Instruction: Please provide detailed information about CVE-2025-27106

CVE:CVE-2025-27106
Description:binance-trading-bot is an automated Binance trading bot with trailing buy/sell strategy. Authenticated users of binance-trading-bot can achieve Remote Code Execution on the host system due to a command injection vulnerability in the `/restore` endpoint. The restore endpoint of binance-trading-bot is vulnerable to command injection via the `/restore` endpoint. The name of the uploaded file is passed to shell.exec without sanitization other than path normalization, resulting in Remote Code Execution. This may allow any authorized user to execute code in the context of the host machine. This issue has been addressed in version 0.0.100 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
published:2025-02-21T22:15:14.033


Instruction: Please provide detailed information about CVE-2025-27108

CVE:CVE-2025-27108
Description:dom-expressions is a Fine-Grained Runtime for Performant DOM Rendering. In affected versions the use of javascript's `.replace()` opens up to potential Cross-site Scripting (XSS) vulnerabilities with the special replacement patterns beginning with `$`. Particularly, when the attributes of `Meta` tag from solid-meta are user-defined, attackers can utilise the special replacement patterns, either `$'` or `$\`` to achieve XSS. The solid-meta package has this issue since it uses `useAffect` and context providers, which injects the used assets in the html header. "dom-expressions" uses `.replace()` to insert the assets, which is vulnerable to the special replacement patterns listed above.  This effectively means that if the attributes of an asset tag contained user-controlled data, it would be vulnerable to XSS. For instance, there might be meta tags for the open graph protocol in a user profile page, but if attackers set the user query to some payload abusing `.replace()`, then they could execute arbitrary javascript in the victim's web browser. Moreover, it could be stored and cause more problems. This issue has been addressed in version 0.39.5 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
published:2025-02-21T22:15:14.170


Instruction: Please provide detailed information about CVE-2025-27109

CVE:CVE-2025-27109
Description:solid-js is a declarative, efficient, and flexible JavaScript library for building user interfaces. In affected versions Inserts/JSX expressions inside illegal inlined JSX fragments lacked escaping, allowing user input to be rendered as HTML when put directly inside JSX fragments. This issue has been addressed in version 1.9.4 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
published:2025-02-21T22:15:14.303


Instruction: Please provide detailed information about CVE-2025-1509

CVE:CVE-2025-1509
Description:The The Show Me The Cookies plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.0. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
published:2025-02-22T04:15:09.883


Instruction: Please provide detailed information about CVE-2025-1510

CVE:CVE-2025-1510
Description:The The Custom Post Type Date Archives plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.7.1. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
published:2025-02-22T04:15:10.040


Instruction: Please provide detailed information about CVE-2025-1361

CVE:CVE-2025-1361
Description:The IP2Location Country Blocker plugin for WordPress is vulnerable to Regular Information Exposure in all versions up to, and including, 2.38.8 due to missing capability checks on the admin_init() function. This makes it possible for unauthenticated attackers to view the plugin's settings.
published:2025-02-22T09:15:24.033


Instruction: Please provide detailed information about CVE-2025-1553

CVE:CVE-2025-1553
Description:A vulnerability was found in pankajindevops scale up to 3633544a00245d3df88b6d13d9b3dd0f411be7f6. It has been classified as problematic. Affected is an unknown function of the file /scale/project. The manipulation of the argument goal leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available.
published:2025-02-22T10:15:09.853


Instruction: Please provide detailed information about CVE-2025-21704

CVE:CVE-2025-21704
Description:In the Linux kernel, the following vulnerability has been resolved:  usb: cdc-acm: Check control transfer buffer size before access  If the first fragment is shorter than struct usb_cdc_notification, we can't calculate an expected_size. Log an error and discard the notification instead of reading lengths from memory outside the received data, which can lead to memory corruption when the expected_size decreases between fragments, causing `expected_size - acm->nb_index` to wrap.  This issue has been present since the beginning of git history; however, it only leads to memory corruption since commit ea2583529cd1 ("cdc-acm: reassemble fragmented notifications").  A mitigating factor is that acm_ctrl_irq() can only execute after userspace has opened /dev/ttyACM*; but if ModemManager is running, ModemManager will do that automatically depending on the USB device's vendor/product IDs and its other interfaces.
published:2025-02-22T10:15:11.263


Instruction: Please provide detailed information about CVE-2025-0918

CVE:CVE-2025-0918
Description:The SMTP for SendGrid – YaySMTP plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.3.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
published:2025-02-22T13:15:11.687


Instruction: Please provide detailed information about CVE-2025-0953

CVE:CVE-2025-0953
Description:The SMTP for Sendinblue – YaySMTP plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.1.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
published:2025-02-22T13:15:11.850


Instruction: Please provide detailed information about CVE-2025-1556

CVE:CVE-2025-1556
Description:A vulnerability, which was classified as problematic, has been found in westboy CicadasCMS 1.0. This issue affects some unknown processing of the file /system of the component Template Management. The manipulation leads to deserialization. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
published:2025-02-22T13:15:12.010


Instruction: Please provide detailed information about CVE-2025-1557

CVE:CVE-2025-1557
Description:A vulnerability, which was classified as problematic, was found in OFCMS 1.1.3. Affected is an unknown function. The manipulation leads to cross-site request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
published:2025-02-22T13:15:12.247


Instruction: Please provide detailed information about CVE-2025-0957

CVE:CVE-2025-0957
Description:The SMTP for Amazon SES – YaySMTP plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.7.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
published:2025-02-22T14:15:29.710


Instruction: Please provide detailed information about CVE-2025-26750

CVE:CVE-2025-26750
Description:Missing Authorization vulnerability in appsbd Vitepos allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Vitepos: from n/a through 3.1.3.
published:2025-02-22T16:15:31.210


Instruction: Please provide detailed information about CVE-2025-26756

CVE:CVE-2025-26756
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in grimdonkey Magic the Gathering Card Tooltips allows Stored XSS. This issue affects Magic the Gathering Card Tooltips: from n/a through 3.5.0.
published:2025-02-22T16:15:31.350


Instruction: Please provide detailed information about CVE-2025-26757

CVE:CVE-2025-26757
Description:Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in FULL SERVICES FULL Customer allows PHP Local File Inclusion. This issue affects FULL Customer: from n/a through 3.1.26.
published:2025-02-22T16:15:31.493


Instruction: Please provide detailed information about CVE-2025-26760

CVE:CVE-2025-26760
Description:Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Wow-Company Calculator Builder allows PHP Local File Inclusion. This issue affects Calculator Builder: from n/a through 1.6.2.
published:2025-02-22T16:15:31.633


Instruction: Please provide detailed information about CVE-2025-26763

CVE:CVE-2025-26763
Description:Deserialization of Untrusted Data vulnerability in MetaSlider Responsive Slider by MetaSlider allows Object Injection. This issue affects Responsive Slider by MetaSlider: from n/a through 3.94.0.
published:2025-02-22T16:15:31.773


Instruction: Please provide detailed information about CVE-2025-26764

CVE:CVE-2025-26764
Description:Missing Authorization vulnerability in enituretechnology Distance Based Shipping Calculator allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Distance Based Shipping Calculator: from n/a through 2.0.22.
published:2025-02-22T16:15:31.910


Instruction: Please provide detailed information about CVE-2025-26774

CVE:CVE-2025-26774
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rock Solid Responsive Modal Builder for High Conversion – Easy Popups allows Reflected XSS. This issue affects Responsive Modal Builder for High Conversion – Easy Popups: from n/a through 1.5.0.
published:2025-02-22T16:15:32.060


Instruction: Please provide detailed information about CVE-2025-26776

CVE:CVE-2025-26776
Description:Unrestricted Upload of File with Dangerous Type vulnerability in NotFound Chaty Pro allows Upload a Web Shell to a Web Server. This issue affects Chaty Pro: from n/a through 3.3.3.
published:2025-02-22T16:15:32.203


Instruction: Please provide detailed information about CVE-2025-26973

CVE:CVE-2025-26973
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WarfarePlugins Social Warfare allows DOM-Based XSS. This issue affects Social Warfare: from n/a through 4.5.4.
published:2025-02-22T16:15:32.347


Instruction: Please provide detailed information about CVE-2025-27012

CVE:CVE-2025-27012
Description:Cross-Site Request Forgery (CSRF) vulnerability in a1post A1POST.BG Shipping for Woo allows Privilege Escalation. This issue affects A1POST.BG Shipping for Woo: from n/a through 1.5.1.
published:2025-02-22T16:15:32.497


Instruction: Please provide detailed information about CVE-2025-1575

CVE:CVE-2025-1575
Description:A vulnerability classified as problematic has been found in Harpia DiagSystem 12. Affected is an unknown function of the file /diagsystem/PACS/atualatendimento_jpeg.php. The manipulation of the argument cod/codexame leads to improper control of resource identifiers. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-02-23T04:15:24.980


Instruction: Please provide detailed information about CVE-2025-1576

CVE:CVE-2025-1576
Description:A vulnerability classified as critical was found in code-projects Real Estate Property Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /ajax_state.php. The manipulation of the argument StateName as part of String leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
published:2025-02-23T05:15:11.853


Instruction: Please provide detailed information about CVE-2025-1577

CVE:CVE-2025-1577
Description:A vulnerability, which was classified as problematic, has been found in code-projects Blood Bank System 1.0. Affected by this issue is some unknown functionality of the file /prostatus.php. The manipulation of the argument message leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
published:2025-02-23T07:15:08.970


Instruction: Please provide detailed information about CVE-2025-1578

CVE:CVE-2025-1578
Description:A vulnerability, which was classified as critical, was found in PHPGurukul Online Shopping Portal 2.1. This affects an unknown part of the file /search-result.php. The manipulation of the argument product leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
published:2025-02-23T08:15:08.187


Instruction: Please provide detailed information about CVE-2025-1579

CVE:CVE-2025-1579
Description:A vulnerability was found in code-projects Blood Bank System 1.0 and classified as problematic. This issue affects some unknown processing of the file /admin/user.php. The manipulation of the argument email leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.
published:2025-02-23T09:15:09.393


Instruction: Please provide detailed information about CVE-2025-1580

CVE:CVE-2025-1580
Description:A vulnerability was found in PHPGurukul Nipah Virus Testing Management System 1.0. It has been classified as critical. Affected is an unknown function of the file /search-report-result.php. The manipulation of the argument searchdata leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The initial researcher advisory mentions contradicting parameter names to be affected.
published:2025-02-23T10:15:09.623


Instruction: Please provide detailed information about CVE-2025-1581

CVE:CVE-2025-1581
Description:A vulnerability was found in PHPGurukul Online Nurse Hiring System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /book-nurse.php?bookid=1. The manipulation of the argument contactname leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
published:2025-02-23T11:15:09.247


Instruction: Please provide detailed information about CVE-2025-1582

CVE:CVE-2025-1582
Description:A vulnerability was found in PHPGurukul Online Nurse Hiring System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin/all-request.php. The manipulation of the argument viewid leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
published:2025-02-23T12:15:08.470


Instruction: Please provide detailed information about CVE-2025-1583

CVE:CVE-2025-1583
Description:A vulnerability classified as critical has been found in PHPGurukul Online Nurse Hiring System 1.0. This affects an unknown part of the file /admin/search-report-details.php. The manipulation of the argument searchinput leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
published:2025-02-23T12:15:09.550


Instruction: Please provide detailed information about CVE-2025-1584

CVE:CVE-2025-1584
Description:A vulnerability classified as problematic was found in opensolon Solon up to 3.0.8. This vulnerability affects unknown code of the file solon-projects/solon-web/solon-web-staticfiles/src/main/java/org/noear/solon/web/staticfiles/StaticMappings.java. The manipulation leads to path traversal: '../filedir'. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 3.0.9 is able to address this issue. The name of the patch is f46e47fd1f8455b9467d7ead3cdb0509115b2ef1. It is recommended to upgrade the affected component.
published:2025-02-23T13:15:09.253


Instruction: Please provide detailed information about CVE-2025-1585

CVE:CVE-2025-1585
Description:A vulnerability, which was classified as problematic, has been found in otale tale up to 2.0.5. This issue affects the function OptionsService of the file src/main/resources/templates/themes/default/partial/header.html. The manipulation of the argument logo_url leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
published:2025-02-23T14:15:09.110


Instruction: Please provide detailed information about CVE-2025-1586

CVE:CVE-2025-1586
Description:A vulnerability was found in code-projects Blood Bank System 1.0. It has been declared as problematic. This vulnerability affects unknown code of the file /Blood/A-.php. The manipulation of the argument Bloodname leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
published:2025-02-23T15:15:09.407


Instruction: Please provide detailed information about CVE-2025-1587

CVE:CVE-2025-1587
Description:A vulnerability was found in SourceCodester Telecom Billing Management System 1.0. It has been rated as critical. This issue affects the function addrecords of the file main.cpp of the component Add New Record. The manipulation of the argument name/phonenumber leads to buffer overflow. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.
published:2025-02-23T15:15:10.107


Instruction: Please provide detailed information about CVE-2025-1467

CVE:CVE-2025-1467
Description:Versions of the package tarteaucitronjs before 1.17.0 are vulnerable to Cross-site Scripting (XSS) via the getElemWidth() and getElemHeight(). This is related to [SNYK-JS-TARTEAUCITRONJS-8366541](https://security.snyk.io/vuln/SNYK-JS-TARTEAUCITRONJS-8366541)
published:2025-02-23T16:15:08.400


Instruction: Please provide detailed information about CVE-2025-1588

CVE:CVE-2025-1588
Description:A vulnerability has been found in PHPGurukul Online Nurse Hiring System 1.0 and classified as critical. This vulnerability affects unknown code of the file /admin/manage-nurse.php. The manipulation of the argument profilepic leads to path traversal: '../filedir'. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The initial researcher advisory mentions contradicting vulnerability classes.
published:2025-02-23T16:15:08.637


Instruction: Please provide detailed information about CVE-2025-1589

CVE:CVE-2025-1589
Description:A vulnerability was found in SourceCodester E-Learning System 1.0 and classified as problematic. This issue affects some unknown processing of the file /register.php of the component User Registration Handler. The manipulation leads to cross site scripting. The attack may be initiated remotely.
published:2025-02-23T18:15:08.427


Instruction: Please provide detailed information about CVE-2025-1590

CVE:CVE-2025-1590
Description:A vulnerability was found in SourceCodester E-Learning System 1.0. It has been classified as critical. Affected is an unknown function of the file /admin/modules/lesson/index.php of the component List of Lessons Page. The manipulation leads to unrestricted upload. It is possible to launch the attack remotely.
published:2025-02-23T19:15:08.780


Instruction: Please provide detailed information about CVE-2025-1591

CVE:CVE-2025-1591
Description:A vulnerability was found in SourceCodester Employee Management System 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /department.php of the component Department Page. The manipulation of the argument Department Name leads to cross site scripting. The attack can be launched remotely.
published:2025-02-23T19:15:09.407


Instruction: Please provide detailed information about CVE-2025-1592

CVE:CVE-2025-1592
Description:A vulnerability was found in SourceCodester Best Employee Management System 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /admin/Operations/Role.php of the component Add Role Page. The manipulation of the argument assign_name/description leads to cross site scripting. The attack may be launched remotely.
published:2025-02-23T20:15:08.243


Instruction: Please provide detailed information about CVE-2025-1593

CVE:CVE-2025-1593
Description:A vulnerability classified as critical has been found in SourceCodester Best Employee Management System 1.0. This affects an unknown part of the file /_hr_soft/assets/uploadImage/Profile/ of the component Profile Picture Handler. The manipulation leads to unrestricted upload. It is possible to initiate the attack remotely.
published:2025-02-23T20:15:09.210


Instruction: Please provide detailed information about CVE-2025-1594

CVE:CVE-2025-1594
Description:A vulnerability, which was classified as critical, was found in FFmpeg up to 7.1. This affects the function ff_aac_search_for_tns of the file libavcodec/aacenc_tns.c of the component AAC Encoder. The manipulation leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
published:2025-02-23T21:15:09.130


Instruction: Please provide detailed information about CVE-2025-1595

CVE:CVE-2025-1595
Description:A vulnerability has been found in Anhui Xufan Information Technology EasyCVR up to 2.7.0 and classified as problematic. This vulnerability affects unknown code of the file /api/v1/getbaseconfig. The manipulation leads to information disclosure. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-02-23T22:15:08.190


Instruction: Please provide detailed information about CVE-2025-1596

CVE:CVE-2025-1596
Description:A vulnerability was found in SourceCodester Best Church Management Software 1.0 and classified as critical. This issue affects some unknown processing of the file /fpassword.php. The manipulation of the argument email leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-02-23T23:15:09.070


Instruction: Please provide detailed information about CVE-2025-1597

CVE:CVE-2025-1597
Description:A vulnerability was found in SourceCodester Best Church Management Software 1.0. It has been classified as problematic. Affected is an unknown function of the file /admin/redirect.php. The manipulation of the argument a leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-02-23T23:15:10.120


Instruction: Please provide detailed information about CVE-2025-22631

CVE:CVE-2025-22631
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in vbout Marketing Automation allows Reflected XSS. This issue affects Marketing Automation: from n/a through 1.2.6.8.
published:2025-02-23T23:15:10.290


Instruction: Please provide detailed information about CVE-2025-22632

CVE:CVE-2025-22632
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in totalsoft WooCommerce Pricing – Product Pricing allows Stored XSS. This issue affects WooCommerce Pricing – Product Pricing: from n/a through 1.0.9.
published:2025-02-23T23:15:10.440


Instruction: Please provide detailed information about CVE-2025-22633

CVE:CVE-2025-22633
Description:Insertion of Sensitive Information into Externally-Accessible File or Directory vulnerability in Matt Cromwell Give – Divi Donation Modules allows Retrieve Embedded Sensitive Data. This issue affects Give – Divi Donation Modules: from n/a through 2.0.0.
published:2025-02-23T23:15:10.573


Instruction: Please provide detailed information about CVE-2025-22635

CVE:CVE-2025-22635
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jyothis Joy Eventer allows Reflected XSS. This issue affects Eventer: from n/a through n/a.
published:2025-02-23T23:15:10.720


Instruction: Please provide detailed information about CVE-2025-1598

CVE:CVE-2025-1598
Description:A vulnerability was found in SourceCodester Best Church Management Software 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /admin/app/asset_crud.php. The manipulation of the argument photo1 leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-02-24T00:15:09.220


Instruction: Please provide detailed information about CVE-2025-1599

CVE:CVE-2025-1599
Description:A vulnerability was found in SourceCodester Best Church Management Software 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /admin/app/profile_crud.php. The manipulation of the argument old_cat_img leads to path traversal: '../filedir'. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-02-24T00:15:09.393


Instruction: Please provide detailed information about CVE-2025-1606

CVE:CVE-2025-1606
Description:A vulnerability classified as problematic was found in SourceCodester Best Employee Management System 1.0. This vulnerability affects unknown code of the file /admin/backup/backups.php. The manipulation leads to information disclosure. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-02-24T00:15:09.567


Instruction: Please provide detailed information about CVE-2025-1607

CVE:CVE-2025-1607
Description:A vulnerability, which was classified as problematic, has been found in SourceCodester Best Employee Management System 1.0. This issue affects some unknown processing of the file /admin/salary_slip.php. The manipulation of the argument id leads to authorization bypass. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-02-24T01:15:09.803


Instruction: Please provide detailed information about CVE-2025-1608

CVE:CVE-2025-1608
Description:A vulnerability, which was classified as critical, was found in LB-LINK AC1900 Router 1.0.2. Affected is the function websGetVar of the file /goform/set_manpwd. The manipulation of the argument routepwd  leads to os command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-02-24T01:15:10.420


Instruction: Please provide detailed information about CVE-2025-1609

CVE:CVE-2025-1609
Description:A vulnerability has been found in LB-LINK AC1900 Router 1.0.2 and classified as critical. Affected by this vulnerability is the function websGetVar of the file /goform/set_cmd. The manipulation of the argument cmd leads to os command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-02-24T02:15:32.097


Instruction: Please provide detailed information about CVE-2025-1610

CVE:CVE-2025-1610
Description:A vulnerability was found in LB-LINK AC1900 Router 1.0.2 and classified as critical. Affected by this issue is the function websGetVar of the file /goform/set_blacklist. The manipulation of the argument mac/enable leads to os command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-02-24T02:15:32.263


Instruction: Please provide detailed information about CVE-2025-1611

CVE:CVE-2025-1611
Description:A vulnerability was found in ShopXO up to 6.4.0. It has been classified as problematic. This affects an unknown part of the file app/service/ThemeAdminService.php of the component Template Handler. The manipulation leads to injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-02-24T02:15:32.437


Instruction: Please provide detailed information about CVE-2025-1612

CVE:CVE-2025-1612
Description:A vulnerability was found in Edimax BR-6288ACL 1.30. It has been declared as problematic. This vulnerability affects unknown code of the file wireless5g_basic.asp. The manipulation of the argument SSID leads to cross site scripting. The attack can be initiated remotely. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-02-24T03:15:09.913


Instruction: Please provide detailed information about CVE-2025-1613

CVE:CVE-2025-1613
Description:A vulnerability was found in FiberHome AN5506-01A ONU GPON RP2511. It has been rated as problematic. This issue affects some unknown processing of the file /goform/URL_filterCfg of the component URL Filtering Submenu. The manipulation of the argument url_IP leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-02-24T03:15:10.083


Instruction: Please provide detailed information about CVE-2025-1614

CVE:CVE-2025-1614
Description:A vulnerability classified as problematic has been found in FiberHome AN5506-01A ONU GPON RP2511. Affected is an unknown function of the file /goform/portForwardingCfg of the component Port Forwarding Submenu. The manipulation of the argument pf_Description leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-02-24T03:15:10.253


Instruction: Please provide detailed information about CVE-2025-1615

CVE:CVE-2025-1615
Description:A vulnerability classified as problematic was found in FiberHome AN5506-01A ONU GPON RP2511. Affected by this vulnerability is an unknown functionality of the component NAT Submenu. The manipulation of the argument Description leads to cross site scripting. The attack can be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-02-24T04:15:08.933


Instruction: Please provide detailed information about CVE-2025-1616

CVE:CVE-2025-1616
Description:A vulnerability, which was classified as critical, has been found in FiberHome AN5506-01A ONU GPON RP2511. Affected by this issue is some unknown functionality of the component Diagnosis. The manipulation of the argument Destination Address leads to os command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-02-24T04:15:09.110


Instruction: Please provide detailed information about CVE-2025-1617

CVE:CVE-2025-1617
Description:A vulnerability, which was classified as problematic, was found in Netis WF2780 2.1.41925. This affects an unknown part of the component Wireless 2.4G Menu. The manipulation of the argument SSID leads to cross site scripting. It is possible to initiate the attack remotely. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-02-24T04:15:09.277


Instruction: Please provide detailed information about CVE-2025-1618

CVE:CVE-2025-1618
Description:A vulnerability has been found in vTiger CRM 6.4.0/6.5.0 and classified as problematic. This vulnerability affects unknown code of the file /modules/Mobile/index.php. The manipulation of the argument _operation leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 7.0 is able to address this issue. It is recommended to upgrade the affected component.
published:2025-02-24T05:15:10.980


Instruction: Please provide detailed information about CVE-2025-1629

CVE:CVE-2025-1629
Description:A vulnerability was found in Excitel Broadband Private my Excitel App 3.13.0 on Android. It has been classified as problematic. Affected is an unknown function of the component One-Time Password Handler. The manipulation leads to improper restriction of excessive authentication attempts. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-02-24T05:15:11.280


Instruction: Please provide detailed information about CVE-2025-0690

CVE:CVE-2025-0690
Description:The read command is used to read the keyboard input from the user, while reads it keeps the input length in a 32-bit integer value which is further used to reallocate the line buffer to accept the next character. During this process, with a line big enough it's possible to make this variable to overflow leading to a out-of-bounds write in the heap based buffer. This flaw may be leveraged to corrupt grub's internal critical data and secure boot bypass is not discarded as consequence.
published:2025-02-24T08:15:09.503


Instruction: Please provide detailed information about CVE-2025-1412

CVE:CVE-2025-1412
Description:Mattermost versions 9.11.x <= 9.11.6, 10.4.x <= 10.4.1 fail to invalidate all active sessions when converting a user to a bot, with allows the converted user to escalate their privileges depending on the permissions granted to the bot.
published:2025-02-24T08:15:09.890


Instruction: Please provide detailed information about CVE-2025-20051

CVE:CVE-2025-20051
Description:Mattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to properly validate input when patching and duplicating a board, which allows a user to read any arbitrary file on the system via duplicating a specially crafted block in Boards.
published:2025-02-24T08:15:10.087


Instruction: Please provide detailed information about CVE-2025-24490

CVE:CVE-2025-24490
Description:Mattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to use prepared statements in the SQL query of boards reordering which allows an attacker to retrieve data from the database, via a SQL injection when reordering specially crafted boards categories.
published:2025-02-24T08:15:10.260


Instruction: Please provide detailed information about CVE-2025-24526

CVE:CVE-2025-24526
Description:Mattermost versions 10.1.x <= 10.1.3, 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to restrict channel export of archived channels when the "Allow users to view archived channels" is disabled which allows a user to export channel contents when they shouldn't have access to it
published:2025-02-24T08:15:10.427


Instruction: Please provide detailed information about CVE-2025-25279

CVE:CVE-2025-25279
Description:Mattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to properly validate board blocks when importing boards which allows an attacker could read any arbitrary file on the system via importing and exporting a specially crafted import archive in Boards.
published:2025-02-24T08:15:10.607


Instruction: Please provide detailed information about CVE-2025-1488

CVE:CVE-2025-1488
Description:The WPO365 | MICROSOFT 365 GRAPH MAILER plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 3.2. This is due to insufficient validation on the redirect url supplied via the 'redirect_to' parameter. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites if 1. they can successfully trick them into performing an action and 2. the plugin is activated but not configured.
published:2025-02-24T11:15:10.193


Instruction: Please provide detailed information about CVE-2025-0545

CVE:CVE-2025-0545
Description:Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Tekrom Technology T-Soft E-Commerce allows Cross-Site Scripting (XSS).This issue affects T-Soft E-Commerce: before v5.
published:2025-02-24T14:15:10.910


Instruction: Please provide detailed information about CVE-2025-1632

CVE:CVE-2025-1632
Description:A vulnerability was found in libarchive up to 3.7.7. It has been classified as problematic. This affects the function list of the file bsdunzip.c. The manipulation leads to null pointer dereference. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-02-24T14:15:11.590


Instruction: Please provide detailed information about CVE-2025-23017

CVE:CVE-2025-23017
Description:WorkOS Hosted AuthKit before 2025-01-07 allows a password authentication MFA bypass (by enrolling a new authentication factor) when the attacker knows the user's password. No exploitation occurred.
published:2025-02-24T15:15:13.393


Instruction: Please provide detailed information about CVE-2025-26883

CVE:CVE-2025-26883
Description:Missing Authorization vulnerability in bPlugins Animated Text Block allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Animated Text Block: from n/a through 1.0.7.
published:2025-02-24T15:15:14.007


Instruction: Please provide detailed information about CVE-2025-27265

CVE:CVE-2025-27265
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Aaron D. Campbell Google Maps for WordPress allows DOM-Based XSS. This issue affects Google Maps for WordPress: from n/a through 1.0.3.
published:2025-02-24T15:15:14.310


Instruction: Please provide detailed information about CVE-2025-27266

CVE:CVE-2025-27266
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ignacio Perez Hover Image Button allows DOM-Based XSS. This issue affects Hover Image Button: from n/a through 1.1.2.
published:2025-02-24T15:15:14.443


Instruction: Please provide detailed information about CVE-2025-27272

CVE:CVE-2025-27272
Description:Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in vinagecko VG PostCarousel allows PHP Local File Inclusion. This issue affects VG PostCarousel: from n/a through 1.1.
published:2025-02-24T15:15:14.587


Instruction: Please provide detailed information about CVE-2025-27276

CVE:CVE-2025-27276
Description:Cross-Site Request Forgery (CSRF) vulnerability in lizeipe Photo Gallery ( Responsive ) allows Privilege Escalation. This issue affects Photo Gallery ( Responsive ): from n/a through 4.0.
published:2025-02-24T15:15:14.730


Instruction: Please provide detailed information about CVE-2025-27277

CVE:CVE-2025-27277
Description:Cross-Site Request Forgery (CSRF) vulnerability in tiefpunkt Add Linked Images To Gallery allows Cross Site Request Forgery. This issue affects Add Linked Images To Gallery: from n/a through 1.4.
published:2025-02-24T15:15:14.867


Instruction: Please provide detailed information about CVE-2025-27280

CVE:CVE-2025-27280
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Alobaidi Archive Page allows DOM-Based XSS. This issue affects Archive Page: from n/a through 1.0.1.
published:2025-02-24T15:15:15.007


Instruction: Please provide detailed information about CVE-2025-27290

CVE:CVE-2025-27290
Description:Cross-Site Request Forgery (CSRF) vulnerability in seyyed-amir Erima Zarinpal Donate allows Cross Site Request Forgery. This issue affects Erima Zarinpal Donate: from n/a through 1.0.
published:2025-02-24T15:15:15.153


Instruction: Please provide detailed information about CVE-2025-27294

CVE:CVE-2025-27294
Description:Missing Authorization vulnerability in platcom WP-Asambleas allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WP-Asambleas: from n/a through 2.85.0.
published:2025-02-24T15:15:15.287


Instruction: Please provide detailed information about CVE-2025-27296

CVE:CVE-2025-27296
Description:Missing Authorization vulnerability in revenueflex Auto Ad Inserter – Increase Google Adsense and Ad Manager Revenue allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Auto Ad Inserter – Increase Google Adsense and Ad Manager Revenue: from n/a through 1.5.
published:2025-02-24T15:15:15.423


Instruction: Please provide detailed information about CVE-2025-27297

CVE:CVE-2025-27297
Description:Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in guelben Bravo Search & Replace allows Blind SQL Injection. This issue affects Bravo Search & Replace: from n/a through 1.0.
published:2025-02-24T15:15:15.567


Instruction: Please provide detailed information about CVE-2025-27298

CVE:CVE-2025-27298
Description:Cross-Site Request Forgery (CSRF) vulnerability in cmstactics WP Video Posts allows OS Command Injection. This issue affects WP Video Posts: from n/a through 3.5.1.
published:2025-02-24T15:15:15.703


Instruction: Please provide detailed information about CVE-2025-27300

CVE:CVE-2025-27300
Description:Deserialization of Untrusted Data vulnerability in giuliopanda ADFO allows Object Injection. This issue affects ADFO: from n/a through 1.9.1.
published:2025-02-24T15:15:15.853


Instruction: Please provide detailed information about CVE-2025-27301

CVE:CVE-2025-27301
Description:Deserialization of Untrusted Data vulnerability in Nazmul Hasan Robin NHR Options Table Manager allows Object Injection. This issue affects NHR Options Table Manager: from n/a through 1.1.2.
published:2025-02-24T15:15:15.983


Instruction: Please provide detailed information about CVE-2025-27303

CVE:CVE-2025-27303
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themelogger Contact Form 7 Star Rating allows Stored XSS. This issue affects Contact Form 7 Star Rating: from n/a through 1.10.
published:2025-02-24T15:15:16.123


Instruction: Please provide detailed information about CVE-2025-27304

CVE:CVE-2025-27304
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themelogger Contact Form 7 Star Rating with font Awesome allows Stored XSS. This issue affects Contact Form 7 Star Rating with font Awesome: from n/a through 1.3.
published:2025-02-24T15:15:16.260


Instruction: Please provide detailed information about CVE-2025-27305

CVE:CVE-2025-27305
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Achal Jain Table of Contents Block allows Stored XSS. This issue affects Table of Contents Block: from n/a through 1.0.2.
published:2025-02-24T15:15:16.387


Instruction: Please provide detailed information about CVE-2025-27306

CVE:CVE-2025-27306
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pathomation Pathomation allows Stored XSS. This issue affects Pathomation: from n/a through 2.5.1.
published:2025-02-24T15:15:16.523


Instruction: Please provide detailed information about CVE-2025-27307

CVE:CVE-2025-27307
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in oooorgle Quotes llama allows Reflected XSS. This issue affects Quotes llama: from n/a through 3.0.1.
published:2025-02-24T15:15:16.653


Instruction: Please provide detailed information about CVE-2025-27311

CVE:CVE-2025-27311
Description:Cross-Site Request Forgery (CSRF) vulnerability in luk3thomas Bulk Content Creator allows Cross Site Request Forgery. This issue affects Bulk Content Creator: from n/a through 1.2.1.
published:2025-02-24T15:15:16.783


Instruction: Please provide detailed information about CVE-2025-27312

CVE:CVE-2025-27312
Description:Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Jenst WP Sitemap allows SQL Injection. This issue affects WP Sitemap: from n/a through 1.0.
published:2025-02-24T15:15:16.917


Instruction: Please provide detailed information about CVE-2025-27315

CVE:CVE-2025-27315
Description:Cross-Site Request Forgery (CSRF) vulnerability in wptom All-In-One Cufon allows Cross Site Request Forgery. This issue affects All-In-One Cufon: from n/a through 1.3.0.
published:2025-02-24T15:15:17.047


Instruction: Please provide detailed information about CVE-2025-27316

CVE:CVE-2025-27316
Description:Cross-Site Request Forgery (CSRF) vulnerability in hosting.io JPG, PNG Compression and Optimization allows Cross Site Request Forgery. This issue affects JPG, PNG Compression and Optimization: from n/a through 1.7.35.
published:2025-02-24T15:15:17.193


Instruction: Please provide detailed information about CVE-2025-27317

CVE:CVE-2025-27317
Description:Cross-Site Request Forgery (CSRF) vulnerability in IT-RAYS RAYS Grid allows Cross Site Request Forgery. This issue affects RAYS Grid: from n/a through 1.3.1.
published:2025-02-24T15:15:17.353


Instruction: Please provide detailed information about CVE-2025-27318

CVE:CVE-2025-27318
Description:Cross-Site Request Forgery (CSRF) vulnerability in ixiter Simple Google Sitemap allows Cross Site Request Forgery. This issue affects Simple Google Sitemap: from n/a through 1.6.
published:2025-02-24T15:15:17.487


Instruction: Please provide detailed information about CVE-2025-27320

CVE:CVE-2025-27320
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pankaj Mondal Profile Widget Ninja allows DOM-Based XSS. This issue affects Profile Widget Ninja: from n/a through 4.3.
published:2025-02-24T15:15:17.620


Instruction: Please provide detailed information about CVE-2025-27321

CVE:CVE-2025-27321
Description:Cross-Site Request Forgery (CSRF) vulnerability in Blighty Blightly Explorer allows Stored XSS. This issue affects Blightly Explorer: from n/a through 2.3.0.
published:2025-02-24T15:15:17.753


Instruction: Please provide detailed information about CVE-2025-27323

CVE:CVE-2025-27323
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jon Bishop WP About Author allows DOM-Based XSS. This issue affects WP About Author: from n/a through 1.5.
published:2025-02-24T15:15:17.887


Instruction: Please provide detailed information about CVE-2025-27325

CVE:CVE-2025-27325
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bruce Video.js HLS Player allows DOM-Based XSS. This issue affects Video.js HLS Player: from n/a through 1.0.2.
published:2025-02-24T15:15:18.033


Instruction: Please provide detailed information about CVE-2025-27327

CVE:CVE-2025-27327
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Winlin Live Streaming Video Player – by SRS Player allows DOM-Based XSS. This issue affects Live Streaming Video Player – by SRS Player: from n/a through 1.0.18.
published:2025-02-24T15:15:18.180


Instruction: Please provide detailed information about CVE-2025-27328

CVE:CVE-2025-27328
Description:Cross-Site Request Forgery (CSRF) vulnerability in queeez WP-PostRatings Cheater allows Cross Site Request Forgery. This issue affects WP-PostRatings Cheater: from n/a through 1.5.
published:2025-02-24T15:15:18.337


Instruction: Please provide detailed information about CVE-2025-27329

CVE:CVE-2025-27329
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in inlinkz EZ InLinkz linkup allows DOM-Based XSS. This issue affects EZ InLinkz linkup: from n/a through 0.18.
published:2025-02-24T15:15:18.493


Instruction: Please provide detailed information about CVE-2025-27330

CVE:CVE-2025-27330
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PlayerJS PlayerJS allows DOM-Based XSS. This issue affects PlayerJS: from n/a through 2.23.
published:2025-02-24T15:15:18.660


Instruction: Please provide detailed information about CVE-2025-27331

CVE:CVE-2025-27331
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sébastien Dumont WooCommerce Display Products by Tags allows DOM-Based XSS. This issue affects WooCommerce Display Products by Tags: from n/a through 1.0.0.
published:2025-02-24T15:15:18.827


Instruction: Please provide detailed information about CVE-2025-27332

CVE:CVE-2025-27332
Description:Cross-Site Request Forgery (CSRF) vulnerability in gmnazmul Smart Maintenance & Countdown allows Stored XSS. This issue affects Smart Maintenance & Countdown: from n/a through 1.2.
published:2025-02-24T15:15:18.997


Instruction: Please provide detailed information about CVE-2025-27335

CVE:CVE-2025-27335
Description:Cross-Site Request Forgery (CSRF) vulnerability in Free plug in by SEO Roma Auto Tag Links allows Cross Site Request Forgery. This issue affects Auto Tag Links: from n/a through 1.0.13.
published:2025-02-24T15:15:19.137


Instruction: Please provide detailed information about CVE-2025-27336

CVE:CVE-2025-27336
Description:Cross-Site Request Forgery (CSRF) vulnerability in Alex Prokopenko / JustCoded Just Variables allows Cross Site Request Forgery. This issue affects Just Variables: from n/a through 1.2.3.
published:2025-02-24T15:15:19.283


Instruction: Please provide detailed information about CVE-2025-27339

CVE:CVE-2025-27339
Description:Cross-Site Request Forgery (CSRF) vulnerability in Will Anderson Minimum Password Strength allows Cross Site Request Forgery. This issue affects Minimum Password Strength: from n/a through 1.2.0.
published:2025-02-24T15:15:19.430


Instruction: Please provide detailed information about CVE-2025-27340

CVE:CVE-2025-27340
Description:Cross-Site Request Forgery (CSRF) vulnerability in Marc F12-Profiler allows Cross Site Request Forgery. This issue affects F12-Profiler: from n/a through 1.3.9.
published:2025-02-24T15:15:19.567


Instruction: Please provide detailed information about CVE-2025-27341

CVE:CVE-2025-27341
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in afzal_du Reactive Mortgage Calculator allows Stored XSS. This issue affects Reactive Mortgage Calculator: from n/a through 1.1.
published:2025-02-24T15:15:19.703


Instruction: Please provide detailed information about CVE-2025-27342

CVE:CVE-2025-27342
Description:Cross-Site Request Forgery (CSRF) vulnerability in josesan WooCommerce Recargo de Equivalencia allows Cross Site Request Forgery. This issue affects WooCommerce Recargo de Equivalencia: from n/a through 1.6.24.
published:2025-02-24T15:15:19.833


Instruction: Please provide detailed information about CVE-2025-27344

CVE:CVE-2025-27344
Description:Cross-Site Request Forgery (CSRF) vulnerability in filipstepanov Phee's LinkPreview allows Cross Site Request Forgery. This issue affects Phee's LinkPreview: from n/a through 1.6.7.
published:2025-02-24T15:15:19.963


Instruction: Please provide detailed information about CVE-2025-27347

CVE:CVE-2025-27347
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in techmix Direct Checkout Button for WooCommerce allows Stored XSS. This issue affects Direct Checkout Button for WooCommerce: from n/a through 1.0.
published:2025-02-24T15:15:20.097


Instruction: Please provide detailed information about CVE-2025-27348

CVE:CVE-2025-27348
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Daniel WP Social SEO Booster – Knowledge Graph Social Signals SEO allows Stored XSS. This issue affects WP Social SEO Booster – Knowledge Graph Social Signals SEO: from n/a through 1.2.0.
published:2025-02-24T15:15:20.230


Instruction: Please provide detailed information about CVE-2025-27349

CVE:CVE-2025-27349
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in nurelm Get Posts allows Stored XSS. This issue affects Get Posts: from n/a through 0.6.
published:2025-02-24T15:15:20.363


Instruction: Please provide detailed information about CVE-2025-27351

CVE:CVE-2025-27351
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ExpertBusinessSearch Local Search SEO Contact Page allows Stored XSS. This issue affects Local Search SEO Contact Page: from n/a through 4.0.1.
published:2025-02-24T15:15:20.503


Instruction: Please provide detailed information about CVE-2025-27352

CVE:CVE-2025-27352
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wumii team 无觅相关文章插件 allows Stored XSS. This issue affects 无觅相关文章插件: from n/a through 1.0.5.7.
published:2025-02-24T15:15:20.643


Instruction: Please provide detailed information about CVE-2025-27353

CVE:CVE-2025-27353
Description:Cross-Site Request Forgery (CSRF) vulnerability in Bob Namaste! LMS allows Cross Site Request Forgery. This issue affects Namaste! LMS: from n/a through 2.6.5.
published:2025-02-24T15:15:20.780


Instruction: Please provide detailed information about CVE-2025-27355

CVE:CVE-2025-27355
Description:Cross-Site Request Forgery (CSRF) vulnerability in Nicolas GRILLET Woocommerce – Loi Hamon allows Stored XSS. This issue affects Woocommerce – Loi Hamon: from n/a through 1.1.0.
published:2025-02-24T15:15:20.917


Instruction: Please provide detailed information about CVE-2025-27356

CVE:CVE-2025-27356
Description:Missing Authorization vulnerability in Hardik Sticky Header On Scroll allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Sticky Header On Scroll: from n/a through 1.0.
published:2025-02-24T15:15:21.077


Instruction: Please provide detailed information about CVE-2025-27357

CVE:CVE-2025-27357
Description:Cross-Site Request Forgery (CSRF) vulnerability in Musa AVCI Önceki Yazı Link allows Cross Site Request Forgery. This issue affects Önceki Yazı Link: from n/a through 1.3.
published:2025-02-24T15:15:21.233


Instruction: Please provide detailed information about CVE-2025-25460

CVE:CVE-2025-25460
Description:A stored Cross-Site Scripting (XSS) vulnerability was identified in FlatPress 1.3.1 within the "Add Entry" feature. This vulnerability allows authenticated attackers to inject malicious JavaScript payloads into blog posts, which are executed when other users view the posts. The issue arises due to improper input sanitization of the "TextArea" field in the blog entry submission form.
published:2025-02-24T16:15:14.873


Instruction: Please provide detailed information about CVE-2025-26803

CVE:CVE-2025-26803
Description:The http parser in Phusion Passenger 6.0.21 through 6.0.25 before 6.0.26 allows a denial of service during parsing of a request with an invalid HTTP method.
published:2025-02-24T16:15:15.020


Instruction: Please provide detailed information about CVE-2025-22495

CVE:CVE-2025-22495
Description:An improper input validation vulnerability was discovered in the NTP server configuration field of the Network-M2 card. This could result in an authenticated high privileged user having the ability to execute arbitrary commands. The vulnerability has been resolved in the version 3.0.4.  Note - Network-M2 has been declared end-of-life in early 2024 and Network-M3 has been released as a fit-and-functional replacement.
published:2025-02-24T17:15:13.723


Instruction: Please provide detailed information about CVE-2025-26200

CVE:CVE-2025-26200
Description:SQL injection in SLIMS v.9.6.1 allows a remote attacker to escalate privileges via the month parameter in the visitor_report_day.php component.
published:2025-02-24T17:15:14.273


Instruction: Please provide detailed information about CVE-2025-26201

CVE:CVE-2025-26201
Description:Credential disclosure vulnerability via the /staff route in GreaterWMS <= 2.1.49 allows a remote unauthenticated attackers to bypass authentication and escalate privileges.
published:2025-02-24T17:15:14.460


Instruction: Please provide detailed information about CVE-2025-27112

CVE:CVE-2025-27112
Description:Navidrome is an open source web-based music collection server and streamer. Starting in version 0.52.0 and prior to version 0.54.5, in certain Subsonic API endpoints, a flaw in the authentication check process allows an attacker to specify any arbitrary username that does not exist on the system, along with a salted hash of an empty password. Under these conditions, Navidrome treats the request as authenticated, granting access to various Subsonic endpoints without requiring valid credentials. An attacker can use any non-existent username to bypass the authentication system and gain access to various read-only data in Navidrome, such as user playlists. However, any attempt to modify data fails with a "permission denied" error due to insufficient permissions, limiting the impact to unauthorized viewing of information. Version 0.54.5 contains a patch for this issue.
published:2025-02-24T19:15:14.597


Instruction: Please provide detailed information about CVE-2025-27133

CVE:CVE-2025-27133
Description:WeGIA is a Web manager for charitable institutions. A SQL Injection vulnerability was discovered in the WeGIA application prior to version 3.2.15 at the `adicionar_tipo_exame.php` endpoint. This vulnerability allows an authorized attacker to execute arbitrary SQL queries, allowing access to sensitive information. Version 3.2.15 contains a patch for the issue.
published:2025-02-24T19:15:14.763


Instruction: Please provide detailed information about CVE-2025-27364

CVE:CVE-2025-27364
Description:In MITRE Caldera through 4.2.0 and 5.0.0 before 35bc06e, a Remote Code Execution (RCE) vulnerability was found in the dynamic agent (implant) compilation functionality of the server. This allows remote attackers to execute arbitrary code on the server that Caldera is running on via a crafted web request to the Caldera server API used for compiling and downloading of Caldera's Sandcat or Manx agent (implants). This web request can use the gcc -extldflags linker flag with sub-commands.
published:2025-02-24T19:15:14.917


Instruction: Please provide detailed information about CVE-2025-26525

CVE:CVE-2025-26525
Description:Insufficient sanitizing in the TeX notation filter resulted in an  arbitrary file read risk on sites where pdfTeX is available (such as  those with TeX Live installed).
published:2025-02-24T20:15:33.103


Instruction: Please provide detailed information about CVE-2025-26526

CVE:CVE-2025-26526
Description:Separate Groups mode restrictions were not factored into permission  checks before allowing viewing or deletion of responses in Feedback  activities.
published:2025-02-24T20:15:33.263


Instruction: Please provide detailed information about CVE-2025-26527

CVE:CVE-2025-26527
Description:Tags not expected to be visible to a user could still be discovered by them via the tag search page or in the tags block.
published:2025-02-24T20:15:33.403


Instruction: Please provide detailed information about CVE-2025-26528

CVE:CVE-2025-26528
Description:The drag-and-drop onto image (ddimageortext) question type required additional sanitizing to prevent a stored XSS risk.
published:2025-02-24T20:15:33.543


Instruction: Please provide detailed information about CVE-2025-26529

CVE:CVE-2025-26529
Description:Description information displayed in the site administration live log  required additional sanitizing to prevent a stored XSS risk.
published:2025-02-24T20:15:33.677


Instruction: Please provide detailed information about CVE-2025-26530

CVE:CVE-2025-26530
Description:The question bank filter required additional sanitizing to prevent a reflected XSS risk.
published:2025-02-24T20:15:33.807


Instruction: Please provide detailed information about CVE-2025-26531

CVE:CVE-2025-26531
Description:Insufficient capability checks made it possible to disable badges a user does not have permission to access.
published:2025-02-24T20:15:33.933


Instruction: Please provide detailed information about CVE-2025-26532

CVE:CVE-2025-26532
Description:Additional checks were required to ensure trusttext is applied (when enabled) to glossary entries being restored.
published:2025-02-24T20:15:34.053


Instruction: Please provide detailed information about CVE-2025-26533

CVE:CVE-2025-26533
Description:An SQL injection risk was identified in the module list filter within course search.
published:2025-02-24T21:15:11.057


Instruction: Please provide detailed information about CVE-2025-27137

CVE:CVE-2025-27137
Description:Dependency-Track is a component analysis platform that allows organizations to identify and reduce risk in the software supply chain. Dependency-Track allows users with the `SYSTEM_CONFIGURATION` permission to customize notification templates. Templates are evaluated using the Pebble template engine. Pebble supports an `include` tag, which allows template authors to include the content of arbitrary files upon evaluation. Prior to version 4.12.6, users of Dependency-Track with the `SYSTEM_CONFIGURATION` permission can abuse the `include` tag by crafting notification templates that `include` sensitive local files, such as `/etc/passwd` or `/proc/1/environ`. By configuring such a template for a notification rule (aka "Alert"), and having it send notifications to a destination controlled by the actor, sensitive information may be leaked. The issue has been fixed in Dependency-Track 4.12.6. In fixed versions, the `include` tag can no longer be used. Usage of the tag will cause template evaluation to fail. As a workaround, avoid assigning the `SYSTEM_CONFIGURATION` permission to untrusted users. The `SYSTEM_CONFIGURATION` permission per default is only granted to members of the `Administrators` team. Assigning this permission to non-administrative users or teams is a security risk in itself, and highly discouraged.
published:2025-02-24T21:15:11.213


Instruction: Please provide detailed information about CVE-2025-25513

CVE:CVE-2025-25513
Description:Seacms <=13.3 is vulnerable to SQL Injection in admin_members.php.
published:2025-02-24T22:15:22.807


Instruction: Please provide detailed information about CVE-2025-27140

CVE:CVE-2025-27140
Description:WeGIA is a Web manager for charitable institutions. An OS Command Injection vulnerability was discovered in versions prior to 3.2.15 of the WeGIA application, `importar_dump.php` endpoint. This vulnerability could allow an attacker to execute arbitrary code remotely. The command is basically a command to move a temporary file, so a webshell upload is also possible. Version 3.2.15 contains a patch for the issue.
published:2025-02-24T22:15:22.913


Instruction: Please provide detailed information about CVE-2025-27141

CVE:CVE-2025-27141
Description:Metabase Enterprise Edition is the enterprise version of Metabase business intelligence and data analytics software. Starting in version 1.47.0 and prior to versions 1.50.36, 1.51.14, 1.52.11, and 1.53.2 of Metabase Enterprise Edition, users with impersonation permissions may be able to see results of cached questions, even if their permissions don’t allow them to see the data. If some user runs a question which gets cached, and then an impersonated user runs that question, then the impersonated user sees the same results as the previous user. These cached results may include data the impersonated user should not have access to. This vulnerability only impacts the Enterprise Edition of Metabase and not the Open Source Edition. Versions 1.53.2, 1.52.11, 1.51.14, and 1.50.36 contains a patch. Versions on the 1.49.X, 1.48.X, and 1.47.X branches are vulnerable but do not have a patch available, so users should upgrade to a major version with an available fix. Disabling question caching is a workaround for this issue.
published:2025-02-24T22:15:23.077


Instruction: Please provide detailed information about CVE-2025-22974

CVE:CVE-2025-22974
Description:SQL Injection vulnerability in SeaCMS v.13.2 and before allows a remote attacker to execute arbitrary code via the DoTranExecSql parameter in the phome.php component.
published:2025-02-24T23:15:11.033


Instruction: Please provide detailed information about CVE-2025-27143

CVE:CVE-2025-27143
Description:Better Auth is an authentication and authorization library for TypeScript. Prior to version 1.1.21, the application is vulnerable to an open redirect due to improper validation of the callbackURL parameter in the email verification endpoint and any other endpoint that accepts callback url. While the server blocks fully qualified URLs, it incorrectly allows scheme-less URLs. This results in the browser interpreting the URL as a fully qualified URL, leading to unintended redirection. An attacker can exploit this flaw by crafting a malicious verification link and tricking users into clicking it. Upon successful email verification, the user will be automatically redirected to the attacker's website, which can be used for phishing, malware distribution, or stealing sensitive authentication tokens. This CVE is a bypass of the fix for GHSA-8jhw-6pjj-8723/CVE-2024-56734. Version 1.1.21 contains an updated patch.
published:2025-02-24T23:15:11.160


Instruction: Please provide detailed information about CVE-2025-27144

CVE:CVE-2025-27144
Description:Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. In versions on the 4.x branch prior to version 4.0.5, when parsing compact JWS or JWE input, Go JOSE could use excessive memory. The code used strings.Split(token, ".") to split JWT tokens, which is vulnerable to excessive memory consumption when processing maliciously crafted tokens with a large number of `.` characters.  An attacker could exploit this by sending numerous malformed tokens, leading to memory exhaustion and a Denial of Service. Version 4.0.5 fixes this issue. As a workaround, applications could pre-validate that payloads passed to Go JOSE do not contain an excessive number of `.` characters.
published:2025-02-24T23:15:11.427


Instruction: Please provide detailed information about CVE-2025-1640

CVE:CVE-2025-1640
Description:A vulnerability was found in Benner ModernaNet up to 1.1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /Home/JS_CarregaCombo?formName=DADOS_PESSOAIS_PLANO&additionalCondition=&insideParameters=&elementToReturn=DADOS_PESSOAIS_PLANO&ordenarPelaDescricao=true&direcaoOrdenacao=asc&_=1739290047295. The manipulation leads to sql injection. The attack may be launched remotely. Upgrading to version 1.1.1 is able to address this issue. It is recommended to upgrade the affected component.
published:2025-02-25T00:15:09.723


Instruction: Please provide detailed information about CVE-2025-1641

CVE:CVE-2025-1641
Description:A vulnerability was found in Benner ModernaNet up to 1.1.0. It has been classified as critical. This affects an unknown part of the file /AGE0000700/GetHorariosDoDia?idespec=0&idproced=1103&data=2025-02-25+19%3A25&agserv=0&convenio=1&localatend=1&idplano=5&pesfis=01&idprofissional=0&target=.horarios--dia--d0&_=1739371223797. The manipulation leads to sql injection. It is possible to initiate the attack remotely. Upgrading to version 1.1.1 is able to address this issue. It is recommended to upgrade the affected component.
published:2025-02-25T00:15:09.913


Instruction: Please provide detailed information about CVE-2025-1642

CVE:CVE-2025-1642
Description:A vulnerability was found in Benner ModernaNet up to 1.1.0. It has been declared as critical. This vulnerability affects unknown code of the file /AGE0000700/GetImageMedico?fooId=1. The manipulation of the argument fooId leads to improper control of resource identifiers. The attack can be initiated remotely. Upgrading to version 1.1.1 is able to address this issue. It is recommended to upgrade the affected component.
published:2025-02-25T01:15:09.057


Instruction: Please provide detailed information about CVE-2025-1643

CVE:CVE-2025-1643
Description:A vulnerability was found in Benner ModernaNet up to 1.1.0. It has been rated as problematic. This issue affects some unknown processing of the file /DadosPessoais/SG_AlterarSenha. The manipulation leads to cross-site request forgery. The attack may be initiated remotely. Upgrading to version 1.1.1 is able to address this issue. It is recommended to upgrade the affected component.
published:2025-02-25T01:15:09.783


Instruction: Please provide detailed information about CVE-2025-1644

CVE:CVE-2025-1644
Description:A vulnerability classified as problematic has been found in Benner ModernaNet up to 1.2.0. Affected is an unknown function of the file /DadosPessoais/SG_Gravar. The manipulation of the argument idItAg leads to cross-site request forgery. It is possible to launch the attack remotely. Upgrading to version 1.2.1 is able to address this issue. It is recommended to upgrade the affected component.
published:2025-02-25T02:15:14.863


Instruction: Please provide detailed information about CVE-2025-1645

CVE:CVE-2025-1645
Description:A vulnerability classified as critical was found in Benner Connecta 1.0.5330. Affected by this vulnerability is an unknown functionality of the file /Usuarios/Usuario/EditarLogado/. The manipulation of the argument Handle leads to improper control of resource identifiers. The attack can be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-02-25T02:15:16.123


Instruction: Please provide detailed information about CVE-2025-27145

CVE:CVE-2025-27145
Description:copyparty, a portable file server, has a DOM-based cross-site scripting vulnerability in versions prior to 1.16.15. The vulnerability is considered low-risk. By handing someone a maliciously-named file, and then tricking them into dragging the file into copyparty's Web-UI, an attacker could execute arbitrary javascript with the same privileges as that user. For example, this could give unintended read-access to files owned by that user. The bug is triggered by the drag-drop action itself; it is not necessary to actually initiate the upload. The file must be empty (zero bytes). Note that, as a general-purpose webserver, it is intentionally possible to upload HTML-files with arbitrary javascript in `<script>` tags, which will execute when the file is opened. The difference is that this vulnerability would trigger execution of javascript during the act of uploading, and not when the uploaded file was opened. Version 1.16.15 contains a fix.
published:2025-02-25T02:15:16.300


Instruction: Please provide detailed information about CVE-2025-1646

CVE:CVE-2025-1646
Description:A vulnerability, which was classified as critical, has been found in Lumsoft ERP 8. Affected by this issue is some unknown functionality of the file /Api/TinyMce/UploadAjaxAPI.ashx of the component ASPX File Handler. The manipulation of the argument file leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-02-25T03:15:09.670


Instruction: Please provide detailed information about CVE-2025-22210

CVE:CVE-2025-22210
Description:A SQL injection vulnerability in the Hikashop component versions 3.3.0-5.1.4 for Joomla allows authenticated attackers (administrator) to execute arbitrary SQL commands in the category management area in backend.
published:2025-02-25T06:15:23.343


Instruction: Please provide detailed information about CVE-2025-1063

CVE:CVE-2025-1063
Description:The Classified Listing – Classified ads & Business Directory Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.0.4 via the rtcl_taxonomy_settings_export function. This makes it possible for unauthenticated attackers to extract sensitive data including API keys and tokens.
published:2025-02-25T07:15:17.127


Instruction: Please provide detailed information about CVE-2025-1128

CVE:CVE-2025-1128
Description:The Everest Forms – Contact Forms, Quiz, Survey, Newsletter & Payment Form Builder for WordPress plugin for WordPress is vulnerable to arbitrary file upload, read, and deletion due to missing file type and path validation in the 'format' method of the EVF_Form_Fields_Upload class in all versions up to, and including, 3.0.9.4. This makes it possible for unauthenticated attackers to upload, read, and delete arbitrary files on the affected site's server which may make remote code execution, sensitive information disclosure, or a site takeover possible.
published:2025-02-25T07:15:18.480


Instruction: Please provide detailed information about CVE-2025-1648

CVE:CVE-2025-1648
Description:The Yawave plugin for WordPress is vulnerable to SQL Injection via the 'lbid' parameter in all versions up to, and including, 2.9.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
published:2025-02-25T07:15:18.670


Instruction: Please provide detailed information about CVE-2025-1673

CVE:CVE-2025-1673
Description:A malicious or malformed DNS packet without a payload can cause an out-of-bounds read, resulting in a crash (denial of service) or an incorrect computation.
published:2025-02-25T07:15:18.837


Instruction: Please provide detailed information about CVE-2025-1674

CVE:CVE-2025-1674
Description:A lack of input validation allows for out of bounds reads caused by malicious or malformed packets.
published:2025-02-25T08:15:29.887


Instruction: Please provide detailed information about CVE-2025-1675

CVE:CVE-2025-1675
Description:The function dns_copy_qname in dns_pack.c performs performs a memcpy operation with an untrusted field and does not check if the source buffer is large enough to contain the copied data.
published:2025-02-25T08:15:30.020


Instruction: Please provide detailed information about CVE-2025-1676

CVE:CVE-2025-1676
Description:A vulnerability classified as critical was found in hzmanyun Education and Training System 3.1.1. Affected by this vulnerability is the function pdf2swf of the file /pdf2swf. The manipulation of the argument file leads to os command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
published:2025-02-25T11:15:09.303


Instruction: Please provide detailed information about CVE-2025-1262

CVE:CVE-2025-1262
Description:The Advanced Google reCaptcha plugin for WordPress is vulnerable to CAPTCHA Bypass in versions up to, and including, 1.27 . This makes it possible for unauthenticated attackers to bypass the Built-in Math Captcha Verification.
published:2025-02-25T13:15:10.077


Instruction: Please provide detailed information about CVE-2024-12424

CVE:CVE-2024-12424
Description:Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2025-24592. Reason: This candidate is a reservation duplicate of CVE-2025-24592. Notes: All CVE users should reference CVE-2025-24592 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
published:2025-02-25T15:15:21.273


Instruction: Please provide detailed information about CVE-2025-26751

CVE:CVE-2025-26751
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Fahad Mahmood Alphabetic Pagination allows Reflected XSS. This issue affects Alphabetic Pagination: from n/a through 3.2.1.
published:2025-02-25T15:15:23.457


Instruction: Please provide detailed information about CVE-2025-26752

CVE:CVE-2025-26752
Description:Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in videowhisper VideoWhisper Live Streaming Integration allows Path Traversal. This issue affects VideoWhisper Live Streaming Integration: from n/a through 6.2.
published:2025-02-25T15:15:23.597


Instruction: Please provide detailed information about CVE-2025-26753

CVE:CVE-2025-26753
Description:Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in videowhisper VideoWhisper Live Streaming Integration allows Path Traversal. This issue affects VideoWhisper Live Streaming Integration: from n/a through 6.2.
published:2025-02-25T15:15:23.750


Instruction: Please provide detailed information about CVE-2025-26868

CVE:CVE-2025-26868
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in fastflow Fast Flow allows Reflected XSS. This issue affects Fast Flow: from n/a through 1.2.16.
published:2025-02-25T15:15:23.903


Instruction: Please provide detailed information about CVE-2025-26871

CVE:CVE-2025-26871
Description:Missing Authorization vulnerability in WPDeveloper Essential Blocks for Gutenberg allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Essential Blocks for Gutenberg: from n/a through 4.8.3.
published:2025-02-25T15:15:24.040


Instruction: Please provide detailed information about CVE-2025-26876

CVE:CVE-2025-26876
Description:Path Traversal vulnerability in CodeManas Search with Typesense allows Path Traversal. This issue affects Search with Typesense: from n/a through 2.0.8.
published:2025-02-25T15:15:24.180


Instruction: Please provide detailed information about CVE-2025-26877

CVE:CVE-2025-26877
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rustaurius Front End Users allows Stored XSS. This issue affects Front End Users: from n/a through 3.2.30.
published:2025-02-25T15:15:24.380


Instruction: Please provide detailed information about CVE-2025-26878

CVE:CVE-2025-26878
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in patternsinthecloud Autoship Cloud for WooCommerce Subscription Products allows DOM-Based XSS. This issue affects Autoship Cloud for WooCommerce Subscription Products: from n/a through 2.8.0.1.
published:2025-02-25T15:15:24.560


Instruction: Please provide detailed information about CVE-2025-26881

CVE:CVE-2025-26881
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Sticky Content allows Stored XSS. This issue affects Sticky Content: from n/a through 1.0.1.
published:2025-02-25T15:15:24.690


Instruction: Please provide detailed information about CVE-2025-26882

CVE:CVE-2025-26882
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GhozyLab Popup Builder allows Stored XSS. This issue affects Popup Builder: from n/a through 1.1.33.
published:2025-02-25T15:15:24.837


Instruction: Please provide detailed information about CVE-2025-26884

CVE:CVE-2025-26884
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpsoul Greenshift allows Stored XSS. This issue affects Greenshift: from n/a through 10.8.
published:2025-02-25T15:15:24.977


Instruction: Please provide detailed information about CVE-2025-26887

CVE:CVE-2025-26887
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Eli EZ SQL Reports Shortcode Widget and DB Backup allows Stored XSS. This issue affects EZ SQL Reports Shortcode Widget and DB Backup: from n/a through 5.21.35.
published:2025-02-25T15:15:25.117


Instruction: Please provide detailed information about CVE-2025-26891

CVE:CVE-2025-26891
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VW THEMES Ibtana allows Stored XSS. This issue affects Ibtana: from n/a through 1.2.4.9.
published:2025-02-25T15:15:25.253


Instruction: Please provide detailed information about CVE-2025-26893

CVE:CVE-2025-26893
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kiran Potphode Easy Charts allows DOM-Based XSS. This issue affects Easy Charts: from n/a through 1.2.3.
published:2025-02-25T15:15:25.390


Instruction: Please provide detailed information about CVE-2025-26896

CVE:CVE-2025-26896
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in vpiwigo PiwigoPress allows Stored XSS. This issue affects PiwigoPress: from n/a through 2.33.
published:2025-02-25T15:15:25.527


Instruction: Please provide detailed information about CVE-2025-26897

CVE:CVE-2025-26897
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Baden List Related Attachments allows DOM-Based XSS. This issue affects List Related Attachments: from n/a through 2.1.6.
published:2025-02-25T15:15:25.690


Instruction: Please provide detailed information about CVE-2025-26900

CVE:CVE-2025-26900
Description:Deserialization of Untrusted Data vulnerability in flexmls Flexmls® IDX allows Object Injection. This issue affects Flexmls® IDX: from n/a through 3.14.27.
published:2025-02-25T15:15:25.853


Instruction: Please provide detailed information about CVE-2025-26904

CVE:CVE-2025-26904
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in gal_op WP Responsive Auto Fit Text allows DOM-Based XSS. This issue affects WP Responsive Auto Fit Text: from n/a through 0.2.
published:2025-02-25T15:15:25.990


Instruction: Please provide detailed information about CVE-2025-26905

CVE:CVE-2025-26905
Description:Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Estatik Estatik allows PHP Local File Inclusion. This issue affects Estatik: from n/a through 4.1.9.
published:2025-02-25T15:15:26.127


Instruction: Please provide detailed information about CVE-2025-26907

CVE:CVE-2025-26907
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Estatik Mortgage Calculator Estatik allows Stored XSS. This issue affects Mortgage Calculator Estatik: from n/a through 2.0.12.
published:2025-02-25T15:15:26.263


Instruction: Please provide detailed information about CVE-2025-26911

CVE:CVE-2025-26911
Description:Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Bowo System Dashboard allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects System Dashboard: from n/a through 2.8.18.
published:2025-02-25T15:15:26.393


Instruction: Please provide detailed information about CVE-2025-26912

CVE:CVE-2025-26912
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HashThemes Easy Elementor Addons allows Stored XSS. This issue affects Easy Elementor Addons: from n/a through 2.1.6.
published:2025-02-25T15:15:26.530


Instruction: Please provide detailed information about CVE-2025-26913

CVE:CVE-2025-26913
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webandprint AR For WordPress allows DOM-Based XSS. This issue affects AR For WordPress: from n/a through 7.7.
published:2025-02-25T15:15:26.663


Instruction: Please provide detailed information about CVE-2025-26915

CVE:CVE-2025-26915
Description:Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in PickPlugins Wishlist allows SQL Injection. This issue affects Wishlist: from n/a through 1.0.41.
published:2025-02-25T15:15:26.793


Instruction: Please provide detailed information about CVE-2025-26926

CVE:CVE-2025-26926
Description:Cross-Site Request Forgery (CSRF) vulnerability in NotFound Booknetic. This issue affects Booknetic: from n/a through 4.0.9.
published:2025-02-25T15:15:26.930


Instruction: Please provide detailed information about CVE-2025-26928

CVE:CVE-2025-26928
Description:Missing Authorization vulnerability in xfinitysoft Order Limit for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Order Limit for WooCommerce: from n/a through 3.0.2.
published:2025-02-25T15:15:27.067


Instruction: Please provide detailed information about CVE-2025-26931

CVE:CVE-2025-26931
Description:Cross-Site Request Forgery (CSRF) vulnerability in Tribulant Software Tribulant Gallery Voting allows Stored XSS. This issue affects Tribulant Gallery Voting: from n/a through 1.2.1.
published:2025-02-25T15:15:27.200


Instruction: Please provide detailed information about CVE-2025-26932

CVE:CVE-2025-26932
Description:Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in QuantumCloud ChatBot allows PHP Local File Inclusion. This issue affects ChatBot: from n/a through 6.3.5.
published:2025-02-25T15:15:27.337


Instruction: Please provide detailed information about CVE-2025-26935

CVE:CVE-2025-26935
Description:Path Traversal vulnerability in wpjobportal WP Job Portal allows PHP Local File Inclusion. This issue affects WP Job Portal: from n/a through 2.2.8.
published:2025-02-25T15:15:27.470


Instruction: Please provide detailed information about CVE-2025-26937

CVE:CVE-2025-26937
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Icon List Block allows Stored XSS. This issue affects Icon List Block: from n/a through 1.1.3.
published:2025-02-25T15:15:27.607


Instruction: Please provide detailed information about CVE-2025-26938

CVE:CVE-2025-26938
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Countdown Timer allows Stored XSS. This issue affects Countdown Timer: from n/a through 1.2.6.
published:2025-02-25T15:15:27.747


Instruction: Please provide detailed information about CVE-2025-26939

CVE:CVE-2025-26939
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Counters Block allows Stored XSS. This issue affects Counters Block: from n/a through 1.1.2.
published:2025-02-25T15:15:27.883


Instruction: Please provide detailed information about CVE-2025-26943

CVE:CVE-2025-26943
Description:Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Jürgen Müller Easy Quotes allows Blind SQL Injection. This issue affects Easy Quotes: from n/a through 1.2.2.
published:2025-02-25T15:15:28.030


Instruction: Please provide detailed information about CVE-2025-26945

CVE:CVE-2025-26945
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Info Cards – Gutenberg block for creating Beautiful Cards allows Stored XSS. This issue affects Info Cards – Gutenberg block for creating Beautiful Cards: from n/a through 1.0.5.
published:2025-02-25T15:15:28.177


Instruction: Please provide detailed information about CVE-2025-26946

CVE:CVE-2025-26946
Description:Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in jgwhite33 WP Yelp Review Slider allows Blind SQL Injection. This issue affects WP Yelp Review Slider: from n/a through 8.1.
published:2025-02-25T15:15:28.320


Instruction: Please provide detailed information about CVE-2025-26947

CVE:CVE-2025-26947
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Services Section block allows Stored XSS. This issue affects Services Section block: from n/a through 1.3.4.
published:2025-02-25T15:15:28.457


Instruction: Please provide detailed information about CVE-2025-26948

CVE:CVE-2025-26948
Description:Missing Authorization vulnerability in NotFound Pie Register Premium. This issue affects Pie Register Premium: from n/a through 3.8.3.2.
published:2025-02-25T15:15:28.597


Instruction: Please provide detailed information about CVE-2025-26949

CVE:CVE-2025-26949
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Team Section Block allows Stored XSS. This issue affects Team Section Block: from n/a through 1.0.9.
published:2025-02-25T15:15:28.733


Instruction: Please provide detailed information about CVE-2025-26952

CVE:CVE-2025-26952
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Business Card Block allows Stored XSS. This issue affects Business Card Block: from n/a through 1.0.5.
published:2025-02-25T15:15:28.870


Instruction: Please provide detailed information about CVE-2025-26957

CVE:CVE-2025-26957
Description:Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Deetronix Affiliate Coupons allows PHP Local File Inclusion. This issue affects Affiliate Coupons: from n/a through 1.7.3.
published:2025-02-25T15:15:29.010


Instruction: Please provide detailed information about CVE-2025-26960

CVE:CVE-2025-26960
Description:Missing Authorization vulnerability in enituretechnology Small Package Quotes – Unishippers Edition allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Small Package Quotes – Unishippers Edition: from n/a through 2.4.9.
published:2025-02-25T15:15:29.150


Instruction: Please provide detailed information about CVE-2025-26962

CVE:CVE-2025-26962
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GhozyLab Easy Contact Form Lite  allows Stored XSS. This issue affects Easy Contact Form Lite : from n/a through 1.1.25.
published:2025-02-25T15:15:29.290


Instruction: Please provide detailed information about CVE-2025-26963

CVE:CVE-2025-26963
Description:Cross-Site Request Forgery (CSRF) vulnerability in flowdee ClickWhale allows Cross Site Request Forgery. This issue affects ClickWhale: from n/a through 2.4.3.
published:2025-02-25T15:15:29.420


Instruction: Please provide detailed information about CVE-2025-26964

CVE:CVE-2025-26964
Description:Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Themewinter Eventin allows PHP Local File Inclusion. This issue affects Eventin: from n/a through 4.0.20.
published:2025-02-25T15:15:29.557


Instruction: Please provide detailed information about CVE-2025-26965

CVE:CVE-2025-26965
Description:Authorization Bypass Through User-Controlled Key vulnerability in ameliabooking Amelia allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Amelia: from n/a through 1.2.16.
published:2025-02-25T15:15:29.703


Instruction: Please provide detailed information about CVE-2025-26966

CVE:CVE-2025-26966
Description:Authentication Bypass Using an Alternate Path or Channel vulnerability in Aldo Latino PrivateContent. This issue affects PrivateContent: from n/a through 8.11.5.
published:2025-02-25T15:15:29.870


Instruction: Please provide detailed information about CVE-2025-26971

CVE:CVE-2025-26971
Description:Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ays-pro Poll Maker allows Blind SQL Injection. This issue affects Poll Maker: from n/a through 5.6.5.
published:2025-02-25T15:15:30.017


Instruction: Please provide detailed information about CVE-2025-26974

CVE:CVE-2025-26974
Description:Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPExperts.io WP Multi Store Locator allows Blind SQL Injection. This issue affects WP Multi Store Locator: from n/a through 2.5.1.
published:2025-02-25T15:15:30.153


Instruction: Please provide detailed information about CVE-2025-26975

CVE:CVE-2025-26975
Description:Missing Authorization vulnerability in WP Chill Strong Testimonials allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Strong Testimonials: from n/a through 3.2.3.
published:2025-02-25T15:15:30.300


Instruction: Please provide detailed information about CVE-2025-26977

CVE:CVE-2025-26977
Description:Authorization Bypass Through User-Controlled Key vulnerability in Ninja Team Filebird allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Filebird: from n/a through 6.4.2.1.
published:2025-02-25T15:15:30.443


Instruction: Please provide detailed information about CVE-2025-26979

CVE:CVE-2025-26979
Description:Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in FunnelKit Funnel Builder by FunnelKit allows PHP Local File Inclusion. This issue affects Funnel Builder by FunnelKit: from n/a through 3.9.0.
published:2025-02-25T15:15:30.587


Instruction: Please provide detailed information about CVE-2025-26980

CVE:CVE-2025-26980
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Wired Impact Wired Impact Volunteer Management allows Stored XSS. This issue affects Wired Impact Volunteer Management: from n/a through 2.5.
published:2025-02-25T15:15:30.730


Instruction: Please provide detailed information about CVE-2025-26981

CVE:CVE-2025-26981
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in accessiBe Web Accessibility By accessiBe allows Reflected XSS. This issue affects Web Accessibility By accessiBe: from n/a through 2.5.
published:2025-02-25T15:15:30.873


Instruction: Please provide detailed information about CVE-2025-26983

CVE:CVE-2025-26983
Description:Missing Authorization vulnerability in WPZOOM Recipe Card Blocks for Gutenberg & Elementor allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Recipe Card Blocks for Gutenberg & Elementor: from n/a through 3.4.3.
published:2025-02-25T15:15:31.043


Instruction: Please provide detailed information about CVE-2025-26985

CVE:CVE-2025-26985
Description:Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Majestic Support Majestic Support allows PHP Local File Inclusion. This issue affects Majestic Support: from n/a through 1.0.6.
published:2025-02-25T15:15:31.183


Instruction: Please provide detailed information about CVE-2025-26987

CVE:CVE-2025-26987
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Shabti Kaplan Frontend Admin by DynamiApps allows Reflected XSS. This issue affects Frontend Admin by DynamiApps: from n/a through 3.25.17.
published:2025-02-25T15:15:31.313


Instruction: Please provide detailed information about CVE-2025-26991

CVE:CVE-2025-26991
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ollybach WPPizza allows Reflected XSS. This issue affects WPPizza: from n/a through 3.19.4.
published:2025-02-25T15:15:31.460


Instruction: Please provide detailed information about CVE-2025-26993

CVE:CVE-2025-26993
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vito Peleg Atarim allows Reflected XSS. This issue affects Atarim: from n/a through 4.1.0.
published:2025-02-25T15:15:31.590


Instruction: Please provide detailed information about CVE-2025-26995

CVE:CVE-2025-26995
Description:Missing Authorization vulnerability in Anton Vanyukov Market Exporter allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Market Exporter: from n/a through 2.0.21.
published:2025-02-25T15:15:31.720


Instruction: Please provide detailed information about CVE-2025-27000

CVE:CVE-2025-27000
Description:Missing Authorization vulnerability in George Pattichis Simple Photo Feed allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Simple Photo Feed: from n/a through 1.4.0.
published:2025-02-25T15:15:31.853