Instruction: Please provide detailed information about CVE-2025-22285

CVE:CVE-2025-22285
Description:Missing Authorization vulnerability in Eniture Technology Pallet Packaging for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Pallet Packaging for WooCommerce: from n/a through 1.1.15.
published:2025-04-04T14:15:21.460


Instruction: Please provide detailed information about CVE-2025-28146

CVE:CVE-2025-28146
Description:Edimax AC1200 Wave 2 Dual-Band Gigabit Router BR-6478AC V3 1.0.15 was discovered to contain a command injection vulnerability via fota_url in /boafrm/formLtefotaUpgradeQuectel
published:2025-04-04T14:15:21.603


Instruction: Please provide detailed information about CVE-2025-2798

CVE:CVE-2025-2798
Description:The Woffice CRM theme for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.4.21. This is due to a misconfiguration of excluded roles during registration. This makes it possible for unauthenticated attackers to register with an Administrator role if a custom login form is being used. This can be combined with CVE-2025-2797 to bypass the user approval process if an Administrator can be tricked into taking an action such as clicking a link.
published:2025-04-04T14:15:22.293


Instruction: Please provide detailed information about CVE-2025-31381

CVE:CVE-2025-31381
Description:Missing Authorization vulnerability in shiptrack Booking Calendar and Notification allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booking Calendar and Notification: from n/a through 4.0.3.
published:2025-04-04T14:15:22.630


Instruction: Please provide detailed information about CVE-2025-31384

CVE:CVE-2025-31384
Description:Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Aviplugins Videos allows Reflected XSS.This issue affects Videos: from n/a through 1.0.5.
published:2025-04-04T14:15:22.780


Instruction: Please provide detailed information about CVE-2025-31389

CVE:CVE-2025-31389
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sequel.Io Sequel allows Reflected XSS.This issue affects Sequel: from n/a through 1.0.11.
published:2025-04-04T14:15:22.940


Instruction: Please provide detailed information about CVE-2025-31403

CVE:CVE-2025-31403
Description:Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in shiptrack Booking Calendar and Notification allows Blind SQL Injection.This issue affects Booking Calendar and Notification: from n/a through 4.0.3.
published:2025-04-04T14:15:23.090


Instruction: Please provide detailed information about CVE-2025-31405

CVE:CVE-2025-31405
Description:Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in zankover Fami WooCommerce Compare allows PHP Local File Inclusion.This issue affects Fami WooCommerce Compare: from n/a through 1.0.5.
published:2025-04-04T14:15:23.253


Instruction: Please provide detailed information about CVE-2025-31407

CVE:CVE-2025-31407
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hutsixdigital Tiger allows Stored XSS.This issue affects Tiger: from n/a through 2.0.
published:2025-04-04T14:15:23.427


Instruction: Please provide detailed information about CVE-2025-31416

CVE:CVE-2025-31416
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AwesomeTOGI Awesome Event Booking allows Reflected XSS.This issue affects Awesome Event Booking: from n/a through 2.8.4.
published:2025-04-04T14:15:23.887


Instruction: Please provide detailed information about CVE-2025-31418

CVE:CVE-2025-31418
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in noonnoo Gravel allows Reflected XSS.This issue affects Gravel: from n/a through 1.6.
published:2025-04-04T14:15:24.053


Instruction: Please provide detailed information about CVE-2025-3249

CVE:CVE-2025-3249
Description:A vulnerability classified as critical was found in TOTOLINK A6000R 1.0.1-B20201211.2000. Affected by this vulnerability is the function apcli_cancel_wps of the file /usr/lib/lua/luci/controller/mtkwifi.lua. The manipulation leads to command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
published:2025-04-04T14:15:25.453


Instruction: Please provide detailed information about CVE-2025-27520

CVE:CVE-2025-27520
Description:BentoML is a Python library for building online serving systems optimized for AI apps and model inference. A Remote Code Execution (RCE) vulnerability caused by insecure deserialization has been identified in the latest version (v1.4.2) of BentoML. It allows any unauthenticated user to execute arbitrary code on the server. It exists an unsafe code segment in serde.py. This vulnerability is fixed in 1.4.3.
published:2025-04-04T15:15:47.927


Instruction: Please provide detailed information about CVE-2025-31130

CVE:CVE-2025-31130
Description:gitoxide is an implementation of git written in Rust. Before 0.42.0, gitoxide uses SHA-1 hash implementations without any collision detection, leaving it vulnerable to hash collision attacks. gitoxide uses the sha1_smol or sha1 crate, both of which implement standard SHA-1 without any mitigations for collision attacks. This means that two distinct Git objects with colliding SHA-1 hashes would break the Git object model and integrity checks when used with gitoxide. This vulnerability is fixed in 0.42.0.
published:2025-04-04T15:15:48.320


Instruction: Please provide detailed information about CVE-2025-31480

CVE:CVE-2025-31480
Description:aiven-extras is a PostgreSQL extension. This is a privilege escalation vulnerability, allowing elevation to superuser inside PostgreSQL databases that use the aiven-extras package. The vulnerability leverages the format function not being schema-prefixed. Affected users should install 1.1.16 and ensure they run the latest version issuing ALTER EXTENSION aiven_extras UPDATE TO '1.1.16' after installing it. This needs to happen in each database aiven_extras has been installed in.
published:2025-04-04T15:15:48.820


Instruction: Please provide detailed information about CVE-2025-3250

CVE:CVE-2025-3250
Description:A vulnerability, which was classified as problematic, has been found in elunez eladmin 2.7. Affected by this issue is some unknown functionality of the file /api/database/testConnect of the component Maintenance Management Module. The manipulation leads to deserialization. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
published:2025-04-04T15:15:51.340


Instruction: Please provide detailed information about CVE-2025-3251

CVE:CVE-2025-3251
Description:A vulnerability, which was classified as problematic, was found in xujiangfei admintwo 1.0. This affects an unknown part of the file /user/updateSet. The manipulation of the argument motto leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
published:2025-04-04T15:15:51.580


Instruction: Please provide detailed information about CVE-2025-0468

CVE:CVE-2025-0468
Description:Software installed and run as a non-privileged user may conduct improper GPU system calls to subvert GPU HW to write to arbitrary physical memory pages.  Under certain circumstances this exploit could be used to corrupt data pages not allocated by the GPU driver but memory pages in use by the kernel and drivers running on the platform altering their behaviour.
published:2025-04-04T16:15:17.873


Instruction: Please provide detailed information about CVE-2025-25178

CVE:CVE-2025-25178
Description:Software installed and run as a non-privileged user may conduct improper GPU system calls to cause kernel system memory corruption.
published:2025-04-04T16:15:18.170


Instruction: Please provide detailed information about CVE-2025-32112

CVE:CVE-2025-32112
Description:Cross-Site Request Forgery (CSRF) vulnerability in OTWthemes Sidebar Manager Light allows Cross Site Request Forgery. This issue affects Sidebar Manager Light: from n/a through 1.1.8.
published:2025-04-04T16:15:19.123


Instruction: Please provide detailed information about CVE-2025-32113

CVE:CVE-2025-32113
Description:Cross-Site Request Forgery (CSRF) vulnerability in Renzo Tejada Libro de Reclamaciones y Quejas allows Cross Site Request Forgery. This issue affects Libro de Reclamaciones y Quejas: from n/a through 0.9.
published:2025-04-04T16:15:19.270


Instruction: Please provide detailed information about CVE-2025-32118

CVE:CVE-2025-32118
Description:Unrestricted Upload of File with Dangerous Type vulnerability in NiteoThemes CMP – Coming Soon & Maintenance allows Using Malicious Files. This issue affects CMP – Coming Soon & Maintenance: from n/a through 4.1.13.
published:2025-04-04T16:15:19.413


Instruction: Please provide detailed information about CVE-2025-32120

CVE:CVE-2025-32120
Description:Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Erick Danzer Easy Query – WP Query Builder allows Blind SQL Injection. This issue affects Easy Query – WP Query Builder: from n/a through 2.0.4.
published:2025-04-04T16:15:19.567


Instruction: Please provide detailed information about CVE-2025-32121

CVE:CVE-2025-32121
Description:Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in SuitePlugins Video & Photo Gallery for Ultimate Member allows SQL Injection. This issue affects Video & Photo Gallery for Ultimate Member: from n/a through 1.1.3.
published:2025-04-04T16:15:19.710


Instruction: Please provide detailed information about CVE-2025-32122

CVE:CVE-2025-32122
Description:Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Stylemix uListing allows Blind SQL Injection. This issue affects uListing: from n/a through 2.1.9.
published:2025-04-04T16:15:19.873


Instruction: Please provide detailed information about CVE-2025-32124

CVE:CVE-2025-32124
Description:Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in eleopard Behance Portfolio Manager allows Blind SQL Injection. This issue affects Behance Portfolio Manager: from n/a through 1.7.4.
published:2025-04-04T16:15:20.027


Instruction: Please provide detailed information about CVE-2025-32125

CVE:CVE-2025-32125
Description:Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in silvasoft Silvasoft boekhouden allows SQL Injection. This issue affects Silvasoft boekhouden: from n/a through 3.0.1.
published:2025-04-04T16:15:20.177


Instruction: Please provide detailed information about CVE-2025-32126

CVE:CVE-2025-32126
Description:Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in cmsMinds Pay with Contact Form 7 allows SQL Injection. This issue affects Pay with Contact Form 7: from n/a through 1.0.4.
published:2025-04-04T16:15:20.323


Instruction: Please provide detailed information about CVE-2025-32127

CVE:CVE-2025-32127
Description:Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in onOffice GmbH onOffice for WP-Websites allows SQL Injection. This issue affects onOffice for WP-Websites: from n/a through 5.7.
published:2025-04-04T16:15:20.483


Instruction: Please provide detailed information about CVE-2025-32129

CVE:CVE-2025-32129
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Data443 Risk Migitation, Inc. Welcome Bar allows Stored XSS. This issue affects Welcome Bar: from n/a through 2.0.4.
published:2025-04-04T16:15:20.633


Instruction: Please provide detailed information about CVE-2025-32130

CVE:CVE-2025-32130
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Data443 Risk Migitation, Inc. Posts Footer Manager allows Stored XSS. This issue affects Posts Footer Manager: from n/a through 2.2.0.
published:2025-04-04T16:15:20.783


Instruction: Please provide detailed information about CVE-2025-32131

CVE:CVE-2025-32131
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in socialintents Social Intents allows Stored XSS. This issue affects Social Intents: from n/a through 1.6.14.
published:2025-04-04T16:15:20.940


Instruction: Please provide detailed information about CVE-2025-32132

CVE:CVE-2025-32132
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FunnelCockpit FunnelCockpit allows Stored XSS. This issue affects FunnelCockpit: from n/a through 1.4.2.
published:2025-04-04T16:15:21.100


Instruction: Please provide detailed information about CVE-2025-32133

CVE:CVE-2025-32133
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ays Pro Secure Copy Content Protection and Content Locking allows Stored XSS. This issue affects Secure Copy Content Protection and Content Locking: from n/a through 4.5.1.
published:2025-04-04T16:15:21.270


Instruction: Please provide detailed information about CVE-2025-32134

CVE:CVE-2025-32134
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in KaizenCoders URL Shortify allows Stored XSS. This issue affects URL Shortify: from n/a through 1.10.4.
published:2025-04-04T16:15:21.417


Instruction: Please provide detailed information about CVE-2025-32135

CVE:CVE-2025-32135
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in rocketelements Split Test For Elementor allows Stored XSS. This issue affects Split Test For Elementor: from n/a through 1.8.3.
published:2025-04-04T16:15:21.573


Instruction: Please provide detailed information about CVE-2025-32136

CVE:CVE-2025-32136
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in activecampaign ActiveCampaign allows Stored XSS. This issue affects ActiveCampaign: from n/a through 8.1.16.
published:2025-04-04T16:15:21.723


Instruction: Please provide detailed information about CVE-2025-32137

CVE:CVE-2025-32137
Description:Relative Path Traversal vulnerability in Cristián Lávaque s2Member allows Path Traversal. This issue affects s2Member: from n/a through 250214.
published:2025-04-04T16:15:21.883


Instruction: Please provide detailed information about CVE-2025-32138

CVE:CVE-2025-32138
Description:Improper Restriction of XML External Entity Reference vulnerability in supsystic Easy Google Maps allows XML Injection. This issue affects Easy Google Maps: from n/a through 1.11.17.
published:2025-04-04T16:15:22.060


Instruction: Please provide detailed information about CVE-2025-32141

CVE:CVE-2025-32141
Description:Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Stylemix MasterStudy LMS allows PHP Local File Inclusion. This issue affects MasterStudy LMS: from n/a through 3.5.23.
published:2025-04-04T16:15:22.223


Instruction: Please provide detailed information about CVE-2025-32142

CVE:CVE-2025-32142
Description:Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Stylemix Motors allows PHP Local File Inclusion. This issue affects Motors: from n/a through 1.4.65.
published:2025-04-04T16:15:22.403


Instruction: Please provide detailed information about CVE-2025-32146

CVE:CVE-2025-32146
Description:Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in JoomSky JS Job Manager allows PHP Local File Inclusion. This issue affects JS Job Manager: from n/a through 2.0.2.
published:2025-04-04T16:15:22.573


Instruction: Please provide detailed information about CVE-2025-32147

CVE:CVE-2025-32147
Description:Missing Authorization vulnerability in coothemes Easy WP Optimizer allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Easy WP Optimizer: from n/a through 1.1.0.
published:2025-04-04T16:15:22.740


Instruction: Please provide detailed information about CVE-2025-32148

CVE:CVE-2025-32148
Description:Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Daisycon Daisycon prijsvergelijkers allows SQL Injection. This issue affects Daisycon prijsvergelijkers: from n/a through 4.8.4.
published:2025-04-04T16:15:22.900


Instruction: Please provide detailed information about CVE-2025-32149

CVE:CVE-2025-32149
Description:Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in winkm89 teachPress allows SQL Injection. This issue affects teachPress: from n/a through 9.0.11.
published:2025-04-04T16:15:23.057


Instruction: Please provide detailed information about CVE-2025-32150

CVE:CVE-2025-32150
Description:Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Rameez Iqbal Real Estate Manager allows PHP Local File Inclusion. This issue affects Real Estate Manager: from n/a through 7.3.
published:2025-04-04T16:15:23.213


Instruction: Please provide detailed information about CVE-2025-32151

CVE:CVE-2025-32151
Description:Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Sven Lehnert BuddyForms allows PHP Local File Inclusion. This issue affects BuddyForms: from n/a through 2.8.15.
published:2025-04-04T16:15:23.370


Instruction: Please provide detailed information about CVE-2025-32152

CVE:CVE-2025-32152
Description:Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Essential Plugins by WP OnlineSupport Slider a SlidersPack allows PHP Local File Inclusion. This issue affects Slider a SlidersPack: from n/a through 2.3.
published:2025-04-04T16:15:23.533


Instruction: Please provide detailed information about CVE-2025-32153

CVE:CVE-2025-32153
Description:Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in vinagecko VG WooCarousel allows PHP Local File Inclusion. This issue affects VG WooCarousel: from n/a through 1.3.
published:2025-04-04T16:15:23.687


Instruction: Please provide detailed information about CVE-2025-32154

CVE:CVE-2025-32154
Description:Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Catch Themes Catch Dark Mode allows PHP Local File Inclusion. This issue affects Catch Dark Mode: from n/a through 1.2.1.
published:2025-04-04T16:15:23.833


Instruction: Please provide detailed information about CVE-2025-32155

CVE:CVE-2025-32155
Description:Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in markkinchin Beds24 Online Booking allows PHP Local File Inclusion. This issue affects Beds24 Online Booking: from n/a through 2.0.26.
published:2025-04-04T16:15:23.997


Instruction: Please provide detailed information about CVE-2025-32156

CVE:CVE-2025-32156
Description:Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Alex Prokopenko / JustCoded Just Post Preview Widget allows PHP Local File Inclusion. This issue affects Just Post Preview Widget: from n/a through 1.1.1.
published:2025-04-04T16:15:24.147


Instruction: Please provide detailed information about CVE-2025-32157

CVE:CVE-2025-32157
Description:Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Jakub Glos Sparkle Elementor Kit allows PHP Local File Inclusion. This issue affects Sparkle Elementor Kit: from n/a through 2.0.9.
published:2025-04-04T16:15:24.300


Instruction: Please provide detailed information about CVE-2025-32159

CVE:CVE-2025-32159
Description:Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in RadiusTheme Radius Blocks allows PHP Local File Inclusion. This issue affects Radius Blocks: from n/a through 2.2.1.
published:2025-04-04T16:15:24.457


Instruction: Please provide detailed information about CVE-2025-32161

CVE:CVE-2025-32161
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ryo Arkhe Blocks allows Stored XSS. This issue affects Arkhe Blocks: from n/a through 2.27.1.
published:2025-04-04T16:15:24.603


Instruction: Please provide detailed information about CVE-2025-32162

CVE:CVE-2025-32162
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Morgan Kay Chamber Dashboard Business Directory allows DOM-Based XSS. This issue affects Chamber Dashboard Business Directory: from n/a through 3.3.11.
published:2025-04-04T16:15:24.760


Instruction: Please provide detailed information about CVE-2025-32163

CVE:CVE-2025-32163
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Xpro Xpro Elementor Addons allows Stored XSS. This issue affects Xpro Elementor Addons: from n/a through 1.4.9.
published:2025-04-04T16:15:24.917


Instruction: Please provide detailed information about CVE-2025-32165

CVE:CVE-2025-32165
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in fromdoppler Doppler Forms allows Stored XSS. This issue affects Doppler Forms: from n/a through 2.4.5.
published:2025-04-04T16:15:25.070


Instruction: Please provide detailed information about CVE-2025-32166

CVE:CVE-2025-32166
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in John Housholder Emma for WordPress allows Stored XSS. This issue affects Emma for WordPress: from n/a through 1.3.3.
published:2025-04-04T16:15:25.217


Instruction: Please provide detailed information about CVE-2025-32167

CVE:CVE-2025-32167
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in devsoftbaltic SurveyJS allows Stored XSS. This issue affects SurveyJS: from n/a through 1.12.20.
published:2025-04-04T16:15:25.370


Instruction: Please provide detailed information about CVE-2025-32168

CVE:CVE-2025-32168
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodeYatri Gutenify allows Stored XSS. This issue affects Gutenify: from n/a through 1.4.9.
published:2025-04-04T16:15:25.527


Instruction: Please provide detailed information about CVE-2025-32169

CVE:CVE-2025-32169
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Suresh Prasad Showeblogin Social allows DOM-Based XSS. This issue affects Showeblogin Social: from n/a through 7.0.
published:2025-04-04T16:15:25.683


Instruction: Please provide detailed information about CVE-2025-32170

CVE:CVE-2025-32170
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Stylemix Motors allows Stored XSS. This issue affects Motors: from n/a through 1.4.65.
published:2025-04-04T16:15:25.847


Instruction: Please provide detailed information about CVE-2025-32171

CVE:CVE-2025-32171
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Imtiaz Rayhan Table Block by Tableberg allows Stored XSS. This issue affects Table Block by Tableberg: from n/a through 0.6.0.
published:2025-04-04T16:15:26.017


Instruction: Please provide detailed information about CVE-2025-32172

CVE:CVE-2025-32172
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Yuri Baranov YaMaps for WordPress allows Stored XSS. This issue affects YaMaps for WordPress: from n/a through 0.6.31.
published:2025-04-04T16:15:26.173


Instruction: Please provide detailed information about CVE-2025-32173

CVE:CVE-2025-32173
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins B Blocks - The ultimate block collection allows Stored XSS. This issue affects B Blocks - The ultimate block collection: from n/a through 2.0.0.
published:2025-04-04T16:15:26.343


Instruction: Please provide detailed information about CVE-2025-32174

CVE:CVE-2025-32174
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tockify Tockify Events Calendar allows DOM-Based XSS. This issue affects Tockify Events Calendar: from n/a through 2.2.13.
published:2025-04-04T16:15:26.500


Instruction: Please provide detailed information about CVE-2025-32175

CVE:CVE-2025-32175
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vektor,Inc. VK Filter Search allows Stored XSS. This issue affects VK Filter Search: from n/a through 2.14.1.0.
published:2025-04-04T16:15:26.660


Instruction: Please provide detailed information about CVE-2025-32176

CVE:CVE-2025-32176
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GalleryCreator Gallery Blocks with Lightbox allows Stored XSS. This issue affects Gallery Blocks with Lightbox: from n/a through 3.2.5.
published:2025-04-04T16:15:26.817


Instruction: Please provide detailed information about CVE-2025-32177

CVE:CVE-2025-32177
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pgn4web Embed Chessboard allows Stored XSS. This issue affects Embed Chessboard: from n/a through 3.07.00.
published:2025-04-04T16:15:26.993


Instruction: Please provide detailed information about CVE-2025-32178

CVE:CVE-2025-32178
Description:Missing Authorization vulnerability in 6Storage 6Storage Rentals allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects 6Storage Rentals: from n/a through 2.18.0.
published:2025-04-04T16:15:27.173


Instruction: Please provide detailed information about CVE-2025-32179

CVE:CVE-2025-32179
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in icopydoc Maps for WP allows Stored XSS. This issue affects Maps for WP: from n/a through 1.2.4.
published:2025-04-04T16:15:27.327


Instruction: Please provide detailed information about CVE-2025-32181

CVE:CVE-2025-32181
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Fast Simon Search, Filters & Merchandising for WooCommerce allows Stored XSS. This issue affects Search, Filters & Merchandising for WooCommerce: from n/a through 3.0.57.
published:2025-04-04T16:15:27.477


Instruction: Please provide detailed information about CVE-2025-32182

CVE:CVE-2025-32182
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Spider Themes Spider Elements – Addons for Elementor allows Stored XSS. This issue affects Spider Elements – Addons for Elementor: from n/a through 1.6.2.
published:2025-04-04T16:15:27.623


Instruction: Please provide detailed information about CVE-2025-32183

CVE:CVE-2025-32183
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Galaxy Weblinks Video Playlist For YouTube allows Stored XSS. This issue affects Video Playlist For YouTube: from n/a through 6.6.
published:2025-04-04T16:15:27.770


Instruction: Please provide detailed information about CVE-2025-32184

CVE:CVE-2025-32184
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bdthemes Ultimate Store Kit Elementor Addons allows Stored XSS. This issue affects Ultimate Store Kit Elementor Addons: from n/a through 2.4.0.
published:2025-04-04T16:15:27.930


Instruction: Please provide detailed information about CVE-2025-32185

CVE:CVE-2025-32185
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Extend Themes Colibri Page Builder allows Stored XSS. This issue affects Colibri Page Builder: from n/a through 1.0.319.
published:2025-04-04T16:15:28.083


Instruction: Please provide detailed information about CVE-2025-32186

CVE:CVE-2025-32186
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Turbo Addons Turbo Addons for Elementor allows DOM-Based XSS. This issue affects Turbo Addons for Elementor: from n/a through 1.7.1.
published:2025-04-04T16:15:28.243


Instruction: Please provide detailed information about CVE-2025-32187

CVE:CVE-2025-32187
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Quý Lê 91 Administrator Z allows DOM-Based XSS. This issue affects Administrator Z: from n/a through 2025.03.04.
published:2025-04-04T16:15:28.407


Instruction: Please provide detailed information about CVE-2025-32188

CVE:CVE-2025-32188
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ILLID Advanced Woo Labels allows Stored XSS. This issue affects Advanced Woo Labels: from n/a through 2.14.
published:2025-04-04T16:15:28.557


Instruction: Please provide detailed information about CVE-2025-32189

CVE:CVE-2025-32189
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Best WP Developer BWD Elementor Addons allows DOM-Based XSS. This issue affects BWD Elementor Addons: from n/a through 4.3.20.
published:2025-04-04T16:15:28.717


Instruction: Please provide detailed information about CVE-2025-32190

CVE:CVE-2025-32190
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in smartwpress Musician's Pack for Elementor allows DOM-Based XSS. This issue affects Musician's Pack for Elementor: from n/a through 1.8.4.
published:2025-04-04T16:15:28.897


Instruction: Please provide detailed information about CVE-2025-32191

CVE:CVE-2025-32191
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webangon News Element Elementor Blog Magazine allows DOM-Based XSS. This issue affects News Element Elementor Blog Magazine: from n/a through 1.0.7.
published:2025-04-04T16:15:29.040


Instruction: Please provide detailed information about CVE-2025-32192

CVE:CVE-2025-32192
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in UltraPress Ultra Addons Lite for Elementor allows Stored XSS. This issue affects Ultra Addons Lite for Elementor: from n/a through 1.1.8.
published:2025-04-04T16:15:29.187


Instruction: Please provide detailed information about CVE-2025-32193

CVE:CVE-2025-32193
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPMinds Simple WP Events allows Stored XSS. This issue affects Simple WP Events: from n/a through 1.8.17.
published:2025-04-04T16:15:29.343


Instruction: Please provide detailed information about CVE-2025-32194

CVE:CVE-2025-32194
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LA-Studio LA-Studio Element Kit for Elementor allows Stored XSS. This issue affects LA-Studio Element Kit for Elementor: from n/a through 1.4.9.
published:2025-04-04T16:15:29.490


Instruction: Please provide detailed information about CVE-2025-32195

CVE:CVE-2025-32195
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ecwid by Lightspeed Ecommerce Shopping Cart Ecwid Shopping Cart allows Stored XSS. This issue affects Ecwid Shopping Cart: from n/a through 7.0.
published:2025-04-04T16:15:29.640


Instruction: Please provide detailed information about CVE-2025-32196

CVE:CVE-2025-32196
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in blazethemes News Kit Elementor Addons allows Stored XSS. This issue affects News Kit Elementor Addons: from n/a through 1.3.1.
published:2025-04-04T16:15:29.790


Instruction: Please provide detailed information about CVE-2025-32197

CVE:CVE-2025-32197
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in piotnetdotcom Piotnet Addons For Elementor allows Stored XSS. This issue affects Piotnet Addons For Elementor: from n/a through 2.4.34.
published:2025-04-04T16:15:29.953


Instruction: Please provide detailed information about CVE-2025-32200

CVE:CVE-2025-32200
Description:Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Nikita Advanced WordPress Backgrounds allows Code Injection. This issue affects Advanced WordPress Backgrounds: from n/a through 1.12.4.
published:2025-04-04T16:15:30.107


Instruction: Please provide detailed information about CVE-2025-32201

CVE:CVE-2025-32201
Description:Missing Authorization vulnerability in Xpro Xpro Theme Builder allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Xpro Theme Builder: from n/a through 1.2.8.3.
published:2025-04-04T16:15:30.253


Instruction: Please provide detailed information about CVE-2025-32203

CVE:CVE-2025-32203
Description:Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in manu225 Falling things allows SQL Injection. This issue affects Falling things: from n/a through 1.08.
published:2025-04-04T16:15:30.407


Instruction: Please provide detailed information about CVE-2025-32204

CVE:CVE-2025-32204
Description:Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in rocketelements Split Test For Elementor allows SQL Injection. This issue affects Split Test For Elementor: from n/a through 1.8.2.
published:2025-04-04T16:15:30.560


Instruction: Please provide detailed information about CVE-2025-32207

CVE:CVE-2025-32207
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Anzar Ahmed Ni WooCommerce Cost Of Goods allows Stored XSS. This issue affects Ni WooCommerce Cost Of Goods: from n/a through 3.2.8.
published:2025-04-04T16:15:30.713


Instruction: Please provide detailed information about CVE-2025-32217

CVE:CVE-2025-32217
Description:Missing Authorization vulnerability in WP Messiah Ai Image Alt Text Generator for WP allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Ai Image Alt Text Generator for WP: from n/a through 1.0.8.
published:2025-04-04T16:15:30.873


Instruction: Please provide detailed information about CVE-2025-32218

CVE:CVE-2025-32218
Description:Missing Authorization vulnerability in RealMag777 TableOn – WordPress Posts Table Filterable allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects TableOn – WordPress Posts Table Filterable: from n/a through 1.0.4.
published:2025-04-04T16:15:31.043


Instruction: Please provide detailed information about CVE-2025-32219

CVE:CVE-2025-32219
Description:Missing Authorization vulnerability in Syntactics, Inc. eaSYNC allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects eaSYNC: from n/a through 1.3.19.
published:2025-04-04T16:15:31.200


Instruction: Please provide detailed information about CVE-2025-32220

CVE:CVE-2025-32220
Description:Missing Authorization vulnerability in Dimitri Grassi Salon booking system allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Salon booking system: from n/a through 10.10.7.
published:2025-04-04T16:15:31.357


Instruction: Please provide detailed information about CVE-2025-32224

CVE:CVE-2025-32224
Description:Missing Authorization vulnerability in shivammani Privyr CRM allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Privyr CRM: from n/a through 1.0.1.
published:2025-04-04T16:15:31.530


Instruction: Please provide detailed information about CVE-2025-32225

CVE:CVE-2025-32225
Description:Missing Authorization vulnerability in WP Event Manager WP Event Manager allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WP Event Manager: from n/a through 3.1.47.
published:2025-04-04T16:15:31.703


Instruction: Please provide detailed information about CVE-2025-32226

CVE:CVE-2025-32226
Description:Missing Authorization vulnerability in Anzar Ahmed Display product variations dropdown on shop page allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Display product variations dropdown on shop page: from n/a through 1.1.3.
published:2025-04-04T16:15:31.863


Instruction: Please provide detailed information about CVE-2025-32229

CVE:CVE-2025-32229
Description:Missing Authorization vulnerability in Bowo Variable Inspector allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Variable Inspector: from n/a through 2.6.3.
published:2025-04-04T16:15:32.040


Instruction: Please provide detailed information about CVE-2025-32231

CVE:CVE-2025-32231
Description:Missing Authorization vulnerability in Bookingor Bookingor allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Bookingor: from n/a through 1.0.6.
published:2025-04-04T16:15:32.223


Instruction: Please provide detailed information about CVE-2025-32232

CVE:CVE-2025-32232
Description:Missing Authorization vulnerability in ERA404 StaffList allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects StaffList: from n/a through 3.2.6.
published:2025-04-04T16:15:32.397


Instruction: Please provide detailed information about CVE-2025-32233

CVE:CVE-2025-32233
Description:Missing Authorization vulnerability in WP Chill Revive.so – Bulk Rewrite and Republish Blog Posts allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Revive.so – Bulk Rewrite and Republish Blog Posts: from n/a through 2.0.3.
published:2025-04-04T16:15:32.617


Instruction: Please provide detailed information about CVE-2025-32234

CVE:CVE-2025-32234
Description:Missing Authorization vulnerability in aleswebs AdMail – Multilingual Back in-Stock Notifier for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects AdMail – Multilingual Back in-Stock Notifier for WooCommerce: from n/a through 1.7.0.
published:2025-04-04T16:15:32.760


Instruction: Please provide detailed information about CVE-2025-32235

CVE:CVE-2025-32235
Description:Missing Authorization vulnerability in sonaar MP3 Audio Player for Music, Radio & Podcast by Sonaar allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects MP3 Audio Player for Music, Radio & Podcast by Sonaar: from n/a through 5.9.4.
published:2025-04-04T16:15:32.917


Instruction: Please provide detailed information about CVE-2025-32237

CVE:CVE-2025-32237
Description:Missing Authorization vulnerability in Stylemix MasterStudy LMS allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects MasterStudy LMS: from n/a through 3.5.23.
published:2025-04-04T16:15:33.077


Instruction: Please provide detailed information about CVE-2025-32238

CVE:CVE-2025-32238
Description:Generation of Error Message Containing Sensitive Information vulnerability in vcita Online Booking & Scheduling Calendar for WordPress by vcita allows Retrieve Embedded Sensitive Data. This issue affects Online Booking & Scheduling Calendar for WordPress by vcita: from n/a through 4.5.2.
published:2025-04-04T16:15:33.233


Instruction: Please provide detailed information about CVE-2025-32239

CVE:CVE-2025-32239
Description:Missing Authorization vulnerability in Joao Romao Social Share Buttons & Analytics Plugin – GetSocial.io allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Social Share Buttons & Analytics Plugin – GetSocial.io: from n/a through 4.5.
published:2025-04-04T16:15:33.383


Instruction: Please provide detailed information about CVE-2025-32241

CVE:CVE-2025-32241
Description:Cross-Site Request Forgery (CSRF) vulnerability in CleverReach® Official CleverReach Plugin for WooCommerce allows Cross Site Request Forgery. This issue affects Official CleverReach Plugin for WooCommerce: from n/a through 3.4.3.
published:2025-04-04T16:15:33.530


Instruction: Please provide detailed information about CVE-2025-32246

CVE:CVE-2025-32246
Description:Missing Authorization vulnerability in Tim Nguyen 1-Click Backup & Restore Database allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects 1-Click Backup & Restore Database: from n/a through 1.0.3.
published:2025-04-04T16:15:33.673


Instruction: Please provide detailed information about CVE-2025-32247

CVE:CVE-2025-32247
Description:Cross-Site Request Forgery (CSRF) vulnerability in ABCdatos AI Content Creator allows Cross Site Request Forgery. This issue affects AI Content Creator: from n/a through 1.2.6.
published:2025-04-04T16:15:33.820


Instruction: Please provide detailed information about CVE-2025-32248

CVE:CVE-2025-32248
Description:Cross-Site Request Forgery (CSRF) vulnerability in SwiftXR SwiftXR (3D/AR/VR) Viewer allows Cross Site Request Forgery. This issue affects SwiftXR (3D/AR/VR) Viewer: from n/a through 1.0.7.
published:2025-04-04T16:15:33.973


Instruction: Please provide detailed information about CVE-2025-32249

CVE:CVE-2025-32249
Description:Cross-Site Request Forgery (CSRF) vulnerability in designinvento DirectoryPress allows Cross Site Request Forgery. This issue affects DirectoryPress: from n/a through 3.6.19.
published:2025-04-04T16:15:34.123


Instruction: Please provide detailed information about CVE-2025-32250

CVE:CVE-2025-32250
Description:Cross-Site Request Forgery (CSRF) vulnerability in rollbar Rollbar allows Cross Site Request Forgery. This issue affects Rollbar: from n/a through 2.7.1.
published:2025-04-04T16:15:34.273


Instruction: Please provide detailed information about CVE-2025-32251

CVE:CVE-2025-32251
Description:Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in J. Tyler Wiest Jetpack Feedback Exporter allows Retrieve Embedded Sensitive Data. This issue affects Jetpack Feedback Exporter: from n/a through 1.23.
published:2025-04-04T16:15:34.423


Instruction: Please provide detailed information about CVE-2025-32252

CVE:CVE-2025-32252
Description:Missing Authorization vulnerability in blackandwhitedigital WP Genealogy – Your Family History Website allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WP Genealogy – Your Family History Website: from n/a through 0.1.9.
published:2025-04-04T16:15:34.573


Instruction: Please provide detailed information about CVE-2025-32253

CVE:CVE-2025-32253
Description:Missing Authorization vulnerability in ComMotion Course Booking System allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Course Booking System: from n/a through 6.0.5.
published:2025-04-04T16:15:34.720


Instruction: Please provide detailed information about CVE-2025-32254

CVE:CVE-2025-32254
Description:Missing Authorization vulnerability in Iqonic Design WPBookit allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects WPBookit: from n/a through 1.0.1.
published:2025-04-04T16:15:34.887


Instruction: Please provide detailed information about CVE-2025-32255

CVE:CVE-2025-32255
Description:Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in ERA404 StaffList allows Retrieve Embedded Sensitive Data. This issue affects StaffList: from n/a through 3.2.6.
published:2025-04-04T16:15:35.047


Instruction: Please provide detailed information about CVE-2025-32256

CVE:CVE-2025-32256
Description:Missing Authorization vulnerability in devsoftbaltic SurveyJS allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects SurveyJS: from n/a through 1.12.20.
published:2025-04-04T16:15:35.190


Instruction: Please provide detailed information about CVE-2025-32257

CVE:CVE-2025-32257
Description:Exposure of Sensitive System Information Due to Uncleared Debug Information vulnerability in 1clickmigration 1 Click WordPress Migration allows Retrieve Embedded Sensitive Data. This issue affects 1 Click WordPress Migration: from n/a through 2.2.
published:2025-04-04T16:15:35.343


Instruction: Please provide detailed information about CVE-2025-32258

CVE:CVE-2025-32258
Description:Missing Authorization vulnerability in InfoGiants Simple Website Logo allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Simple Website Logo: from n/a through 1.1.
published:2025-04-04T16:15:36.573


Instruction: Please provide detailed information about CVE-2025-32261

CVE:CVE-2025-32261
Description:Cross-Site Request Forgery (CSRF) vulnerability in Kuppuraj Advanced All in One Admin Search by WP Spotlight allows Cross Site Request Forgery. This issue affects Advanced All in One Admin Search by WP Spotlight: from n/a through 1.1.1.
published:2025-04-04T16:15:36.720


Instruction: Please provide detailed information about CVE-2025-32262

CVE:CVE-2025-32262
Description:Cross-Site Request Forgery (CSRF) vulnerability in Robert D Payne RDP Wiki Embed allows Cross Site Request Forgery. This issue affects RDP Wiki Embed: from n/a through 1.2.20.
published:2025-04-04T16:15:36.887


Instruction: Please provide detailed information about CVE-2025-32263

CVE:CVE-2025-32263
Description:Cross-Site Request Forgery (CSRF) vulnerability in BeRocket Sequential Order Numbers for WooCommerce allows Cross Site Request Forgery. This issue affects Sequential Order Numbers for WooCommerce: from n/a through 3.6.2.
published:2025-04-04T16:15:37.060


Instruction: Please provide detailed information about CVE-2025-32264

CVE:CVE-2025-32264
Description:Cross-Site Request Forgery (CSRF) vulnerability in Saiful Islam UltraAddons Elementor Lite allows Cross Site Request Forgery. This issue affects UltraAddons Elementor Lite: from n/a through 2.0.0.
published:2025-04-04T16:15:37.230


Instruction: Please provide detailed information about CVE-2025-32265

CVE:CVE-2025-32265
Description:Cross-Site Request Forgery (CSRF) vulnerability in Hossni Mubarak JobWP allows Cross Site Request Forgery. This issue affects JobWP: from n/a through 2.3.9.
published:2025-04-04T16:15:37.410


Instruction: Please provide detailed information about CVE-2025-32266

CVE:CVE-2025-32266
Description:Cross-Site Request Forgery (CSRF) vulnerability in wp-buy 404 Image Redirection (Replace Broken Images) allows Cross Site Request Forgery. This issue affects 404 Image Redirection (Replace Broken Images): from n/a through 1.4.
published:2025-04-04T16:15:37.560


Instruction: Please provide detailed information about CVE-2025-32267

CVE:CVE-2025-32267
Description:Cross-Site Request Forgery (CSRF) vulnerability in wpzinc Post to Social Media – WordPress to Hootsuite allows Cross Site Request Forgery. This issue affects Post to Social Media – WordPress to Hootsuite: from n/a through 1.5.8.
published:2025-04-04T16:15:37.713


Instruction: Please provide detailed information about CVE-2025-32268

CVE:CVE-2025-32268
Description:Cross-Site Request Forgery (CSRF) vulnerability in www.15.to QR Code Tag for WC allows Cross Site Request Forgery. This issue affects QR Code Tag for WC: from n/a through 1.9.36.
published:2025-04-04T16:15:37.870


Instruction: Please provide detailed information about CVE-2025-32269

CVE:CVE-2025-32269
Description:Cross-Site Request Forgery (CSRF) vulnerability in CRM Perks WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms allows Cross Site Request Forgery. This issue affects WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms: from n/a through 1.1.3.
published:2025-04-04T16:15:38.060


Instruction: Please provide detailed information about CVE-2025-32270

CVE:CVE-2025-32270
Description:Cross-Site Request Forgery (CSRF) vulnerability in Broadstreet Broadstreet allows Cross Site Request Forgery. This issue affects Broadstreet: from n/a through 1.51.1.
published:2025-04-04T16:15:38.213


Instruction: Please provide detailed information about CVE-2025-32271

CVE:CVE-2025-32271
Description:Cross-Site Request Forgery (CSRF) vulnerability in ablancodev Woocommerce Role Pricing allows Cross Site Request Forgery. This issue affects Woocommerce Role Pricing: from n/a through 3.5.5.
published:2025-04-04T16:15:38.370


Instruction: Please provide detailed information about CVE-2025-32272

CVE:CVE-2025-32272
Description:Cross-Site Request Forgery (CSRF) vulnerability in PickPlugins Wishlist allows Cross Site Request Forgery. This issue affects Wishlist: from n/a through 1.0.44.
published:2025-04-04T16:15:38.530


Instruction: Please provide detailed information about CVE-2025-32273

CVE:CVE-2025-32273
Description:Cross-Site Request Forgery (CSRF) vulnerability in freetobook Freetobook Responsive Widget allows Cross Site Request Forgery. This issue affects Freetobook Responsive Widget: from n/a through 1.1.
published:2025-04-04T16:15:38.677


Instruction: Please provide detailed information about CVE-2025-32274

CVE:CVE-2025-32274
Description:Cross-Site Request Forgery (CSRF) vulnerability in axew3 WP w3all phpBB allows Cross Site Request Forgery. This issue affects WP w3all phpBB: from n/a through 2.9.2.
published:2025-04-04T16:15:38.820


Instruction: Please provide detailed information about CVE-2025-32276

CVE:CVE-2025-32276
Description:Cross-Site Request Forgery (CSRF) vulnerability in Quý Lê 91 Administrator Z allows Cross Site Request Forgery. This issue affects Administrator Z: from n/a through 2025.03.04.
published:2025-04-04T16:15:39.007


Instruction: Please provide detailed information about CVE-2025-32277

CVE:CVE-2025-32277
Description:Missing Authorization vulnerability in Ateeq Rafeeq RepairBuddy allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects RepairBuddy: from n/a through 3.8211.
published:2025-04-04T16:15:39.170


Instruction: Please provide detailed information about CVE-2025-32278

CVE:CVE-2025-32278
Description:Cross-Site Request Forgery (CSRF) vulnerability in wprio Table Block by RioVizual allows Cross Site Request Forgery. This issue affects Table Block by RioVizual: from n/a through 2.1.7.
published:2025-04-04T16:15:39.307


Instruction: Please provide detailed information about CVE-2025-32280

CVE:CVE-2025-32280
Description:Cross-Site Request Forgery (CSRF) vulnerability in weDevs WP Project Manager allows Cross Site Request Forgery. This issue affects WP Project Manager: from n/a through 2.6.22.
published:2025-04-04T16:15:39.453


Instruction: Please provide detailed information about CVE-2025-3252

CVE:CVE-2025-3252
Description:A vulnerability has been found in xujiangfei admintwo 1.0 and classified as problematic. This vulnerability affects unknown code of the file /resource/add. The manipulation of the argument Name leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
published:2025-04-04T16:15:40.180


Instruction: Please provide detailed information about CVE-2025-3253

CVE:CVE-2025-3253
Description:A vulnerability was found in xujiangfei admintwo 1.0 and classified as problematic. This issue affects some unknown processing of the file /ztree/insertTree. The manipulation of the argument Name leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
published:2025-04-04T16:15:40.390


Instruction: Please provide detailed information about CVE-2025-3254

CVE:CVE-2025-3254
Description:A vulnerability was found in xujiangfei admintwo 1.0. It has been classified as critical. Affected is an unknown function of the file /resource/add. The manipulation of the argument description leads to server-side request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
published:2025-04-04T16:15:40.607


Instruction: Please provide detailed information about CVE-2025-3255

CVE:CVE-2025-3255
Description:A vulnerability was found in xujiangfei admintwo 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /user/home. The manipulation of the argument ID leads to improper access controls. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
published:2025-04-04T16:15:40.807


Instruction: Please provide detailed information about CVE-2025-3256

CVE:CVE-2025-3256
Description:A vulnerability was found in xujiangfei admintwo 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /user/updateSet. The manipulation of the argument email leads to improper access controls. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
published:2025-04-04T17:15:47.500


Instruction: Please provide detailed information about CVE-2025-3257

CVE:CVE-2025-3257
Description:A vulnerability classified as problematic has been found in xujiangfei admintwo 1.0. This affects an unknown part of the file /user/updateSet. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
published:2025-04-04T17:15:47.740


Instruction: Please provide detailed information about CVE-2025-3258

CVE:CVE-2025-3258
Description:A vulnerability classified as critical was found in PHPGurukul Old Age Home Management System 1.0. This vulnerability affects unknown code of the file /search.php. The manipulation of the argument searchdata leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
published:2025-04-04T17:15:47.977


Instruction: Please provide detailed information about CVE-2025-29476

CVE:CVE-2025-29476
Description:Buffer Overflow vulnerability in compress_chunk_fuzzer with oss-fuzz on commit 16450518afddcb3139de627157208e49bfef6987 in c-blosc2 v.2.17.0 and before.
published:2025-04-04T18:15:48.263


Instruction: Please provide detailed information about CVE-2025-29477

CVE:CVE-2025-29477
Description:An issue in fluent-bit v.3.7.2 allows a local attacker to cause a denial of service via the function consume_event.
published:2025-04-04T18:15:48.387


Instruction: Please provide detailed information about CVE-2025-3259

CVE:CVE-2025-3259
Description:A vulnerability, which was classified as critical, has been found in Tenda RX3 16.03.13.11. This issue affects the function formSetDeviceName of the file /goform/SetOnlineDevName. The manipulation of the argument devName leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
published:2025-04-04T18:15:49.137


Instruction: Please provide detailed information about CVE-2025-3265

CVE:CVE-2025-3265
Description:A vulnerability classified as critical was found in PHPGurukul e-Diary Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /add-category.php. The manipulation of the argument Category leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
published:2025-04-04T20:15:18.347


Instruction: Please provide detailed information about CVE-2025-3266

CVE:CVE-2025-3266
Description:A vulnerability, which was classified as critical, has been found in qinguoyi TinyWebServer up to 1.0. Affected by this issue is some unknown functionality of the file /http/http_conn.cpp. The manipulation of the argument name/password leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
published:2025-04-04T20:15:18.543


Instruction: Please provide detailed information about CVE-2025-3267

CVE:CVE-2025-3267
Description:A vulnerability, which was classified as critical, was found in qinguoyi TinyWebServer up to 1.0. This affects an unknown part of the file /http/http_conn.cpp. The manipulation of the argument name/password leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
published:2025-04-04T20:15:18.740


Instruction: Please provide detailed information about CVE-2025-3268

CVE:CVE-2025-3268
Description:A vulnerability has been found in qinguoyi TinyWebServer up to 1.0 and classified as critical. This vulnerability affects unknown code of the file http/http_conn.cpp. The manipulation of the argument m_url_real leads to improper authentication. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
published:2025-04-04T21:15:51.557


Instruction: Please provide detailed information about CVE-2025-2889

CVE:CVE-2025-2889
Description:The Link Library plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Link Additional Parameters in all versions up to, and including, 7.7.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
published:2025-04-05T00:15:15.287


Instruction: Please provide detailed information about CVE-2025-1500

CVE:CVE-2025-1500
Description:IBM Maximo Application Suite 9.0 could allow an authenticated user to upload a file with dangerous types that could be executed by another user if opened.
published:2025-04-05T01:15:42.000


Instruction: Please provide detailed information about CVE-2025-0810

CVE:CVE-2025-0810
Description:The Read More & Accordion plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.4.5. This is due to missing or incorrect nonce validation on the addNewButtons() function. This makes it possible for unauthenticated attackers to include and execute arbitrary PHP files via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
published:2025-04-05T02:15:15.140


Instruction: Please provide detailed information about CVE-2025-2544

CVE:CVE-2025-2544
Description:The AI Content Pipelines plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
published:2025-04-05T02:15:15.307


Instruction: Please provide detailed information about CVE-2025-2933

CVE:CVE-2025-2933
Description:The Email Notifications for Updates plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the awun_import_settings() function in all versions up to, and including, 1.1.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site.
published:2025-04-05T02:15:15.477


Instruction: Please provide detailed information about CVE-2025-32352

CVE:CVE-2025-32352
Description:A type confusion vulnerability in lib/NSSAuthenticator.php in ZendTo before v5.04-7 allows remote attackers to bypass authentication for users with passwords stored as MD5 hashes that can be interpreted as numbers. A solution requires moving from MD5 to bcrypt.
published:2025-04-05T05:15:44.693


Instruction: Please provide detailed information about CVE-2025-0839

CVE:CVE-2025-0839
Description:The ZoomSounds plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 6.91 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
published:2025-04-05T06:15:39.050


Instruction: Please provide detailed information about CVE-2025-1233

CVE:CVE-2025-1233
Description:The Lafka Plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the 'lafka_options_upload' AJAX function in all versions up to, and including, 7.1.0. This makes it possible for authenticated attackers, with subscriber-level access and above, to update the theme option that overrides the site.
published:2025-04-05T06:15:39.223


Instruction: Please provide detailed information about CVE-2025-2789

CVE:CVE-2025-2789
Description:The MultiVendorX – Empower Your WooCommerce Store with a Dynamic Multivendor Marketplace – Build the Next Amazon, eBay, Etsy plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the delete_table_rate_shipping_row function in all versions up to, and including, 4.2.19. This makes it possible for unauthenticated attackers to delete Table Rates that can impact the shipping cost calculations.
published:2025-04-05T06:15:39.477


Instruction: Please provide detailed information about CVE-2025-2941

CVE:CVE-2025-2941
Description:The Drag and Drop Multiple File Upload for WooCommerce plugin for WordPress is vulnerable to arbitrary file moving due to insufficient file path validation via the wc-upload-file[] parameter in all versions up to, and including, 1.1.4. This makes it possible for unauthenticated attackers to move arbitrary files on the server, which can easily lead to remote code execution when the right file is moved (such as wp-config.php).
published:2025-04-05T07:15:40.107


Instruction: Please provide detailed information about CVE-2025-3296

CVE:CVE-2025-3296
Description:A vulnerability, which was classified as critical, has been found in SourceCodester Online Eyewear Shop 1.0. This issue affects some unknown processing of the file /classes/Users.php?f=delete_customer. The manipulation of the argument ID leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
published:2025-04-05T08:15:13.787


Instruction: Please provide detailed information about CVE-2025-3297

CVE:CVE-2025-3297
Description:A vulnerability, which was classified as problematic, was found in SourceCodester Online Eyewear Shop 1.0. Affected is an unknown function of the file /classes/Master.php?f=save_product. The manipulation of the argument brand leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.
published:2025-04-05T09:15:15.237


Instruction: Please provide detailed information about CVE-2025-3298

CVE:CVE-2025-3298
Description:A vulnerability has been found in SourceCodester Online Eyewear Shop 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /oews/classes/Master.php?f=save_product of the component Registration Handler. The manipulation of the argument email leads to improper access controls. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
published:2025-04-05T11:15:40.917


Instruction: Please provide detailed information about CVE-2025-3299

CVE:CVE-2025-3299
Description:A vulnerability was found in PHPGurukul Men Salon Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /appointment.php. The manipulation of the argument Name leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
published:2025-04-05T11:15:41.180


Instruction: Please provide detailed information about CVE-2025-30401

CVE:CVE-2025-30401
Description:A spoofing issue in WhatsApp for Windows prior to version 2.2450.6 displayed attachments according to their MIME type but selected the file opening handler based on the attachment’s filename extension. A maliciously crafted mismatch could have caused the recipient to inadvertently execute arbitrary code rather than view the attachment when manually opening the attachment inside WhatsApp. We have not seen evidence of exploitation in the wild.
published:2025-04-05T12:15:14.540


Instruction: Please provide detailed information about CVE-2025-32357

CVE:CVE-2025-32357
Description:In Zammad 6.4.x before 6.4.2, an authenticated agent with knowledge base permissions was able to use the Zammad API to fetch knowledge base content that they have no permission for.
published:2025-04-05T21:15:39.450


Instruction: Please provide detailed information about CVE-2025-32358

CVE:CVE-2025-32358
Description:In Zammad 6.4.x before 6.4.2, SSRF can occur. Authenticated admin users can enable webhooks in Zammad, which are triggered as POST requests when certain conditions are met. If a webhook endpoint returned a redirect response, Zammad would follow it automatically with another GET request. This could be abused by an attacker to cause GET requests for example in the local network.
published:2025-04-05T21:15:40.487


Instruction: Please provide detailed information about CVE-2025-32359

CVE:CVE-2025-32359
Description:In Zammad 6.4.x before 6.4.2, there is client-side enforcement of server-side security. When changing their two factor authentication configuration, users need to re-authenticate with their current password first. However, this change was enforced in Zammad only on the front end level, and not when using the API directly.
published:2025-04-05T21:15:40.657


Instruction: Please provide detailed information about CVE-2025-32360

CVE:CVE-2025-32360
Description:In Zammad 6.4.x before 6.4.2, there is information exposure. Only agents should be able to see and work on shared article drafts. However, a logged in customer was able to see details about shared drafts for their customer tickets in the browser console, which may contain confidential information, and also to manipulate them via API.
published:2025-04-05T21:15:40.820


Instruction: Please provide detailed information about CVE-2025-3303

CVE:CVE-2025-3303
Description:A vulnerability, which was classified as critical, has been found in code-projects Patient Record Management System 1.0. Affected by this issue is some unknown functionality of the file /birthing_record.php. The manipulation of the argument itr_no leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
published:2025-04-05T21:15:40.990


Instruction: Please provide detailed information about CVE-2025-32364

CVE:CVE-2025-32364
Description:A floating-point exception in the PSStack::roll function of Poppler before 25.04.0 can cause an application to crash when handling malformed inputs associated with INT_MIN.
published:2025-04-05T22:15:18.337


Instruction: Please provide detailed information about CVE-2025-32365

CVE:CVE-2025-32365
Description:Poppler before 25.04.0 allows crafted input files to trigger out-of-bounds reads in the JBIG2Bitmap::combine function in JBIG2Stream.cc because of a misplaced isOk check.
published:2025-04-05T22:15:19.010


Instruction: Please provide detailed information about CVE-2025-3304

CVE:CVE-2025-3304
Description:A vulnerability, which was classified as critical, was found in code-projects Patient Record Management System 1.0. This affects an unknown part of the file /dental_not.php. The manipulation of the argument itr_no leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
published:2025-04-05T22:15:19.203


Instruction: Please provide detailed information about CVE-2025-32366

CVE:CVE-2025-32366
Description:In ConnMan through 1.44, parse_rr in dnsproxy.c has a memcpy length that depends on an RR RDLENGTH value, i.e., *rdlen=ntohs(rr->rdlen) and memcpy(response+offset,*end,*rdlen).
published:2025-04-05T23:15:40.910


Instruction: Please provide detailed information about CVE-2025-3305

CVE:CVE-2025-3305
Description:A vulnerability has been found in 1902756969/code-projects IKUN_Library 1.0 and classified as problematic. This vulnerability affects the function addInterceptors of the file MvcConfig.java of the component Borrow Handler. The manipulation leads to improper access controls. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
published:2025-04-05T23:15:41.780


Instruction: Please provide detailed information about CVE-2025-3306

CVE:CVE-2025-3306
Description:A vulnerability was found in code-projects Blood Bank Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /don.php. The manipulation of the argument fullname leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.
published:2025-04-06T01:15:40.663


Instruction: Please provide detailed information about CVE-2025-3307

CVE:CVE-2025-3307
Description:A vulnerability was found in code-projects Blood Bank Management System 1.0. It has been classified as critical. Affected is an unknown function of the file /reset.php. The manipulation of the argument useremail leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
published:2025-04-06T03:15:15.603


Instruction: Please provide detailed information about CVE-2025-3308

CVE:CVE-2025-3308
Description:A vulnerability was found in code-projects Blood Bank Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /viewrequest.php. The manipulation of the argument ID leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
published:2025-04-06T04:15:15.887


Instruction: Please provide detailed information about CVE-2025-1264

CVE:CVE-2025-1264
Description:The Broken Link Checker by AIOSEO – Easily Fix/Monitor Internal and External links plugin for WordPress is vulnerable to SQL Injection via the 'orderBy' parameter in all versions up to, and including, 1.2.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
published:2025-04-06T05:15:15.400


Instruction: Please provide detailed information about CVE-2025-32369

CVE:CVE-2025-32369
Description:Kentico Xperience before 13.0.181 allows authenticated users to distribute malicious content (for stored XSS) via certain interactions with the media library file upload feature.
published:2025-04-06T06:15:15.470


Instruction: Please provide detailed information about CVE-2025-3309

CVE:CVE-2025-3309
Description:A vulnerability was found in code-projects Blood Bank Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin/campsdetails.php. The manipulation of the argument hospital leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
published:2025-04-06T06:15:17.530


Instruction: Please provide detailed information about CVE-2025-3310

CVE:CVE-2025-3310
Description:A vulnerability classified as critical has been found in code-projects Blood Bank Management System 1.0. This affects an unknown part of the file /admin/delete.php. The manipulation of the argument Search leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
published:2025-04-06T06:15:17.980


Instruction: Please provide detailed information about CVE-2025-32370

CVE:CVE-2025-32370
Description:Kentico Xperience before 13.0.178 has a specific set of allowed ContentUploader file extensions for unauthenticated uploads; however, because .zip is processed through TryZipProviderSafe, there is additional functionality to create files with other extensions. NOTE: this is a separate issue not necessarily related to SVG or XSS.
published:2025-04-06T07:15:40.970


Instruction: Please provide detailed information about CVE-2025-3311

CVE:CVE-2025-3311
Description:A vulnerability classified as critical was found in PHPGurukul Men Salon Management System 1.0. This vulnerability affects unknown code of the file /admin/about-us.php. The manipulation of the argument pagetitle leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
published:2025-04-06T07:15:41.690


Instruction: Please provide detailed information about CVE-2025-3312

CVE:CVE-2025-3312
Description:A vulnerability, which was classified as critical, has been found in PHPGurukul Men Salon Management System 1.0. This issue affects some unknown processing of the file /admin/add-customer-services.php. The manipulation of the argument sids[] leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
published:2025-04-06T07:15:42.910


Instruction: Please provide detailed information about CVE-2025-3313

CVE:CVE-2025-3313
Description:A vulnerability, which was classified as critical, was found in PHPGurukul Men Salon Management System 1.0. Affected is an unknown function of the file /admin/add-customer.php. The manipulation of the argument Name leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
published:2025-04-06T08:15:14.077


Instruction: Please provide detailed information about CVE-2025-3314

CVE:CVE-2025-3314
Description:A vulnerability has been found in SourceCodester Apartment Visitor Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /forgotpw.php. The manipulation of the argument secode leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
published:2025-04-06T09:15:14.670


Instruction: Please provide detailed information about CVE-2025-3315

CVE:CVE-2025-3315
Description:A vulnerability was found in SourceCodester Apartment Visitor Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /view-report.php. The manipulation of the argument fromdate/todate leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
published:2025-04-06T10:15:14.840


Instruction: Please provide detailed information about CVE-2025-3316

CVE:CVE-2025-3316
Description:A vulnerability was found in PHPGurukul Men Salon Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /admin/search-invoices.php. The manipulation of the argument searchdata leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
published:2025-04-06T11:15:39.240


Instruction: Please provide detailed information about CVE-2025-3317

CVE:CVE-2025-3317
Description:A vulnerability classified as problematic has been found in fumiao opencms up to a0fafa5cff58719e9b27c2a2eec204cc165ce14f. Affected is an unknown function of the file opencms-dev/src/main/webapp/view/admin/document/dataPage.jsp. The manipulation of the argument path leads to path traversal. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available.
published:2025-04-06T12:15:14.923


Instruction: Please provide detailed information about CVE-2025-3318

CVE:CVE-2025-3318
Description:A vulnerability classified as critical was found in Kenj_Frog 肯尼基蛙 company-financial-management 公司财务管理系统 1.0. Affected by this vulnerability is the function page of the file src/main/java/com/controller/ShangpinleixingController.java. The manipulation of the argument sort leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available.
published:2025-04-06T14:15:35.690


Instruction: Please provide detailed information about CVE-2025-2258

CVE:CVE-2025-2258
Description:In NetX Duo component HTTP server functionality of Eclipse ThreadX NetX Duo before  version 6.4.3, an attacker can cause an integer underflow and a  subsequent denial of service by writing a very large file, by specially  crafted packets with Content-Length smaller than the data request size. A  possible workaround is to disable HTTP PUT support.     This issue follows an uncomplete fix in CVE-2025-0728.
published:2025-04-06T19:15:40.197


Instruction: Please provide detailed information about CVE-2025-2259

CVE:CVE-2025-2259
Description:In NetX HTTP server functionality of Eclipse ThreadX NetX Duo before  version 6.4.3, an attacker can cause an integer underflow and a  subsequent denial of service by writing a very large file, by specially  crafted packets with Content-Length in one packet smaller than the data  request size of the other packet. A possible workaround is to disable  HTTP PUT support.     This issue follows an incomplete fix of CVE-2025-0727
published:2025-04-06T19:15:41.020


Instruction: Please provide detailed information about CVE-2025-2260

CVE:CVE-2025-2260
Description:In NetX HTTP server functionality of Eclipse ThreadX NetX Duo before  version 6.4.3, an attacker can cause a denial of service by specially  crafted packets. The core issue is missing closing of a file in case of  an error condition, resulting in the 404 error for each further file  request. Users can work-around the issue by disabling the PUT request  support.     This issue follows an incomplete fix of CVE-2025-0726.
published:2025-04-06T19:15:41.153


Instruction: Please provide detailed information about CVE-2025-31488

CVE:CVE-2025-31488
Description:Plain Craft Launcher (PCL) is a launcher for Minecraft. PCL allows users to use homepages provided by third parties. If controls such as WebBrowser are used in the homepage, WPF will use Internet Explorer to load the specified webpage. If the user uses a malicious homepage, the attacker can use IE background to access the specified webpage without knowing it. This vulnerability is fixed in 2.9.3.
published:2025-04-06T20:15:14.310


Instruction: Please provide detailed information about CVE-2025-31492

CVE:CVE-2025-31492
Description:mod_auth_openidc is an OpenID Certified authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality. Prior to 2.4.16.11, a bug in a mod_auth_openidc results in disclosure of protected content to unauthenticated users. The conditions for disclosure are an OIDCProviderAuthRequestMethod POST, a valid account, and there mustn't be any application-level gateway (or load balancer etc) protecting the server. When you request a protected resource, the response includes the HTTP status, the HTTP headers, the intended response (the self-submitting form), and the protected resource (with no headers). This is an example of a request for a protected resource, including all the data returned. In the case where mod_auth_openidc returns a form, it has to return OK from check_userid so as not to go down the error path in httpd. This means httpd will try to issue the protected resource. oidc_content_handler is called early, which has the opportunity to prevent the normal output being issued by httpd. oidc_content_handler has a number of checks for when it intervenes, but it doesn't check for this case, so the handler returns DECLINED. Consequently, httpd appends the protected content to the response. The issue has been patched in mod_auth_openidc versions >= 2.4.16.11.
published:2025-04-06T20:15:15.063


Instruction: Please provide detailed information about CVE-2025-32013

CVE:CVE-2025-32013
Description:LNbits is a Lightning wallet and accounts system. A Server-Side Request Forgery (SSRF) vulnerability has been discovered in LNbits' LNURL authentication handling functionality. When processing LNURL authentication requests, the application accepts a callback URL parameter and makes an HTTP request to that URL using the httpx library with redirect following enabled. The application doesn't properly validate the callback URL, allowing attackers to specify internal network addresses and access internal resources.
published:2025-04-06T20:15:15.217


Instruction: Please provide detailed information about CVE-2025-3323

CVE:CVE-2025-3323
Description:A vulnerability classified as critical was found in godcheese/code-projects Nimrod 0.8. Affected by this vulnerability is an unknown functionality of the file ViewMenuCategoryRestController.java. The manipulation of the argument Name leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
published:2025-04-06T22:15:28.400


Instruction: Please provide detailed information about CVE-2025-3324

CVE:CVE-2025-3324
Description:A vulnerability, which was classified as critical, has been found in godcheese/code-projects Nimrod 0.8. Affected by this issue is some unknown functionality of the file FileRestController.java. The manipulation of the argument File leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
published:2025-04-06T23:15:39.443


Instruction: Please provide detailed information about CVE-2025-3325

CVE:CVE-2025-3325
Description:A vulnerability, which was classified as problematic, was found in iteaj iboot 物联网网关 1.1.3. This affects an unknown part of the file /core/admin/pwd of the component Admin Password Handler. The manipulation of the argument ID leads to improper access controls. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
published:2025-04-06T23:15:39.640


Instruction: Please provide detailed information about CVE-2025-3326

CVE:CVE-2025-3326
Description:A vulnerability has been found in iteaj iboot 物联网网关 1.1.3 and classified as problematic. This vulnerability affects unknown code of the file /common/upload of the component File Upload. The manipulation of the argument File leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
published:2025-04-07T00:15:14.603


Instruction: Please provide detailed information about CVE-2025-3327

CVE:CVE-2025-3327
Description:A vulnerability was found in iteaj iboot 物联网网关 1.1.3 and classified as problematic. This issue affects some unknown processing of the file /common/upload/batch of the component File Upload. The manipulation of the argument File leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
published:2025-04-07T01:15:42.750


Instruction: Please provide detailed information about CVE-2025-3328

CVE:CVE-2025-3328
Description:A vulnerability was found in Tenda AC1206 15.03.06.23. It has been classified as critical. Affected is the function form_fast_setting_wifi_set of the file /goform/fast_setting_wifi_set. The manipulation of the argument ssid/timeZone leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.
published:2025-04-07T01:15:42.953


Instruction: Please provide detailed information about CVE-2025-3329

CVE:CVE-2025-3329
Description:A vulnerability classified as problematic has been found in Consumer Comanda Mobile up to 14.9.3.2/15.0.0.8. This affects an unknown part of the component Restaurant Order Handler. The manipulation of the argument Login/Password leads to cleartext transmission of sensitive information. The attack can only be initiated within the local network. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used.
published:2025-04-07T01:15:43.157


Instruction: Please provide detailed information about CVE-2025-3330

CVE:CVE-2025-3330
Description:A vulnerability classified as critical was found in codeprojects Online Restaurant Management System 1.0. This vulnerability affects unknown code of the file /reservation_save.php. The manipulation of the argument first leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.
published:2025-04-07T02:15:15.950


Instruction: Please provide detailed information about CVE-2025-20102

CVE:CVE-2025-20102
Description:in OpenHarmony v5.0.2 and prior versions allow a local attacker cause DOS through  out-of-bounds read.
published:2025-04-07T03:15:20.457


Instruction: Please provide detailed information about CVE-2025-22452

CVE:CVE-2025-22452
Description:in OpenHarmony v5.0.2 and prior versions allow a local attacker cause DOS through  out-of-bounds read.
published:2025-04-07T03:15:20.647


Instruction: Please provide detailed information about CVE-2025-22842

CVE:CVE-2025-22842
Description:in OpenHarmony v5.0.2 and prior versions allow a local attacker cause DOS through  out-of-bounds read.
published:2025-04-07T03:15:20.807


Instruction: Please provide detailed information about CVE-2025-22851

CVE:CVE-2025-22851
Description:in OpenHarmony v5.0.2 and prior versions allow a local attacker arbitrary code execution in pre-installed apps through integer overflow.
published:2025-04-07T03:15:20.967


Instruction: Please provide detailed information about CVE-2025-24304

CVE:CVE-2025-24304
Description:in OpenHarmony v5.0.2 and prior versions allow a local attacker cause DOS through  out-of-bounds write.
published:2025-04-07T03:15:21.110


Instruction: Please provide detailed information about CVE-2025-25057

CVE:CVE-2025-25057
Description:in OpenHarmony v5.0.2 and prior versions allow a local attacker case DOS through missing release of memory.
published:2025-04-07T03:15:21.280


Instruction: Please provide detailed information about CVE-2025-27534

CVE:CVE-2025-27534
Description:in OpenHarmony v5.0.2 and prior versions allow a local attacker case DOS through missing release of memory.
published:2025-04-07T03:15:21.440


Instruction: Please provide detailed information about CVE-2025-3331

CVE:CVE-2025-3331
Description:A vulnerability, which was classified as critical, has been found in codeprojects Online Restaurant Management System 1.0. This issue affects some unknown processing of the file /payment_save.php. The manipulation of the argument mode leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
published:2025-04-07T03:15:21.917


Instruction: Please provide detailed information about CVE-2025-3332

CVE:CVE-2025-3332
Description:A vulnerability, which was classified as critical, was found in codeprojects Online Restaurant Management System 1.0. Affected is an unknown function of the file /admin/menu_save.php. The manipulation of the argument menu leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
published:2025-04-07T03:15:22.117


Instruction: Please provide detailed information about CVE-2025-3333

CVE:CVE-2025-3333
Description:A vulnerability has been found in codeprojects Online Restaurant Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin/menu_update.php. The manipulation of the argument menu leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
published:2025-04-07T03:15:22.307


Instruction: Please provide detailed information about CVE-2025-20654

CVE:CVE-2025-20654
Description:In wlan service, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00406897; Issue ID: MSV-2875.
published:2025-04-07T04:15:19.180


Instruction: Please provide detailed information about CVE-2025-20655

CVE:CVE-2025-20655
Description:In keymaster, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: DTV04427687; Issue ID: MSV-3183.
published:2025-04-07T04:15:19.327


Instruction: Please provide detailed information about CVE-2025-20656

CVE:CVE-2025-20656
Description:In DA, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege, if an attacker has physical access to the device, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS09625423; Issue ID: MSV-3033.
published:2025-04-07T04:15:19.447


Instruction: Please provide detailed information about CVE-2025-20657

CVE:CVE-2025-20657
Description:In vdec, there is a possible permission bypass due to improper input validation. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS09486425; Issue ID: MSV-2609.
published:2025-04-07T04:15:19.577


Instruction: Please provide detailed information about CVE-2025-20658

CVE:CVE-2025-20658
Description:In DA, there is a possible permission bypass due to a logic error. This could lead to local escalation of privilege, if an attacker has physical access to the device, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS09474894; Issue ID: MSV-2597.
published:2025-04-07T04:15:19.703


Instruction: Please provide detailed information about CVE-2025-20659

CVE:CVE-2025-20659
Description:In Modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01519028; Issue ID: MSV-2768.
published:2025-04-07T04:15:19.820


Instruction: Please provide detailed information about CVE-2025-20660

CVE:CVE-2025-20660
Description:In PlayReady TA, there is a possible out of bounds read due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: DTV04436357; Issue ID: MSV-3186.
published:2025-04-07T04:15:19.940


Instruction: Please provide detailed information about CVE-2025-20661

CVE:CVE-2025-20661
Description:In PlayReady TA, there is a possible out of bounds read due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: DTV04436357; Issue ID: MSV-3185.
published:2025-04-07T04:15:20.057


Instruction: Please provide detailed information about CVE-2025-20662

CVE:CVE-2025-20662
Description:In PlayReady TA, there is a possible out of bounds read due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: DTV04428276; Issue ID: MSV-3184.
published:2025-04-07T04:15:20.187


Instruction: Please provide detailed information about CVE-2025-20663

CVE:CVE-2025-20663
Description:In wlan AP driver, there is a possible information disclosure due to an uncaught exception. This could lead to remote (proximal/adjacent) information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00408868; Issue ID: MSV-3031.
published:2025-04-07T04:15:20.300


Instruction: Please provide detailed information about CVE-2025-20664

CVE:CVE-2025-20664
Description:In wlan AP driver, there is a possible information disclosure due to an uncaught exception. This could lead to remote (proximal/adjacent) information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00406217; Issue ID: MSV-2773.
published:2025-04-07T04:15:20.420


Instruction: Please provide detailed information about CVE-2025-31170

CVE:CVE-2025-31170
Description:Access control vulnerability in the security verification module Impact: Successful exploitation of this vulnerability will affect integrity and confidentiality.
published:2025-04-07T04:15:20.557


Instruction: Please provide detailed information about CVE-2025-31171

CVE:CVE-2025-31171
Description:File read permission bypass vulnerability in the kernel file system module Impact: Successful exploitation of this vulnerability may affect service confidentiality.
published:2025-04-07T04:15:20.730


Instruction: Please provide detailed information about CVE-2025-31172

CVE:CVE-2025-31172
Description:Memory write permission bypass vulnerability in the kernel futex module Impact: Successful exploitation of this vulnerability may affect service confidentiality.
published:2025-04-07T04:15:20.913


Instruction: Please provide detailed information about CVE-2025-31173

CVE:CVE-2025-31173
Description:Memory write permission bypass vulnerability in the kernel futex module Impact: Successful exploitation of this vulnerability may affect service confidentiality.
published:2025-04-07T04:15:21.997


Instruction: Please provide detailed information about CVE-2025-31174

CVE:CVE-2025-31174
Description:Path traversal vulnerability in the DFS module Impact: Successful exploitation of this vulnerability may affect service confidentiality.
published:2025-04-07T04:15:22.937


Instruction: Please provide detailed information about CVE-2025-31175

CVE:CVE-2025-31175
Description:Deserialization mismatch vulnerability in the DSoftBus module Impact: Successful exploitation of this vulnerability may affect service integrity.
published:2025-04-07T04:15:24.080


Instruction: Please provide detailed information about CVE-2025-3334

CVE:CVE-2025-3334
Description:A vulnerability was found in codeprojects Online Restaurant Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/category_save.php. The manipulation of the argument Category leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
published:2025-04-07T04:15:26.117


Instruction: Please provide detailed information about CVE-2025-3335

CVE:CVE-2025-3335
Description:A vulnerability was found in codeprojects Online Restaurant Management System 1.0. It has been classified as critical. This affects an unknown part of the file /admin/category_update.php. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
published:2025-04-07T04:15:36.017


Instruction: Please provide detailed information about CVE-2025-3336

CVE:CVE-2025-3336
Description:A vulnerability was found in codeprojects Online Restaurant Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /admin/member_save.php. The manipulation of the argument last leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.
published:2025-04-07T05:15:29.767


Instruction: Please provide detailed information about CVE-2025-3337

CVE:CVE-2025-3337
Description:A vulnerability was found in codeprojects Online Restaurant Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /admin/member_update.php. The manipulation of the argument ID leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
published:2025-04-07T05:15:31.707


Instruction: Please provide detailed information about CVE-2025-3338

CVE:CVE-2025-3338
Description:A vulnerability classified as critical has been found in codeprojects Online Restaurant Management System 1.0. Affected is an unknown function of the file /admin/user_save.php. The manipulation of the argument Name leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.
published:2025-04-07T06:15:40.547