed information about CVE-2025-24552

CVE:CVE-2025-24552
Description:Generation of Error Message Containing Sensitive Information vulnerability in David de Boer Paytium allows Retrieve Embedded Sensitive Data. This issue affects Paytium: from n/a through 4.4.11.
published:2025-01-24T18:15:33.257


Instruction: Please provide detailed information about CVE-2025-24555

CVE:CVE-2025-24555
Description:Cross-Site Request Forgery (CSRF) vulnerability in SubscriptionDNA.com Subscription DNA allows Stored XSS. This issue affects Subscription DNA: from n/a through 2.1.
published:2025-01-24T18:15:33.440


Instruction: Please provide detailed information about CVE-2025-24561

CVE:CVE-2025-24561
Description:Cross-Site Request Forgery (CSRF) vulnerability in ReviewsTap ReviewsTap allows Stored XSS. This issue affects ReviewsTap: from n/a through 1.1.2.
published:2025-01-24T18:15:33.623


Instruction: Please provide detailed information about CVE-2025-24562

CVE:CVE-2025-24562
Description:Cross-Site Request Forgery (CSRF) vulnerability in Optimal Access Inc. KBucket allows Stored XSS. This issue affects KBucket: from n/a through 4.1.6.
published:2025-01-24T18:15:33.810


Instruction: Please provide detailed information about CVE-2025-24568

CVE:CVE-2025-24568
Description:Cross-Site Request Forgery (CSRF) vulnerability in Brainstorm Force Starter Templates allows Cross Site Request Forgery. This issue affects Starter Templates: from n/a through 4.4.9.
published:2025-01-24T18:15:33.987


Instruction: Please provide detailed information about CVE-2025-24570

CVE:CVE-2025-24570
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Atarim Atarim allows Stored XSS. This issue affects Atarim: from n/a through 4.0.8.
published:2025-01-24T18:15:34.147


Instruction: Please provide detailed information about CVE-2025-24571

CVE:CVE-2025-24571
Description:Missing Authorization vulnerability in Epsiloncool WP Fast Total Search allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WP Fast Total Search: from n/a through 1.78.258.
published:2025-01-24T18:15:34.320


Instruction: Please provide detailed information about CVE-2025-24572

CVE:CVE-2025-24572
Description:Cross-Site Request Forgery (CSRF) vulnerability in Epsiloncool WP Fast Total Search allows Cross Site Request Forgery. This issue affects WP Fast Total Search: from n/a through 1.78.258.
published:2025-01-24T18:15:34.477


Instruction: Please provide detailed information about CVE-2025-24573

CVE:CVE-2025-24573
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pagelayer Team PageLayer allows DOM-Based XSS. This issue affects PageLayer: from n/a through 1.9.4.
published:2025-01-24T18:15:34.640


Instruction: Please provide detailed information about CVE-2025-24575

CVE:CVE-2025-24575
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HelloAsso HelloAsso allows Stored XSS. This issue affects HelloAsso: from n/a through 1.1.11.
published:2025-01-24T18:15:34.793


Instruction: Please provide detailed information about CVE-2025-24578

CVE:CVE-2025-24578
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ElementInvader ElementInvader Addons for Elementor allows DOM-Based XSS. This issue affects ElementInvader Addons for Elementor: from n/a through 1.3.0.
published:2025-01-24T18:15:34.947


Instruction: Please provide detailed information about CVE-2025-24579

CVE:CVE-2025-24579
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kyle Phillips Nested Pages allows Stored XSS. This issue affects Nested Pages: from n/a through 3.2.9.
published:2025-01-24T18:15:35.090


Instruction: Please provide detailed information about CVE-2025-24580

CVE:CVE-2025-24580
Description:Missing Authorization vulnerability in Code for Recovery 12 Step Meeting List allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects 12 Step Meeting List: from n/a through 3.16.5.
published:2025-01-24T18:15:35.247


Instruction: Please provide detailed information about CVE-2025-24582

CVE:CVE-2025-24582
Description:Insertion of Sensitive Information Into Sent Data vulnerability in Code for Recovery 12 Step Meeting List allows Retrieve Embedded Sensitive Data. This issue affects 12 Step Meeting List: from n/a through 3.16.5.
published:2025-01-24T18:15:35.397


Instruction: Please provide detailed information about CVE-2025-24585

CVE:CVE-2025-24585
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in N.O.U.S. Open Useful and Simple Event post allows Stored XSS. This issue affects Event post: from n/a through 5.9.7.
published:2025-01-24T18:15:35.550


Instruction: Please provide detailed information about CVE-2025-24587

CVE:CVE-2025-24587
Description:Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in I Thirteen Web Solution Email Subscription Popup allows Blind SQL Injection. This issue affects Email Subscription Popup: from n/a through 1.2.23.
published:2025-01-24T18:15:35.697


Instruction: Please provide detailed information about CVE-2025-24588

CVE:CVE-2025-24588
Description:Missing Authorization vulnerability in Patreon Patreon WordPress allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Patreon WordPress: from n/a through 1.9.1.
published:2025-01-24T18:15:35.867


Instruction: Please provide detailed information about CVE-2025-24589

CVE:CVE-2025-24589
Description:Missing Authorization vulnerability in JS Morisset JSM Show Post Metadata allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects JSM Show Post Metadata: from n/a through 4.6.0.
published:2025-01-24T18:15:36.013


Instruction: Please provide detailed information about CVE-2025-24591

CVE:CVE-2025-24591
Description:Missing Authorization vulnerability in NinjaTeam GDPR CCPA Compliance Support allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects GDPR CCPA Compliance Support: from n/a through 2.7.1.
published:2025-01-24T18:15:36.160


Instruction: Please provide detailed information about CVE-2025-24594

CVE:CVE-2025-24594
Description:Missing Authorization vulnerability in Speedcomp Linet ERP-Woocommerce Integration allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Linet ERP-Woocommerce Integration: from n/a through 3.5.7.
published:2025-01-24T18:15:36.330


Instruction: Please provide detailed information about CVE-2025-24595

CVE:CVE-2025-24595
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins All Embed – Elementor Addons allows Stored XSS. This issue affects All Embed – Elementor Addons: from n/a through 1.1.3.
published:2025-01-24T18:15:36.497


Instruction: Please provide detailed information about CVE-2025-24596

CVE:CVE-2025-24596
Description:Missing Authorization vulnerability in WC Product Table WooCommerce Product Table Lite allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WooCommerce Product Table Lite: from n/a through 3.8.7.
published:2025-01-24T18:15:36.657


Instruction: Please provide detailed information about CVE-2025-24604

CVE:CVE-2025-24604
Description:Missing Authorization vulnerability in Vikas Ratudi VForm allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects VForm: from n/a through 3.0.5.
published:2025-01-24T18:15:36.823


Instruction: Please provide detailed information about CVE-2025-24610

CVE:CVE-2025-24610
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Christian Leuenberg, L.net Web Solutions Restrict Anonymous Access allows Stored XSS. This issue affects Restrict Anonymous Access: from n/a through 1.2.
published:2025-01-24T18:15:36.980


Instruction: Please provide detailed information about CVE-2025-24611

CVE:CVE-2025-24611
Description:Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Smackcoders WP Ultimate Exporter allows Absolute Path Traversal. This issue affects WP Ultimate Exporter: from n/a through 2.9.
published:2025-01-24T18:15:37.133


Instruction: Please provide detailed information about CVE-2025-24613

CVE:CVE-2025-24613
Description:Missing Authorization vulnerability in Foliovision FV Thoughtful Comments allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects FV Thoughtful Comments: from n/a through 0.3.5.
published:2025-01-24T18:15:37.277


Instruction: Please provide detailed information about CVE-2025-24618

CVE:CVE-2025-24618
Description:Missing Authorization vulnerability in ElementInvader ElementInvader Addons for Elementor allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects ElementInvader Addons for Elementor: from n/a through 1.3.1.
published:2025-01-24T18:15:37.430


Instruction: Please provide detailed information about CVE-2025-24622

CVE:CVE-2025-24622
Description:Cross-Site Request Forgery (CSRF) vulnerability in PickPlugins Job Board Manager allows Cross Site Request Forgery. This issue affects Job Board Manager: from n/a through 2.1.59.
published:2025-01-24T18:15:37.577


Instruction: Please provide detailed information about CVE-2025-24623

CVE:CVE-2025-24623
Description:Cross-Site Request Forgery (CSRF) vulnerability in Really Simple Security Really Simple SSL allows Cross Site Request Forgery. This issue affects Really Simple SSL: from n/a through 9.1.4.
published:2025-01-24T18:15:37.727


Instruction: Please provide detailed information about CVE-2025-24625

CVE:CVE-2025-24625
Description:Missing Authorization vulnerability in Marco Almeida | Webdados Taxonomy/Term and Role based Discounts for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Taxonomy/Term and Role based Discounts for WooCommerce: from n/a through 5.1.
published:2025-01-24T18:15:37.897


Instruction: Please provide detailed information about CVE-2025-24627

CVE:CVE-2025-24627
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Linnea Huxford, LinSoftware Blur Text allows Stored XSS. This issue affects Blur Text: from n/a through 1.0.0.
published:2025-01-24T18:15:38.050


Instruction: Please provide detailed information about CVE-2025-24633

CVE:CVE-2025-24633
Description:Missing Authorization vulnerability in silverplugins217 Build Private Store For Woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Build Private Store For Woocommerce: from n/a through 1.0.
published:2025-01-24T18:15:38.200


Instruction: Please provide detailed information about CVE-2025-24634

CVE:CVE-2025-24634
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Svetoslav Marinov (Slavi) Orbisius Simple Notice allows Stored XSS. This issue affects Orbisius Simple Notice: from n/a through 1.1.3.
published:2025-01-24T18:15:38.350


Instruction: Please provide detailed information about CVE-2025-24636

CVE:CVE-2025-24636
Description:Cross-Site Request Forgery (CSRF) vulnerability in Laymance Technologies LLC MachForm Shortcode allows Stored XSS. This issue affects MachForm Shortcode: from n/a through 1.4.1.
published:2025-01-24T18:15:38.507


Instruction: Please provide detailed information about CVE-2025-24638

CVE:CVE-2025-24638
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pete Dring Create with Code allows DOM-Based XSS. This issue affects Create with Code: from n/a through 1.4.
published:2025-01-24T18:15:38.670


Instruction: Please provide detailed information about CVE-2025-24644

CVE:CVE-2025-24644
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels allows Stored XSS. This issue affects WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels: from n/a through 4.7.1.
published:2025-01-24T18:15:38.833


Instruction: Please provide detailed information about CVE-2025-24647

CVE:CVE-2025-24647
Description:Cross-Site Request Forgery (CSRF) vulnerability in datafeedr.com WooCommerce Cloak Affiliate Links allows Cross Site Request Forgery. This issue affects WooCommerce Cloak Affiliate Links: from n/a through 1.0.35.
published:2025-01-24T18:15:39.007


Instruction: Please provide detailed information about CVE-2025-24649

CVE:CVE-2025-24649
Description:Missing Authorization vulnerability in wpase.com Admin and Site Enhancements (ASE) allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Admin and Site Enhancements (ASE): from n/a through 7.6.2.
published:2025-01-24T18:15:39.167


Instruction: Please provide detailed information about CVE-2025-24650

CVE:CVE-2025-24650
Description:Unrestricted Upload of File with Dangerous Type vulnerability in Themefic Tourfic allows Upload a Web Shell to a Web Server. This issue affects Tourfic: from n/a through 2.15.3.
published:2025-01-24T18:15:39.347


Instruction: Please provide detailed information about CVE-2025-24652

CVE:CVE-2025-24652
Description:Missing Authorization vulnerability in Revmakx WP Duplicate – WordPress Migration Plugin allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WP Duplicate – WordPress Migration Plugin: from n/a through 1.1.6.
published:2025-01-24T18:15:39.517


Instruction: Please provide detailed information about CVE-2025-24657

CVE:CVE-2025-24657
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WebToffee Wishlist for WooCommerce allows Stored XSS. This issue affects Wishlist for WooCommerce: from n/a through 2.1.2.
published:2025-01-24T18:15:39.680


Instruction: Please provide detailed information about CVE-2025-24658

CVE:CVE-2025-24658
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Joe Hawes Auction Nudge – Your eBay on Your Site allows Stored XSS. This issue affects Auction Nudge – Your eBay on Your Site: from n/a through 7.2.0.
published:2025-01-24T18:15:39.853


Instruction: Please provide detailed information about CVE-2025-24659

CVE:CVE-2025-24659
Description:Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WordPress Download Manager Premium Packages allows Blind SQL Injection. This issue affects Premium Packages: from n/a through 5.9.6.
published:2025-01-24T18:15:40.020


Instruction: Please provide detailed information about CVE-2025-24663

CVE:CVE-2025-24663
Description:Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Tips and Tricks HQ, Ruhul Amin, Josh Lobe Simple Download Monitor allows Blind SQL Injection. This issue affects Simple Download Monitor: from n/a through 3.9.25.
published:2025-01-24T18:15:40.203


Instruction: Please provide detailed information about CVE-2025-24666

CVE:CVE-2025-24666
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeIsle AI Chatbot for WordPress – Hyve Lite allows Stored XSS. This issue affects AI Chatbot for WordPress – Hyve Lite: from n/a through 1.2.2.
published:2025-01-24T18:15:40.400


Instruction: Please provide detailed information about CVE-2025-24668

CVE:CVE-2025-24668
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeisle PPOM for WooCommerce allows Stored XSS. This issue affects PPOM for WooCommerce: from n/a through 33.0.8.
published:2025-01-24T18:15:40.563


Instruction: Please provide detailed information about CVE-2025-24669

CVE:CVE-2025-24669
Description:Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in SERPed SERPed.net allows SQL Injection. This issue affects SERPed.net: from n/a through 4.4.
published:2025-01-24T18:15:40.730


Instruction: Please provide detailed information about CVE-2025-24672

CVE:CVE-2025-24672
Description:Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in CodePeople Form Builder CP allows SQL Injection. This issue affects Form Builder CP: from n/a through 1.2.41.
published:2025-01-24T18:15:40.890


Instruction: Please provide detailed information about CVE-2025-24673

CVE:CVE-2025-24673
Description:Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in AyeCode Ltd Ketchup Shortcodes allows Stored XSS. This issue affects Ketchup Shortcodes: from n/a through 0.1.2.
published:2025-01-24T18:15:41.033


Instruction: Please provide detailed information about CVE-2025-24674

CVE:CVE-2025-24674
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Teplitsa. Technologies for Social Good ShMapper by Teplitsa allows Stored XSS. This issue affects ShMapper by Teplitsa: from n/a through 1.5.0.
published:2025-01-24T18:15:41.190


Instruction: Please provide detailed information about CVE-2025-24675

CVE:CVE-2025-24675
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in osamaesh WP Visitor Statistics (Real Time Traffic) allows Stored XSS. This issue affects WP Visitor Statistics (Real Time Traffic): from n/a through 7.2.
published:2025-01-24T18:15:41.340


Instruction: Please provide detailed information about CVE-2025-24678

CVE:CVE-2025-24678
Description:Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Listamester Listamester allows Stored XSS. This issue affects Listamester: from n/a through 2.3.4.
published:2025-01-24T18:15:41.477


Instruction: Please provide detailed information about CVE-2025-24679

CVE:CVE-2025-24679
Description:Missing Authorization vulnerability in webraketen Internal Links Manager allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Internal Links Manager: from n/a through 2.5.2.
published:2025-01-24T18:15:41.630


Instruction: Please provide detailed information about CVE-2025-24681

CVE:CVE-2025-24681
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpWax Product Carousel Slider & Grid Ultimate for WooCommerce allows Stored XSS. This issue affects Product Carousel Slider & Grid Ultimate for WooCommerce: from n/a through 1.10.0.
published:2025-01-24T18:15:41.767


Instruction: Please provide detailed information about CVE-2025-24682

CVE:CVE-2025-24682
Description:Missing Authorization vulnerability in mikemmx Super Block Slider allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Super Block Slider: from n/a through 2.7.9.
published:2025-01-24T18:15:41.947


Instruction: Please provide detailed information about CVE-2025-24683

CVE:CVE-2025-24683
Description:Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPChill RSVP and Event Management Plugin allows SQL Injection. This issue affects RSVP and Event Management Plugin: from n/a through 2.7.14.
published:2025-01-24T18:15:42.133


Instruction: Please provide detailed information about CVE-2025-24687

CVE:CVE-2025-24687
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Lars Wallenborn Show/Hide Shortcode allows Stored XSS. This issue affects Show/Hide Shortcode: from n/a through 1.0.0.
published:2025-01-24T18:15:42.283


Instruction: Please provide detailed information about CVE-2025-24691

CVE:CVE-2025-24691
Description:Missing Authorization vulnerability in Gagan Sandhu , Enej Bajgoric , CTLT DEV, UBC People Lists allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects People Lists: from n/a through 1.3.10.
published:2025-01-24T18:15:42.433


Instruction: Please provide detailed information about CVE-2025-24693

CVE:CVE-2025-24693
Description:Missing Authorization vulnerability in Yehi Advanced Notifications allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Advanced Notifications: from n/a through 1.2.7.
published:2025-01-24T18:15:42.597


Instruction: Please provide detailed information about CVE-2025-24695

CVE:CVE-2025-24695
Description:Server-Side Request Forgery (SSRF) vulnerability in HasThemes Extensions For CF7 allows Server Side Request Forgery. This issue affects Extensions For CF7: from n/a through 3.2.0.
published:2025-01-24T18:15:42.740


Instruction: Please provide detailed information about CVE-2025-24696

CVE:CVE-2025-24696
Description:Cross-Site Request Forgery (CSRF) vulnerability in WP Attire Attire Blocks allows Cross Site Request Forgery. This issue affects Attire Blocks: from n/a through 1.9.6.
published:2025-01-24T18:15:42.900


Instruction: Please provide detailed information about CVE-2025-24698

CVE:CVE-2025-24698
Description:Cross-Site Request Forgery (CSRF) vulnerability in G5Theme Essential Real Estate allows Cross Site Request Forgery. This issue affects Essential Real Estate: from n/a through 5.1.8.
published:2025-01-24T18:15:43.050


Instruction: Please provide detailed information about CVE-2025-24701

CVE:CVE-2025-24701
Description:Server-Side Request Forgery (SSRF) vulnerability in Kiboko Labs Chained Quiz allows Server Side Request Forgery. This issue affects Chained Quiz: from n/a through 1.3.2.9.
published:2025-01-24T18:15:43.207


Instruction: Please provide detailed information about CVE-2025-24702

CVE:CVE-2025-24702
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Xagio Xagio SEO allows Stored XSS. This issue affects Xagio SEO: from n/a through 7.0.0.20.
published:2025-01-24T18:15:43.360


Instruction: Please provide detailed information about CVE-2025-24703

CVE:CVE-2025-24703
Description:Server-Side Request Forgery (SSRF) vulnerability in DLX Plugins Comment Edit Core – Simple Comment Editing allows Server Side Request Forgery. This issue affects Comment Edit Core – Simple Comment Editing: from n/a through 3.0.33.
published:2025-01-24T18:15:43.520


Instruction: Please provide detailed information about CVE-2025-24704

CVE:CVE-2025-24704
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sebastian Zaha Magic the Gathering Card Tooltips allows Stored XSS. This issue affects Magic the Gathering Card Tooltips: from n/a through 3.4.0.
published:2025-01-24T18:15:43.680


Instruction: Please provide detailed information about CVE-2025-24705

CVE:CVE-2025-24705
Description:Missing Authorization vulnerability in Arshid WooCommerce Quick View allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WooCommerce Quick View: from n/a through 1.1.1.
published:2025-01-24T18:15:43.840


Instruction: Please provide detailed information about CVE-2025-24706

CVE:CVE-2025-24706
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MultiVendorX WC Marketplace allows Stored XSS. This issue affects WC Marketplace: from n/a through 4.2.13.
published:2025-01-24T18:15:44.003


Instruction: Please provide detailed information about CVE-2025-24709

CVE:CVE-2025-24709
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Plethora Plugins Plethora Plugins Tabs + Accordions allows Stored XSS. This issue affects Plethora Plugins Tabs + Accordions: from n/a through 1.1.5.
published:2025-01-24T18:15:44.170


Instruction: Please provide detailed information about CVE-2025-24711

CVE:CVE-2025-24711
Description:Cross-Site Request Forgery (CSRF) vulnerability in Wow-Company Popup Box allows Cross Site Request Forgery. This issue affects Popup Box: from n/a through 3.2.4.
published:2025-01-24T18:15:44.330


Instruction: Please provide detailed information about CVE-2025-24712

CVE:CVE-2025-24712
Description:Cross-Site Request Forgery (CSRF) vulnerability in RadiusTheme Radius Blocks allows Cross Site Request Forgery. This issue affects Radius Blocks: from n/a through 2.1.2.
published:2025-01-24T18:15:44.480


Instruction: Please provide detailed information about CVE-2025-24713

CVE:CVE-2025-24713
Description:Cross-Site Request Forgery (CSRF) vulnerability in Wow-Company Button Generator – easily Button Builder allows Cross Site Request Forgery. This issue affects Button Generator – easily Button Builder: from n/a through 3.1.1.
published:2025-01-24T18:15:44.630


Instruction: Please provide detailed information about CVE-2025-24714

CVE:CVE-2025-24714
Description:Cross-Site Request Forgery (CSRF) vulnerability in Wow-Company Bubble Menu – circle floating menu allows Cross Site Request Forgery. This issue affects Bubble Menu – circle floating menu: from n/a through 4.0.2.
published:2025-01-24T18:15:44.773


Instruction: Please provide detailed information about CVE-2025-24715

CVE:CVE-2025-24715
Description:Cross-Site Request Forgery (CSRF) vulnerability in Wow-Company Counter Box allows Cross Site Request Forgery. This issue affects Counter Box: from n/a through 2.0.5.
published:2025-01-24T18:15:44.913


Instruction: Please provide detailed information about CVE-2025-24716

CVE:CVE-2025-24716
Description:Cross-Site Request Forgery (CSRF) vulnerability in Wow-Company Herd Effects allows Cross Site Request Forgery. This issue affects Herd Effects: from n/a through 6.2.1.
published:2025-01-24T18:15:45.057


Instruction: Please provide detailed information about CVE-2025-24717

CVE:CVE-2025-24717
Description:Cross-Site Request Forgery (CSRF) vulnerability in Wow-Company Modal Window allows Cross Site Request Forgery. This issue affects Modal Window: from n/a through 6.1.4.
published:2025-01-24T18:15:45.210


Instruction: Please provide detailed information about CVE-2025-24719

CVE:CVE-2025-24719
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpdevart Widget Countdown allows Stored XSS. This issue affects Widget Countdown: from n/a through 2.7.1.
published:2025-01-24T18:15:45.360


Instruction: Please provide detailed information about CVE-2025-24720

CVE:CVE-2025-24720
Description:Cross-Site Request Forgery (CSRF) vulnerability in Wow-Company Sticky Buttons allows Cross Site Request Forgery. This issue affects Sticky Buttons: from n/a through 4.1.1.
published:2025-01-24T18:15:45.523


Instruction: Please provide detailed information about CVE-2025-24721

CVE:CVE-2025-24721
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Aleksandar Urošević Easy YouTube Gallery allows Stored XSS. This issue affects Easy YouTube Gallery: from n/a through 1.0.4.
published:2025-01-24T18:15:45.667


Instruction: Please provide detailed information about CVE-2025-24722

CVE:CVE-2025-24722
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in F.A.Q Builder Team FAQ Builder AYS allows Stored XSS. This issue affects FAQ Builder AYS: from n/a through 1.7.3.
published:2025-01-24T18:15:45.840


Instruction: Please provide detailed information about CVE-2025-24723

CVE:CVE-2025-24723
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodePeople Booking Calendar Contact Form allows Stored XSS. This issue affects Booking Calendar Contact Form: from n/a through 1.2.55.
published:2025-01-24T18:15:46.000


Instruction: Please provide detailed information about CVE-2025-24724

CVE:CVE-2025-24724
Description:Cross-Site Request Forgery (CSRF) vulnerability in Wow-Company Side Menu Lite allows Cross Site Request Forgery. This issue affects Side Menu Lite: from n/a through 5.3.1.
published:2025-01-24T18:15:46.170


Instruction: Please provide detailed information about CVE-2025-24725

CVE:CVE-2025-24725
Description:Missing Authorization vulnerability in ThimPress Thim Elementor Kit allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Thim Elementor Kit: from n/a through 1.2.8.
published:2025-01-24T18:15:46.357


Instruction: Please provide detailed information about CVE-2025-24726

CVE:CVE-2025-24726
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HT Plugins HT Conctact Form 7 allows Stored XSS. This issue affects HT Conctact Form 7: from n/a through 1.2.1.
published:2025-01-24T18:15:46.530


Instruction: Please provide detailed information about CVE-2025-24727

CVE:CVE-2025-24727
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodePeople Contact Form Email allows Stored XSS. This issue affects Contact Form Email: from n/a through 1.3.52.
published:2025-01-24T18:15:46.707


Instruction: Please provide detailed information about CVE-2025-24728

CVE:CVE-2025-24728
Description:Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Yannick Lefebvre Bug Library allows Blind SQL Injection. This issue affects Bug Library: from n/a through 2.1.4.
published:2025-01-24T18:15:46.877


Instruction: Please provide detailed information about CVE-2025-24729

CVE:CVE-2025-24729
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ElementInvader ElementInvader Addons for Elementor allows Stored XSS. This issue affects ElementInvader Addons for Elementor: from n/a through 1.3.3.
published:2025-01-24T18:15:47.037


Instruction: Please provide detailed information about CVE-2025-24730

CVE:CVE-2025-24730
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rextheme WP VR allows DOM-Based XSS. This issue affects WP VR: from n/a through 8.5.14.
published:2025-01-24T18:15:47.193


Instruction: Please provide detailed information about CVE-2025-24731

CVE:CVE-2025-24731
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in IP2Location Download IP2Location Country Blocker allows Stored XSS. This issue affects Download IP2Location Country Blocker: from n/a through 2.38.3.
published:2025-01-24T18:15:47.370


Instruction: Please provide detailed information about CVE-2025-24732

CVE:CVE-2025-24732
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Booking & Appointment - Repute Infosystems BookingPress allows DOM-Based XSS. This issue affects BookingPress: from n/a through 1.1.25.
published:2025-01-24T18:15:47.530


Instruction: Please provide detailed information about CVE-2025-24733

CVE:CVE-2025-24733
Description:Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AddonMaster Post Grid Master allows PHP Local File Inclusion. This issue affects Post Grid Master: from n/a through 3.4.12.
published:2025-01-24T18:15:47.697


Instruction: Please provide detailed information about CVE-2025-24736

CVE:CVE-2025-24736
Description:Missing Authorization vulnerability in Metaphor Creations Post Duplicator allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Post Duplicator: from n/a through 2.35.
published:2025-01-24T18:15:47.850


Instruction: Please provide detailed information about CVE-2025-24738

CVE:CVE-2025-24738
Description:Cross-Site Request Forgery (CSRF) vulnerability in NowButtons.com Call Now Button allows Cross Site Request Forgery. This issue affects Call Now Button: from n/a through 1.4.13.
published:2025-01-24T18:15:48.017


Instruction: Please provide detailed information about CVE-2025-24739

CVE:CVE-2025-24739
Description:Cross-Site Request Forgery (CSRF) vulnerability in FluentSMTP & WPManageNinja Team FluentSMTP allows Cross Site Request Forgery. This issue affects FluentSMTP: from n/a through 2.2.80.
published:2025-01-24T18:15:48.177


Instruction: Please provide detailed information about CVE-2025-24746

CVE:CVE-2025-24746
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Popup Maker Popup Maker allows Stored XSS. This issue affects Popup Maker: from n/a through 1.20.2.
published:2025-01-24T18:15:48.437


Instruction: Please provide detailed information about CVE-2025-24750

CVE:CVE-2025-24750
Description:Missing Authorization vulnerability in ExactMetrics ExactMetrics allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects ExactMetrics: from n/a through 8.1.0.
published:2025-01-24T18:15:48.663


Instruction: Please provide detailed information about CVE-2025-24751

CVE:CVE-2025-24751
Description:Missing Authorization vulnerability in GoDaddy CoBlocks allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects CoBlocks: from n/a through 3.1.13.
published:2025-01-24T18:15:48.810


Instruction: Please provide detailed information about CVE-2025-24753

CVE:CVE-2025-24753
Description:Missing Authorization vulnerability in Kadence WP Gutenberg Blocks by Kadence Blocks allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Gutenberg Blocks by Kadence Blocks: from n/a through 3.3.1.
published:2025-01-24T18:15:48.950


Instruction: Please provide detailed information about CVE-2025-24755

CVE:CVE-2025-24755
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in add-ons.org PDF Invoices for WooCommerce + Drag and Drop Template Builder allows Stored XSS. This issue affects PDF Invoices for WooCommerce + Drag and Drop Template Builder: from n/a through 4.6.0.
published:2025-01-24T18:15:49.160


Instruction: Please provide detailed information about CVE-2025-24756

CVE:CVE-2025-24756
Description:Cross-Site Request Forgery (CSRF) vulnerability in mgplugin Roi Calculator allows Stored XSS. This issue affects Roi Calculator: from n/a through 1.0.
published:2025-01-24T18:15:49.307


Instruction: Please provide detailed information about CVE-2025-0703

CVE:CVE-2025-0703
Description:A vulnerability, which was classified as problematic, has been found in JoeyBling bootplus up to 247d5f6c209be1a5cf10cd0fa18e1d8cc63cf55d. This issue affects some unknown processing of the file src/main/java/io/github/controller/SysFileController.java. The manipulation of the argument name leads to path traversal. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable.
published:2025-01-24T19:15:13.137


Instruction: Please provide detailed information about CVE-2025-0704

CVE:CVE-2025-0704
Description:A vulnerability, which was classified as problematic, was found in JoeyBling bootplus up to 247d5f6c209be1a5cf10cd0fa18e1d8cc63cf55d. Affected is the function qrCode of the file src/main/java/io/github/controller/QrCodeController.java. The manipulation of the argument w/h leads to resource consumption. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available.
published:2025-01-24T19:15:13.303


Instruction: Please provide detailed information about CVE-2025-0705

CVE:CVE-2025-0705
Description:A vulnerability has been found in JoeyBling bootplus up to 247d5f6c209be1a5cf10cd0fa18e1d8cc63cf55d and classified as problematic. Affected by this vulnerability is the function qrCode of the file src/main/java/io/github/controller/QrCodeController.java. The manipulation of the argument text leads to open redirect. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available.
published:2025-01-24T19:15:13.467


Instruction: Please provide detailed information about CVE-2025-24363

CVE:CVE-2025-24363
Description:The HL7 FHIR IG publisher is a tool to take a set of inputs and create a standard FHIR IG. Prior to version 1.8.9, in CI contexts, the IG Publisher CLI uses git commands to determine the URL of the originating repo. If the repo was cloned, or otherwise set to use a repo that uses a username and credential based URL, the entire URL will be included in the built Implementation Guide, exposing username and credential. This does not impact users that clone public repos without credentials, such as those using the auto-ig-build continuous integration infrastructure. This problem has been patched in release 1.8.9. Some workarounds are available. Users should ensure the IG repo they are publishing does not have username or credentials included in the `origin` URL. Running the command `git remote origin url` should return a URL that contains no username, password, or token; or users should run the IG Publisher CLI with the `-repo` parameter and specify a URL that contains no username, password, or token.
published:2025-01-24T19:15:13.633


Instruction: Please provide detailed information about CVE-2025-0706

CVE:CVE-2025-0706
Description:A vulnerability was found in JoeyBling bootplus up to 247d5f6c209be1a5cf10cd0fa18e1d8cc63cf55d and classified as problematic. Affected by this issue is some unknown functionality of the file /admin/sys/admin.html. The manipulation leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available.
published:2025-01-24T20:15:33.830


Instruction: Please provide detailed information about CVE-2025-0707

CVE:CVE-2025-0707
Description:A vulnerability was found in Rise Group Rise Mode Temp CPU 2.1. It has been classified as critical. This affects an unknown part in the library CRYPTBASE.dll of the component Startup. The manipulation leads to untrusted search path. The attack needs to be approached locally.
published:2025-01-24T20:15:34.020


Instruction: Please provide detailed information about CVE-2025-0708

CVE:CVE-2025-0708
Description:A vulnerability was found in fumiao opencms 2.2. It has been declared as problematic. This vulnerability affects unknown code of the file /admin/model/addOrUpdate of the component Add Model Management Page. The manipulation of the argument 模板前缀 leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
published:2025-01-24T20:15:34.200


Instruction: Please provide detailed information about CVE-2025-0709

CVE:CVE-2025-0709
Description:A vulnerability was found in Dcat-Admin 2.2.1-beta. It has been rated as problematic. This issue affects some unknown processing of the file /admin/auth/roles of the component Roles Page. The manipulation leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
published:2025-01-24T21:15:11.237


Instruction: Please provide detailed information about CVE-2025-0710

CVE:CVE-2025-0710
Description:A vulnerability classified as problematic has been found in CampCodes School Management Software 1.0. Affected is an unknown function of the file /notice-list of the component Notice Board Page. The manipulation of the argument Notice leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
published:2025-01-24T21:15:11.420


Instruction: Please provide detailed information about CVE-2025-21262

CVE:CVE-2025-21262
Description:User Interface (UI) Misrepresentation of Critical Information in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network
published:2025-01-24T22:15:38.220


Instruction: Please provide detailed information about CVE-2025-24360

CVE:CVE-2025-24360
Description:Nuxt is an open-source web development framework for Vue.js. Starting in version 3.8.1 and prior to version 3.15.3, Nuxt allows any websites to send any requests to the development server and read the response due to default CORS settings. Users with the default server.cors option using Vite builder may get the source code stolen by malicious websites. Version 3.15.3 fixes the vulnerability.
published:2025-01-25T01:15:24.047


Instruction: Please provide detailed information about CVE-2025-24361

CVE:CVE-2025-24361
Description:Nuxt is an open-source web development framework for Vue.js. Source code may be stolen during dev when using version 3.0.0 through 3.15.12 of the webpack builder or version 3.12.2 through 3.152 of the rspack builder and a victim opens a malicious web site. Because the request for classic script by a script tag is not subject to same origin policy, an attacker can inject a malicious script in their site and run the script. By using `Function::toString` against the values in `window.webpackChunknuxt_app`, the attacker can get the source code. Version 3.15.13 of Nuxt patches this issue.
published:2025-01-25T01:15:24.193


Instruction: Please provide detailed information about CVE-2025-0357

CVE:CVE-2025-0357
Description:The WPBookit plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'WPB_Profile_controller::handle_image_upload' function in versions up to, and including, 1.6.9. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
published:2025-01-25T02:15:26.990


Instruction: Please provide detailed information about CVE-2025-0411

CVE:CVE-2025-0411
Description:7-Zip Mark-of-the-Web Bypass Vulnerability. This vulnerability allows remote attackers to bypass the Mark-of-the-Web protection mechanism on affected installations of 7-Zip. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.  The specific flaw exists within the handling of archived files. When extracting files from a crafted archive that bears the Mark-of-the-Web, 7-Zip does not propagate the Mark-of-the-Web to the extracted files. An attacker can leverage this vulnerability to execute arbitrary code in the context of the current user. Was ZDI-CAN-25456.
published:2025-01-25T05:15:09.533


Instruction: Please provide detailed information about CVE-2025-0682

CVE:CVE-2025-0682
Description:The ThemeREX Addons plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.33.0 via the 'trx_sc_reviews' shortcode 'type' attribute. This makes it possible for authenticated attackers, with contributor-level and above permissions, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where php file type can be uploaded and included.
published:2025-01-25T06:15:28.740


Instruction: Please provide detailed information about CVE-2025-0350

CVE:CVE-2025-0350
Description:The Divi Carousel Maker – Image, Logo, Testimonial, Post Carousel & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Image Carousel and Logo Carousel in all versions up to, and including, 2.0.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
published:2025-01-25T10:15:08.160


Instruction: Please provide detailed information about CVE-2025-0542

CVE:CVE-2025-0542
Description:Local privilege escalation due to incorrect assignment of privileges of temporary files in the update mechanism of G DATA Management Server. This vulnerability allows a local, unprivileged attacker to escalate privileges on affected installations by placing a crafted ZIP archive in a globally writable directory, which gets unpacked in the context of SYSTEM and results in arbitrary file write.
published:2025-01-25T17:15:21.030


Instruction: Please provide detailed information about CVE-2025-0543

CVE:CVE-2025-0543
Description:Local privilege escalation in G DATA Security Client due to incorrect assignment of privileges to directories. This vulnerability allows a local, unprivileged attacker to escalate privileges on affected installations by placing an arbitrary executable in a globally writable directory resulting in execution by the SetupSVC.exe service in the context of SYSTEM.
published:2025-01-25T17:15:21.720


Instruction: Please provide detailed information about CVE-2025-24858

CVE:CVE-2025-24858
Description:Develocity (formerly Gradle Enterprise) before 2024.3.1 allows an attacker who has network access to a Develocity server to obtain the hashed password of the system user. The hash algorithm used by Develocity was chosen according to best practices for password storage and provides some protection against brute-force attempts. The applicable severity of this vulnerability depends on whether a Develocity server is accessible by external or unauthorized users, and the complexity of the System User password.
published:2025-01-26T06:15:23.470


Instruction: Please provide detailed information about CVE-2025-0720

CVE:CVE-2025-0720
Description:A vulnerability was found in Microword eScan Antivirus 7.0.32 on Linux. It has been rated as problematic. Affected by this issue is the function removeExtraSlashes of the file /opt/MicroWorld/sbin/rtscanner of the component Folder Watch List Handler. The manipulation leads to stack-based buffer overflow. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-01-26T23:15:21.547


Instruction: Please provide detailed information about CVE-2025-0721

CVE:CVE-2025-0721
Description:A vulnerability classified as problematic has been found in needyamin image_gallery 1.0. This affects the function image_gallery of the file /view.php. The manipulation of the argument username leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-01-27T00:15:26.317


Instruction: Please provide detailed information about CVE-2025-0722

CVE:CVE-2025-0722
Description:A vulnerability classified as critical was found in needyamin image_gallery 1.0. This vulnerability affects unknown code of the file /admin/gallery.php of the component Cover Image Handler. The manipulation of the argument image leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-01-27T00:15:26.517


Instruction: Please provide detailed information about CVE-2025-24389

CVE:CVE-2025-24389
Description:Certain errors of the upstream libraries will insert sensitive information in the OTRS or ((OTRS)) Community Edition log mechanism and mails send to the system administrator.  This issue affects:     *  OTRS 7.0.X    *  OTRS 8.0.X   *  OTRS 2023.X   *  OTRS 2024.X    *  ((OTRS)) Community Edition: 6.0.x  Products based on the ((OTRS)) Community Edition also very likely to be affected
published:2025-01-27T06:15:24.170


Instruction: Please provide detailed information about CVE-2025-24390

CVE:CVE-2025-24390
Description:A vulnerability in OTRS Application Server and reverse proxy settings allows session hijacking due to missing attributes for sensitive cookie settings in HTTPS sessions.  This issue affects:     *  OTRS 7.0.X    *  OTRS 8.0.X   *  OTRS 2023.X   *  OTRS 2024.X
published:2025-01-27T06:15:24.313


Instruction: Please provide detailed information about CVE-2025-24814

CVE:CVE-2025-24814
Description:Core creation allows users to replace "trusted" configset files with arbitrary configuration  Solr instances that (1) use the "FileSystemConfigSetService" component (the default in "standalone" or "user-managed" mode), and (2) are running without authentication and authorization are vulnerable to a sort of privilege escalation wherein individual "trusted" configset files can be ignored in favor of potentially-untrusted replacements available elsewhere on the filesystem.  These replacement config files are treated as "trusted" and can use "<lib>" tags to add to Solr's classpath, which an attacker might use to load malicious code as a searchComponent or other plugin.  This issue affects all Apache Solr versions up through Solr 9.7.  Users can protect against the vulnerability by enabling authentication and authorization on their Solr clusters or switching to SolrCloud (and away from "FileSystemConfigSetService").  Users are also recommended to upgrade to Solr 9.8.0, which mitigates this issue by disabling use of "<lib>" tags by default.
published:2025-01-27T09:15:14.947


Instruction: Please provide detailed information about CVE-2025-0695

CVE:CVE-2025-0695
Description:An Allocation of Resources Without Limits or Throttling vulnerability in Cesanta Frozen versions less than 1.7 allows an attacker to induce a crash of the component embedding the library by supplying a maliciously crafted JSON as input.
published:2025-01-27T11:15:11.087


Instruction: Please provide detailed information about CVE-2025-0696

CVE:CVE-2025-0696
Description:A NULL Pointer Dereference vulnerability in Cesanta Frozen versions less than 1.7 allows an attacker to induce a crash of the component embedding the library by supplying a maliciously crafted JSON as input.
published:2025-01-27T11:15:11.267


Instruction: Please provide detailed information about CVE-2025-22513

CVE:CVE-2025-22513
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound Simple Locator allows Reflected XSS. This issue affects Simple Locator: from n/a through 2.0.4.
published:2025-01-27T14:15:28.233


Instruction: Please provide detailed information about CVE-2025-23457

CVE:CVE-2025-23457
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Clodeo Shipdeo allows Reflected XSS. This issue affects Shipdeo: from n/a through 1.2.8.
published:2025-01-27T14:15:28.373


Instruction: Please provide detailed information about CVE-2025-23792

CVE:CVE-2025-23792
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Busters Passwordless WP – Login with your glance or fingerprint allows Reflected XSS. This issue affects Passwordless WP – Login with your glance or fingerprint: from n/a through 1.1.6.
published:2025-01-27T14:15:28.510


Instruction: Please provide detailed information about CVE-2025-24533

CVE:CVE-2025-24533
Description:Cross-Site Request Forgery (CSRF) vulnerability in MetaSlider Responsive Slider by MetaSlider allows Cross Site Request Forgery. This issue affects Responsive Slider by MetaSlider: from n/a through 3.92.0.
published:2025-01-27T14:15:28.653


Instruction: Please provide detailed information about CVE-2025-24584

CVE:CVE-2025-24584
Description:Missing Authorization vulnerability in BdThemes Ultimate Store Kit Elementor Addons allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Ultimate Store Kit Elementor Addons: from n/a through 2.3.0.
published:2025-01-27T14:15:28.797


Instruction: Please provide detailed information about CVE-2025-24601

CVE:CVE-2025-24601
Description:Deserialization of Untrusted Data vulnerability in ThimPress FundPress allows Object Injection. This issue affects FundPress: from n/a through 2.0.6.
published:2025-01-27T14:15:28.927


Instruction: Please provide detailed information about CVE-2025-24612

CVE:CVE-2025-24612
Description:Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in MORKVA Shipping for Nova Poshta allows SQL Injection. This issue affects Shipping for Nova Poshta: from n/a through 1.19.6.
published:2025-01-27T14:15:29.063


Instruction: Please provide detailed information about CVE-2025-24664

CVE:CVE-2025-24664
Description:Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Eniture Technology LTL Freight Quotes – Worldwide Express Edition allows SQL Injection. This issue affects LTL Freight Quotes – Worldwide Express Edition: from n/a through 5.0.20.
published:2025-01-27T14:15:29.197


Instruction: Please provide detailed information about CVE-2025-24685

CVE:CVE-2025-24685
Description:Path Traversal vulnerability in MORKVA Morkva UA Shipping allows PHP Local File Inclusion. This issue affects Morkva UA Shipping: from n/a through 1.0.18.
published:2025-01-27T14:15:29.333


Instruction: Please provide detailed information about CVE-2025-24754

CVE:CVE-2025-24754
Description:Missing Authorization vulnerability in Houzez.co Houzez. This issue affects Houzez: from n/a through 3.4.0.
published:2025-01-27T14:15:29.477