Instruction: Please provide detailed information about CVE-2025-23428

CVE:CVE-2025-23428
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound QMean – WordPress Did You Mean allows Reflected XSS. This issue affects QMean – WordPress Did You Mean: from n/a through 2.0.
published:2025-02-14T13:15:43.160


Instruction: Please provide detailed information about CVE-2025-23431

CVE:CVE-2025-23431
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound Envato Affiliater allows Reflected XSS. This issue affects Envato Affiliater: from n/a through 1.2.4.
published:2025-02-14T13:15:43.300


Instruction: Please provide detailed information about CVE-2025-23474

CVE:CVE-2025-23474
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mike Martel Live Dashboard allows Reflected XSS. This issue affects Live Dashboard: from n/a through 0.3.3.
published:2025-02-14T13:15:43.437


Instruction: Please provide detailed information about CVE-2025-23492

CVE:CVE-2025-23492
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CantonBolo WordPress 淘宝客插件 allows Reflected XSS. This issue affects WordPress 淘宝客插件: from n/a through 1.1.2.
published:2025-02-14T13:15:43.573


Instruction: Please provide detailed information about CVE-2025-23523

CVE:CVE-2025-23523
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hoststreamsell HSS Embed Streaming Video allows Reflected XSS. This issue affects HSS Embed Streaming Video: from n/a through 3.23.
published:2025-02-14T13:15:43.703


Instruction: Please provide detailed information about CVE-2025-23525

CVE:CVE-2025-23525
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in kvvaradha Kv Compose Email From Dashboard allows Reflected XSS. This issue affects Kv Compose Email From Dashboard: from n/a through 1.1.
published:2025-02-14T13:15:43.840


Instruction: Please provide detailed information about CVE-2025-23534

CVE:CVE-2025-23534
Description:Missing Authorization vulnerability in Mark Winiarski WPLingo allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WPLingo: from n/a through 1.1.2.
published:2025-02-14T13:15:43.980


Instruction: Please provide detailed information about CVE-2025-23568

CVE:CVE-2025-23568
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in fredsted WP Login Attempt Log allows Reflected XSS. This issue affects WP Login Attempt Log: from n/a through 1.3.
published:2025-02-14T13:15:44.123


Instruction: Please provide detailed information about CVE-2025-23571

CVE:CVE-2025-23571
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound Internal Links Generator allows Reflected XSS. This issue affects Internal Links Generator: from n/a through 3.51.
published:2025-02-14T13:15:44.330


Instruction: Please provide detailed information about CVE-2025-23598

CVE:CVE-2025-23598
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in craig.edmunds@gmail.com Recip.ly allows Reflected XSS. This issue affects Recip.ly: from n/a through 1.1.8.
published:2025-02-14T13:15:44.483


Instruction: Please provide detailed information about CVE-2025-23646

CVE:CVE-2025-23646
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Matt Brooks Library Instruction Recorder allows Reflected XSS. This issue affects Library Instruction Recorder: from n/a through 1.1.4.
published:2025-02-14T13:15:44.617


Instruction: Please provide detailed information about CVE-2025-23647

CVE:CVE-2025-23647
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ariagle WP-Clap allows Reflected XSS. This issue affects WP-Clap: from n/a through 1.5.
published:2025-02-14T13:15:44.790


Instruction: Please provide detailed information about CVE-2025-23648

CVE:CVE-2025-23648
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wjharil AdsMiddle allows Reflected XSS. This issue affects AdsMiddle: from n/a through 1.0.
published:2025-02-14T13:15:44.930


Instruction: Please provide detailed information about CVE-2025-23650

CVE:CVE-2025-23650
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in razvypp Tidy.ro allows Reflected XSS. This issue affects Tidy.ro: from n/a through 1.3.
published:2025-02-14T13:15:45.063


Instruction: Please provide detailed information about CVE-2025-23651

CVE:CVE-2025-23651
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound Scroll Top allows Reflected XSS. This issue affects Scroll Top: from n/a through 1.3.3.
published:2025-02-14T13:15:45.200


Instruction: Please provide detailed information about CVE-2025-23652

CVE:CVE-2025-23652
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound Add custom content after post allows Reflected XSS. This issue affects Add custom content after post: from n/a through 1.0.
published:2025-02-14T13:15:45.333


Instruction: Please provide detailed information about CVE-2025-23653

CVE:CVE-2025-23653
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound Form To Online Booking allows Reflected XSS. This issue affects Form To Online Booking: from n/a through 1.0.
published:2025-02-14T13:15:45.467


Instruction: Please provide detailed information about CVE-2025-23655

CVE:CVE-2025-23655
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound Contact Form 7 – Paystack Add-on allows Reflected XSS. This issue affects Contact Form 7 – Paystack Add-on: from n/a through 1.2.3.
published:2025-02-14T13:15:45.610


Instruction: Please provide detailed information about CVE-2025-23657

CVE:CVE-2025-23657
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound WordPress-to-candidate for Salesforce CRM allows Reflected XSS. This issue affects WordPress-to-candidate for Salesforce CRM: from n/a through 1.0.1.
published:2025-02-14T13:15:45.760


Instruction: Please provide detailed information about CVE-2025-23658

CVE:CVE-2025-23658
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tauhidul Alam Advanced Angular Contact Form allows Reflected XSS. This issue affects Advanced Angular Contact Form: from n/a through 1.1.0.
published:2025-02-14T13:15:45.900


Instruction: Please provide detailed information about CVE-2025-23742

CVE:CVE-2025-23742
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Podamibe Nepal Podamibe Twilio Private Call allows Reflected XSS. This issue affects Podamibe Twilio Private Call: from n/a through 1.0.1.
published:2025-02-14T13:15:46.033


Instruction: Please provide detailed information about CVE-2025-23748

CVE:CVE-2025-23748
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound Singsys -Awesome Gallery allows Reflected XSS. This issue affects Singsys -Awesome Gallery: from n/a through 1.0.
published:2025-02-14T13:15:46.177


Instruction: Please provide detailed information about CVE-2025-23750

CVE:CVE-2025-23750
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in devbunchuk Custom Widget Creator allows Reflected XSS. This issue affects Custom Widget Creator: from n/a through 1.0.5.
published:2025-02-14T13:15:46.313


Instruction: Please provide detailed information about CVE-2025-23751

CVE:CVE-2025-23751
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Think201 Data Dash allows Reflected XSS. This issue affects Data Dash: from n/a through 1.2.3.
published:2025-02-14T13:15:46.450


Instruction: Please provide detailed information about CVE-2025-23766

CVE:CVE-2025-23766
Description:Missing Authorization vulnerability in ashamil OPSI Israel Domestic Shipments allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects OPSI Israel Domestic Shipments: from n/a through 2.6.6.
published:2025-02-14T13:15:46.583


Instruction: Please provide detailed information about CVE-2025-23771

CVE:CVE-2025-23771
Description:Missing Authorization vulnerability in Murali Push Notification for Post and BuddyPress allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Push Notification for Post and BuddyPress: from n/a through 2.11.
published:2025-02-14T13:15:46.727


Instruction: Please provide detailed information about CVE-2025-23786

CVE:CVE-2025-23786
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DuoGeek Email to Download allows Reflected XSS. This issue affects Email to Download: from n/a through 3.1.0.
published:2025-02-14T13:15:46.860


Instruction: Please provide detailed information about CVE-2025-23787

CVE:CVE-2025-23787
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound Easy Bet allows Reflected XSS. This issue affects Easy Bet: from n/a through 1.0.7.
published:2025-02-14T13:15:47.003


Instruction: Please provide detailed information about CVE-2025-23788

CVE:CVE-2025-23788
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound Easy Filter allows Reflected XSS. This issue affects Easy Filter: from n/a through 1.10.
published:2025-02-14T13:15:47.143


Instruction: Please provide detailed information about CVE-2025-23789

CVE:CVE-2025-23789
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tahminajannat URL Shortener | Conversion Tracking  | AB Testing  | WooCommerce allows Reflected XSS. This issue affects URL Shortener | Conversion Tracking  | AB Testing  | WooCommerce: from n/a through 9.0.2.
published:2025-02-14T13:15:47.280


Instruction: Please provide detailed information about CVE-2025-23790

CVE:CVE-2025-23790
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wassereimer Easy Code Placement allows Reflected XSS. This issue affects Easy Code Placement: from n/a through 18.11.
published:2025-02-14T13:15:47.417


Instruction: Please provide detailed information about CVE-2025-23851

CVE:CVE-2025-23851
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound Coronavirus (COVID-19) Outbreak Data Widgets allows Reflected XSS. This issue affects Coronavirus (COVID-19) Outbreak Data Widgets: from n/a through 1.1.1.
published:2025-02-14T13:15:47.550


Instruction: Please provide detailed information about CVE-2025-23853

CVE:CVE-2025-23853
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in michelem NoFollow Free allows Reflected XSS. This issue affects NoFollow Free: from n/a through 1.6.3.
published:2025-02-14T13:15:47.700


Instruction: Please provide detailed information about CVE-2025-23857

CVE:CVE-2025-23857
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound Essential WP Real Estate allows Reflected XSS. This issue affects Essential WP Real Estate: from n/a through 1.1.3.
published:2025-02-14T13:15:47.837


Instruction: Please provide detailed information about CVE-2025-23905

CVE:CVE-2025-23905
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Johannes van Poelgeest Admin Options Pages allows Reflected XSS. This issue affects Admin Options Pages: from n/a through 0.9.7.
published:2025-02-14T13:15:47.973


Instruction: Please provide detailed information about CVE-2025-24554

CVE:CVE-2025-24554
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in awcode AWcode Toolkit allows Reflected XSS. This issue affects AWcode Toolkit: from n/a through 1.0.14.
published:2025-02-14T13:15:48.113


Instruction: Please provide detailed information about CVE-2025-24558

CVE:CVE-2025-24558
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CRM Perks CRM Perks allows Reflected XSS. This issue affects CRM Perks: from n/a through 1.1.5.
published:2025-02-14T13:15:48.253


Instruction: Please provide detailed information about CVE-2025-24564

CVE:CVE-2025-24564
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in aviplugins.com Contact Form With Shortcode allows Reflected XSS. This issue affects Contact Form With Shortcode: from n/a through 4.2.5.
published:2025-02-14T13:15:48.393


Instruction: Please provide detailed information about CVE-2025-24565

CVE:CVE-2025-24565
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Saleswonder Team Tobias WP2LEADS allows Reflected XSS. This issue affects WP2LEADS: from n/a through 3.3.3.
published:2025-02-14T13:15:48.540


Instruction: Please provide detailed information about CVE-2025-24566

CVE:CVE-2025-24566
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tomáš Groulík Intro Tour Tutorial DeepPresentation allows Reflected XSS. This issue affects Intro Tour Tutorial DeepPresentation: from n/a through 6.5.2.
published:2025-02-14T13:15:48.663


Instruction: Please provide detailed information about CVE-2025-24567

CVE:CVE-2025-24567
Description:Insertion of Sensitive Information Into Sent Data vulnerability in brandtoss WP Mailster allows Retrieve Embedded Sensitive Data. This issue affects WP Mailster: from n/a through 1.8.16.0.
published:2025-02-14T13:15:48.800


Instruction: Please provide detailed information about CVE-2025-24592

CVE:CVE-2025-24592
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SysBasics Customize My Account for WooCommerce allows Reflected XSS. This issue affects Customize My Account for WooCommerce: from n/a through 2.8.22.
published:2025-02-14T13:15:48.940


Instruction: Please provide detailed information about CVE-2025-24607

CVE:CVE-2025-24607
Description:Missing Authorization vulnerability in Northern Beaches Websites IdeaPush allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects IdeaPush: from n/a through 8.71.
published:2025-02-14T13:15:49.083


Instruction: Please provide detailed information about CVE-2025-24614

CVE:CVE-2025-24614
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in agileLogix Post Timeline allows Reflected XSS. This issue affects Post Timeline: from n/a through 2.3.9.
published:2025-02-14T13:15:49.217


Instruction: Please provide detailed information about CVE-2025-24615

CVE:CVE-2025-24615
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in fatcatapps Analytics Cat allows Reflected XSS. This issue affects Analytics Cat: from n/a through 1.1.2.
published:2025-02-14T13:15:49.353


Instruction: Please provide detailed information about CVE-2025-24616

CVE:CVE-2025-24616
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in UIUX Lab Uix Page Builder allows Reflected XSS. This issue affects Uix Page Builder: from n/a through 1.7.3.
published:2025-02-14T13:15:49.490


Instruction: Please provide detailed information about CVE-2025-24617

CVE:CVE-2025-24617
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AcyMailing Newsletter Team AcyMailing SMTP Newsletter allows Reflected XSS. This issue affects AcyMailing SMTP Newsletter: from n/a through n/a.
published:2025-02-14T13:15:49.633


Instruction: Please provide detailed information about CVE-2025-24641

CVE:CVE-2025-24641
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in rickonline_nl Better WishList API allows Stored XSS. This issue affects Better WishList API: from n/a through 1.1.3.
published:2025-02-14T13:15:49.773


Instruction: Please provide detailed information about CVE-2025-24688

CVE:CVE-2025-24688
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in brandtoss WP Mailster allows Reflected XSS. This issue affects WP Mailster: from n/a through 1.8.20.0.
published:2025-02-14T13:15:49.910


Instruction: Please provide detailed information about CVE-2025-24692

CVE:CVE-2025-24692
Description:Missing Authorization vulnerability in Michael Revellin-Clerc Bulk Menu Edit allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Bulk Menu Edit: from n/a through 1.3.
published:2025-02-14T13:15:50.050


Instruction: Please provide detailed information about CVE-2025-24699

CVE:CVE-2025-24699
Description:Cross-Site Request Forgery (CSRF) vulnerability in Wow-Company WP Coder allows Cross-Site Scripting (XSS). This issue affects WP Coder: from n/a through 3.6.
published:2025-02-14T13:15:50.193


Instruction: Please provide detailed information about CVE-2025-24700

CVE:CVE-2025-24700
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Xylus Themes WP Event Aggregator allows Reflected XSS. This issue affects WP Event Aggregator: from n/a through 1.8.2.
published:2025-02-14T13:15:50.330


Instruction: Please provide detailed information about CVE-2025-0178

CVE:CVE-2025-0178
Description:Improper Input Validation vulnerability in WatchGuard Fireware OS allows an attacker to manipulate the value of the HTTP Host header in requests sent to the Web UI. An attacker could exploit this vulnerability to redirect users to malicious websites, poison the web cache, or inject malicious JavaScript into responses sent by the Web UI. This issue affects Fireware OS: from 12.0 up to and including 12.11.
published:2025-02-14T14:15:32.403


Instruction: Please provide detailed information about CVE-2025-1071

CVE:CVE-2025-1071
Description:Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS allows Stored XSS via the spamBlocker module. This vulnerability requires an authenticated administrator session to a locally managed Firebox.This issue affects Fireware OS: from 12.0 through 12.5.12+701324, from 12.6 through 12.11.
published:2025-02-14T14:15:32.560


Instruction: Please provide detailed information about CVE-2025-1239

CVE:CVE-2025-1239
Description:Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS allows Stored XSS via the Blocked Sites list. This vulnerability requires an authenticated administrator session to a locally managed Firebox.This issue affects Fireware OS: from 12.0 through 12.5.12+701324, from 12.6 through 12.11.
published:2025-02-14T14:15:32.687


Instruction: Please provide detailed information about CVE-2025-25740

CVE:CVE-2025-25740
Description:D-Link DIR-853 A1 FW1.20B07 was discovered to contain a stack-based buffer overflow vulnerability via the PSK parameter in the SetQuickVPNSettings module.
published:2025-02-14T15:15:13.190


Instruction: Please provide detailed information about CVE-2025-25745

CVE:CVE-2025-25745
Description:D-Link DIR-853 A1 FW1.20B07 was discovered to contain a stack-based buffer overflow vulnerability via the Password parameter in the SetQuickVPNSettings module.
published:2025-02-14T16:15:37.010


Instruction: Please provide detailed information about CVE-2025-25204

CVE:CVE-2025-25204
Description:`gh` is GitHub’s official command line tool. Starting in version 2.49.0 and prior to version 2.67.0, under certain conditions, a bug in GitHub's Artifact Attestation cli tool `gh attestation verify` causes it to return a zero exit status when no attestations are present. This behavior is incorrect: When no attestations are present, `gh attestation verify` should return a non-zero exit status code, thereby signaling verification failure. An attacker can abuse this flaw to, for example, deploy malicious artifacts in any system that uses `gh attestation verify`'s exit codes to gatekeep deployments. Users are advised to update `gh` to patched version `v2.67.0` as soon as possible.
published:2025-02-14T17:15:19.140


Instruction: Please provide detailed information about CVE-2025-25206

CVE:CVE-2025-25206
Description:eLabFTW is an open source electronic lab notebook for research labs. Prior to version 5.1.15, an incorrect input validation could allow an authenticated user to read sensitive information, including login token or other content stored in the database. This could lead to privilege escalation if cookies are enabled (default setting). Users must upgrade to eLabFTW version 5.1.15 to receive a fix. No known workarounds are available.
published:2025-02-14T17:15:19.327


Instruction: Please provide detailed information about CVE-2025-25295

CVE:CVE-2025-25295
Description:Label Studio is an open source data labeling tool. A path traversal vulnerability in Label Studio SDK versions prior to 1.0.10 allows unauthorized file access outside the intended directory structure. The flaw exists in the VOC, COCO and YOLO export functionalities. These functions invoke a `download` function on the `label-studio-sdk` python package, which fails to validate file paths when processing image references during task exports. By creating tasks with path traversal sequences in the image field, an attacker can force the application to read files from arbitrary server filesystem locations when exporting projects in any of the mentioned formats. This is authentication-required vulnerability allowing arbitrary file reads from the server filesystem. It may lead to potential exposure of sensitive information like configuration files, credentials, and confidential data. Label Studio versions before 1.16.0 specified SDK versions prior to 1.0.10 as dependencies, and the issue was confirmed in Label Studio version 1.13.2.dev0; therefore, Label Studio users should upgrade to 1.16.0 or newer to mitigate it.
published:2025-02-14T17:15:20.230


Instruction: Please provide detailed information about CVE-2025-25988

CVE:CVE-2025-25988
Description:Cross Site Scripting vulnerability in hooskcms v.1.8 allows a remote attacker to cause a denial of service via the custom Link title parameter and the Title parameter.
published:2025-02-14T17:15:21.157


Instruction: Please provide detailed information about CVE-2025-25990

CVE:CVE-2025-25990
Description:Cross Site Scripting vulnerability in hooskcms v.1.7.1 allows a remote attacker to obtain sensitive information via the /install/index.php component.
published:2025-02-14T17:15:21.320


Instruction: Please provide detailed information about CVE-2025-25991

CVE:CVE-2025-25991
Description:SQL Injection vulnerability in hooskcms v.1.7.1 allows a remote attacker to obtain sensitive information via the /install/index.php component.
published:2025-02-14T17:15:21.477


Instruction: Please provide detailed information about CVE-2025-25992

CVE:CVE-2025-25992
Description:SQL Injection vulnerability in FeMiner wms 1.0 allows a remote attacker to obtain sensitive information via the inquire_inout_item.php component.
published:2025-02-14T17:15:21.640


Instruction: Please provide detailed information about CVE-2025-25993

CVE:CVE-2025-25993
Description:SQL Injection vulnerability in FeMiner wms wms 1.0 allows a remote attacker to obtain sensitive information via the parameter "itemid."
published:2025-02-14T17:15:21.793


Instruction: Please provide detailed information about CVE-2025-25994

CVE:CVE-2025-25994
Description:SQL Injection vulnerability in FeMiner wms wms 1.0 allows a remote attacker to obtain sensitive information via the parameters date1, date2, id.
published:2025-02-14T17:15:21.953


Instruction: Please provide detailed information about CVE-2025-25997

CVE:CVE-2025-25997
Description:Directory Traversal vulnerability in FeMiner wms v.1.0 allows a remote attacker to obtain sensitive information via the databak.php component.
published:2025-02-14T17:15:22.117


Instruction: Please provide detailed information about CVE-2025-26156

CVE:CVE-2025-26156
Description:A SQL Injection vulnerability was found in /shopping/track-orders.php in PHPGurukul Online Shopping Portal v2.1, which allows remote attackers to execute arbitrary code via orderid POST request parameter.
published:2025-02-14T17:15:22.273


Instruction: Please provide detailed information about CVE-2025-26157

CVE:CVE-2025-26157
Description:A SQL Injection vulnerability was found in /bpms/index.php in Source Code and Project Beauty Parlour Management System V1.1, which allows remote attackers to execute arbitrary code via the name POST request parameter.
published:2025-02-14T17:15:22.437


Instruction: Please provide detailed information about CVE-2025-26158

CVE:CVE-2025-26158
Description:A Stored Cross-Site Scripting (XSS) vulnerability was discovered in the manage-employee.php page of Kashipara Online Attendance Management System V1.0. This vulnerability allows remote attackers to execute arbitrary scripts via the department parameter.
published:2025-02-14T17:15:22.590


Instruction: Please provide detailed information about CVE-2025-26506

CVE:CVE-2025-26506
Description:Certain HP LaserJet Pro, HP LaserJet Enterprise, and HP LaserJet Managed Printers may potentially be vulnerable to Remote Code Execution and Elevation of Privilege when processing a PostScript print job.
published:2025-02-14T17:15:22.747


Instruction: Please provide detailed information about CVE-2025-26507

CVE:CVE-2025-26507
Description:Certain HP LaserJet Pro, HP LaserJet Enterprise, and HP LaserJet Managed Printers may potentially be vulnerable to Remote Code Execution and Elevation of Privilege when processing a PostScript print job.
published:2025-02-14T17:15:22.863


Instruction: Please provide detailed information about CVE-2025-26508

CVE:CVE-2025-26508
Description:Certain HP LaserJet Pro, HP LaserJet Enterprise, and HP LaserJet Managed Printers may potentially be vulnerable to Remote Code Execution and Elevation of Privilege when processing a PostScript print job.
published:2025-02-14T17:15:22.983


Instruction: Please provide detailed information about CVE-2025-0503

CVE:CVE-2025-0503
Description:Mattermost versions 9.11.x <= 9.11.6 fail to filter out DMs from the deleted channels endpoint which allows an attacker to infer user IDs and other metadata from deleted DMs if someone had manually marked DMs as deleted in the database.
published:2025-02-14T18:15:23.870


Instruction: Please provide detailed information about CVE-2025-25285

CVE:CVE-2025-25285
Description:@octokit/endpoint turns REST API endpoints into generic request options. Starting in version 4.1.0 and prior to version 10.1.3, by crafting specific `options` parameters, the `endpoint.parse(options)` call can be triggered, leading to a regular expression denial-of-service (ReDoS) attack. This causes the program to hang and results in high CPU utilization. The issue occurs in the `parse` function within the `parse.ts` file of the npm package `@octokit/endpoint`. Version 10.1.3 contains a patch for the issue.
published:2025-02-14T20:15:34.487


Instruction: Please provide detailed information about CVE-2025-25288

CVE:CVE-2025-25288
Description:@octokit/plugin-paginate-rest is the Octokit plugin to paginate REST API endpoint responses. For versions starting in 1.0.0 and prior to 11.4.1 of the npm package `@octokit/plugin-paginate-rest`, when calling `octokit.paginate.iterator()`, a specially crafted `octokit` instance—particularly with a malicious `link` parameter in the `headers` section of the `request`—can trigger a ReDoS attack. Version 11.4.1 contains a fix for the issue.
published:2025-02-14T20:15:34.737


Instruction: Please provide detailed information about CVE-2025-25289

CVE:CVE-2025-25289
Description:@octokit/request-error is an error class for Octokit request errors. Starting in version 1.0.0 and prior to version 6.1.7, a Regular Expression Denial of Service (ReDoS) vulnerability exists in the processing of HTTP request headers. By sending an authorization header containing an excessively long sequence of spaces followed by a newline and "@", an attacker can exploit inefficient regular expression processing, leading to excessive resource consumption. This can significantly degrade server performance or cause a denial-of-service (DoS) condition, impacting availability. Version 6.1.7 contains a fix for the issue.
published:2025-02-14T20:15:35.100


Instruction: Please provide detailed information about CVE-2025-25290

CVE:CVE-2025-25290
Description:@octokit/request sends parameterized requests to GitHub’s APIs with sensible defaults in browsers and Node. Starting in version 1.0.0 and prior to version 9.2.1, the regular expression `/<([^>]+)>; rel="deprecation"/` used to match the `link` header in HTTP responses is vulnerable to a ReDoS (Regular Expression Denial of Service) attack. This vulnerability arises due to the unbounded nature of the regex's matching behavior, which can lead to catastrophic backtracking when processing specially crafted input. An attacker could exploit this flaw by sending a malicious `link` header, resulting in excessive CPU usage and potentially causing the server to become unresponsive, impacting service availability. Version 9.2.1 fixes the issue.
published:2025-02-14T20:15:35.593


Instruction: Please provide detailed information about CVE-2025-25296

CVE:CVE-2025-25296
Description:Label Studio is an open source data labeling tool. Prior to version 1.16.0, Label Studio's `/projects/upload-example` endpoint allows injection of arbitrary HTML through a `GET` request with an appropriately crafted `label_config` query parameter. By crafting a specially formatted XML label config with inline task data containing malicious HTML/JavaScript, an attacker can achieve Cross-Site Scripting (XSS). While the application has a Content Security Policy (CSP), it is only set in report-only mode, making it ineffective at preventing script execution. The vulnerability exists because the upload-example endpoint renders user-provided HTML content without proper sanitization on a GET request. This allows attackers to inject and execute arbitrary JavaScript in victims' browsers by getting them to visit a maliciously crafted URL. This is considered vulnerable because it enables attackers to execute JavaScript in victims' contexts, potentially allowing theft of sensitive data, session hijacking, or other malicious actions. Version 1.16.0 contains a patch for the issue.
published:2025-02-14T20:15:36.103


Instruction: Please provide detailed information about CVE-2025-25297

CVE:CVE-2025-25297
Description:Label Studio is an open source data labeling tool. Prior to version 1.16.0, Label Studio's S3 storage integration feature contains a Server-Side Request Forgery (SSRF) vulnerability in its endpoint configuration. When creating an S3 storage connection, the application allows users to specify a custom S3 endpoint URL via the s3_endpoint parameter. This endpoint URL is passed directly to the boto3 AWS SDK without proper validation or restrictions on the protocol or destination. The vulnerability allows an attacker to make the application send HTTP requests to arbitrary internal services by specifying them as the S3 endpoint. When the storage sync operation is triggered, the application attempts to make S3 API calls to the specified endpoint, effectively making HTTP requests to the target service and returning the response in error messages. This SSRF vulnerability enables attackers to bypass network segmentation and access internal services that should not be accessible from the external network. The vulnerability is particularly severe because error messages from failed requests contain the full response body, allowing data exfiltration from internal services. Version 1.16.0 contains a patch for the issue.
published:2025-02-14T20:15:36.627


Instruction: Please provide detailed information about CVE-2025-25304

CVE:CVE-2025-25304
Description:Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs. Prior to version 5.26.0 of vega and 5.4.2 of vega-selections, the `vlSelectionTuples` function can be used to call JavaScript functions, leading to cross-site scripting.`vlSelectionTuples` calls multiple functions that can be controlled by an attacker, including one call with an attacker-controlled argument. This can be used to call `Function()` with arbitrary JavaScript and the resulting function can be called with `vlSelectionTuples` or using a type coercion to call `toString` or `valueOf`. Version 5.26.0 of vega and 5.4.2 of vega-selections fix this issue.
published:2025-02-14T20:15:36.903


Instruction: Please provide detailed information about CVE-2025-0592

CVE:CVE-2025-0592
Description:The vulnerability may allow a remote low priviledged attacker to run arbitrary shell commands by manipulating the firmware file and uploading it to the device.
published:2025-02-14T21:15:16.543


Instruction: Please provide detailed information about CVE-2025-0593

CVE:CVE-2025-0593
Description:The vulnerability may allow a remote low priviledged attacker to run arbitrary shell commands by using lower-level functions to interact with the device.
published:2025-02-14T21:15:16.680


Instruction: Please provide detailed information about CVE-2025-21401

CVE:CVE-2025-21401
Description:Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability
published:2025-02-15T00:15:27.163


Instruction: Please provide detailed information about CVE-2025-26819

CVE:CVE-2025-26819
Description:Monero through 0.18.3.4 before ec74ff4 does not have response limits on HTTP server connections.
published:2025-02-15T00:15:28.510


Instruction: Please provide detailed information about CVE-2025-0995

CVE:CVE-2025-0995
Description:Use after free in V8 in Google Chrome prior to 133.0.6943.98 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
published:2025-02-15T02:15:09.127


Instruction: Please provide detailed information about CVE-2025-0996

CVE:CVE-2025-0996
Description:Inappropriate implementation in Browser UI in Google Chrome on Android prior to 133.0.6943.98 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (Chromium security severity: High)
published:2025-02-15T02:15:09.260


Instruction: Please provide detailed information about CVE-2025-0997

CVE:CVE-2025-0997
Description:Use after free in Navigation in Google Chrome prior to 133.0.6943.98 allowed a remote attacker to potentially exploit heap corruption via a crafted Chrome Extension. (Chromium security severity: High)
published:2025-02-15T02:15:09.377


Instruction: Please provide detailed information about CVE-2025-0998

CVE:CVE-2025-0998
Description:Rejected reason: Not exploitable
published:2025-02-15T02:15:09.483


Instruction: Please provide detailed information about CVE-2025-1302

CVE:CVE-2025-1302
Description:Versions of the package jsonpath-plus before 10.3.0 are vulnerable to Remote Code Execution (RCE) due to improper input sanitization. An attacker can execute aribitrary code on the system by exploiting the unsafe default usage of eval='safe' mode.

**Note:**

This is caused by an incomplete fix for [CVE-2024-21534](https://security.snyk.io/vuln/SNYK-JS-JSONPATHPLUS-7945884).
published:2025-02-15T05:15:11.683


Instruction: Please provide detailed information about CVE-2025-0935

CVE:CVE-2025-0935
Description:The Media Library Folders plugin for WordPress is vulnerable to unauthorized plugin settings change due to a missing capability check on several AJAX actions in all versions up to, and including, 8.3.0. This makes it possible for authenticated attackers, with Author-level access and above, to change plugin settings related to things such as IP-blocking.
published:2025-02-15T09:15:10.583


Instruction: Please provide detailed information about CVE-2025-22208

CVE:CVE-2025-22208
Description:A SQL injection vulnerability in the JS Jobs plugin versions 1.1.5-1.4.3 for Joomla allows authenticated attackers (administrator) to execute arbitrary SQL commands via the 'filter_email' parameter in the GDPR Erase Data Request search feature.
published:2025-02-15T09:15:11.043


Instruction: Please provide detailed information about CVE-2025-22209

CVE:CVE-2025-22209
Description:A SQL injection vulnerability in the JS Jobs plugin versions 1.1.5-1.4.3 for Joomla allows authenticated attackers (administrator) to execute arbitrary SQL commands via the 'searchpaymentstatus' parameter in the Employer Payment History search feature.
published:2025-02-15T09:15:11.237


Instruction: Please provide detailed information about CVE-2025-1005

CVE:CVE-2025-1005
Description:The ElementsKit Elementor addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Image Accordion widget in all versions up to, and including, 3.4.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
published:2025-02-15T10:15:08.740


Instruction: Please provide detailed information about CVE-2025-0822

CVE:CVE-2025-0822
Description:Bit Assist plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.5.2 via the fileID Parameter. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.
published:2025-02-15T13:15:28.847


Instruction: Please provide detailed information about CVE-2025-26793

CVE:CVE-2025-26793
Description:The Web GUI configuration panel of Hirsch (formerly Identiv and Viscount) Enterphone MESH through 2024 ships with default credentials (username freedom, password viscount). The administrator is not prompted to change these credentials on initial configuration, and changing the credentials requires many steps. Attackers can use the credentials over the Internet via mesh.webadmin.MESHAdminServlet to gain access to dozens of Canadian and U.S. apartment buildings and obtain building residents' PII. NOTE: the Supplier's perspective is that the "vulnerable systems are not following manufacturers' recommendations to change the default password."
published:2025-02-15T15:15:23.587


Instruction: Please provide detailed information about CVE-2025-1332

CVE:CVE-2025-1332
Description:A vulnerability has been found in FastCMS up to 0.1.5 and classified as problematic. This vulnerability affects unknown code of the file /fastcms.html#/template/menu of the component Template Menu. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available.
published:2025-02-16T01:15:20.440


Instruction: Please provide detailed information about CVE-2025-1335

CVE:CVE-2025-1335
Description:A vulnerability, which was classified as problematic, was found in CmsEasy 7.7.7.9. Affected is the function deleteimg_action in the library lib/admin/file_admin.php. The manipulation of the argument imgname leads to path traversal. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-02-16T04:15:23.230


Instruction: Please provide detailed information about CVE-2025-1336

CVE:CVE-2025-1336
Description:A vulnerability has been found in CmsEasy 7.7.7.9 and classified as problematic. Affected by this vulnerability is the function deleteimg_action in the library lib/admin/image_admin.php. The manipulation of the argument imgname leads to path traversal. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-02-16T09:15:09.347


Instruction: Please provide detailed information about CVE-2025-1337

CVE:CVE-2025-1337
Description:A vulnerability was found in Eastnets PaymentSafe 2.5.26.0. It has been classified as problematic. This affects an unknown part of the component BIC Search. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. Upgrading to version 2.5.27.0 is able to address this issue.
published:2025-02-16T11:15:08.203


Instruction: Please provide detailed information about CVE-2025-1338

CVE:CVE-2025-1338
Description:A vulnerability was found in NUUO Camera up to 20250203. It has been declared as critical. This vulnerability affects the function print_file of the file /handle_config.php. The manipulation of the argument log leads to command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-02-16T11:15:09.530


Instruction: Please provide detailed information about CVE-2025-1339

CVE:CVE-2025-1339
Description:A vulnerability was found in TOTOLINK X18 9.1.0cu.2024_B20220329. It has been rated as critical. This issue affects the function setL2tpdConfig of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument enable leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-02-16T12:15:08.173


Instruction: Please provide detailed information about CVE-2025-1340

CVE:CVE-2025-1340
Description:A vulnerability classified as critical has been found in TOTOLINK X18 9.1.0cu.2024_B20220329. Affected is the function setPasswordCfg of the file /cgi-bin/cstecgi.cgi. The manipulation as part of String leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-02-16T14:15:21.130


Instruction: Please provide detailed information about CVE-2025-1341

CVE:CVE-2025-1341
Description:A vulnerability, which was classified as problematic, was found in PMWeb 7.2.0. This affects an unknown part of the component Setting Handler. The manipulation leads to weak password requirements. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. It is recommended to change the configuration settings. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-02-16T14:15:21.893


Instruction: Please provide detailed information about CVE-2025-1352

CVE:CVE-2025-1352
Description:A vulnerability has been found in GNU elfutils 0.192 and classified as critical. This vulnerability affects the function __libdw_thread_tail in the library libdw_alloc.c of the component eu-readelf. The manipulation of the argument w leads to memory corruption. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The name of the patch is 2636426a091bd6c6f7f02e49ab20d4cdc6bfc753. It is recommended to apply a patch to fix this issue.
published:2025-02-16T15:15:09.133


Instruction: Please provide detailed information about CVE-2025-1353

CVE:CVE-2025-1353
Description:A vulnerability was found in Kong Insomnia up to 10.3.0 and classified as critical. This issue affects some unknown processing in the library profapi.dll. The manipulation leads to untrusted search path. An attack has to be approached locally. The complexity of an attack is rather high. The exploitation is known to be difficult. The real existence of this vulnerability is still doubted at the moment. The vendor is not able to reproduce the issue.
published:2025-02-16T15:15:09.320


Instruction: Please provide detailed information about CVE-2025-1354

CVE:CVE-2025-1354
Description:A cross-site scripting (XSS)  vulnerability in the RT-N10E/ RT-N12E 2.0.0.x firmware . This vulnerability caused by improper input validation and can be triggered via the manipulation of the SSID argument in the sysinfo.asp file, leading to disclosure of sensitive information. Note: All versions of RT-N10E and RT-N12E are unsupported (End-of-Life, EOL). Consumers can mitigate this vulnerability by disabling the remote access features from WAN
published:2025-02-16T16:15:19.253


Instruction: Please provide detailed information about CVE-2025-1355

CVE:CVE-2025-1355
Description:A vulnerability was found in needyamin Library Card System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /signup.php of the component Add Picture. The manipulation leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-02-16T17:15:07.973


Instruction: Please provide detailed information about CVE-2025-1356

CVE:CVE-2025-1356
Description:A vulnerability was found in needyamin Library Card System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file card.php. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-02-16T18:15:07.383


Instruction: Please provide detailed information about CVE-2025-1357

CVE:CVE-2025-1357
Description:A vulnerability classified as problematic has been found in Seventh D-Guard up to 20250206. This affects an unknown part of the component HTTP GET Request Handler. The manipulation leads to path traversal. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-02-16T19:15:09.500


Instruction: Please provide detailed information about CVE-2025-1358

CVE:CVE-2025-1358
Description:A vulnerability classified as problematic was found in Pix Software Vivaz 6.0.10. This vulnerability affects unknown code. The manipulation leads to cross-site request forgery. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-02-16T20:15:07.990


Instruction: Please provide detailed information about CVE-2025-1359

CVE:CVE-2025-1359
Description:A vulnerability, which was classified as problematic, has been found in SIAM Industria de Automação e Monitoramento SIAM 2.0. This issue affects some unknown processing of the file /qrcode.jsp. The manipulation of the argument url leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-02-16T20:15:08.817


Instruction: Please provide detailed information about CVE-2025-1360

CVE:CVE-2025-1360
Description:A vulnerability, which was classified as problematic, was found in Internet Web Solutions Sublime CRM up to 20250207. Affected is an unknown function of the file /crm/inicio.php of the component HTTP POST Request Handler. The manipulation of the argument msg_to leads to cross site scripting. It is possible to launch the attack remotely. Other parameters might be affected as well. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-02-16T21:15:09.970


Instruction: Please provide detailed information about CVE-2025-1364

CVE:CVE-2025-1364
Description:A vulnerability has been found in MicroWord eScan Antivirus 7.0.32 on Linux and classified as critical. Affected by this vulnerability is the function passPrompt of the component USB Protection Service. The manipulation leads to stack-based buffer overflow. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-02-16T23:15:09.087


Instruction: Please provide detailed information about CVE-2025-22284

CVE:CVE-2025-22284
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in enituretechnology LTL Freight Quotes – Unishippers Edition allows Reflected XSS. This issue affects LTL Freight Quotes – Unishippers Edition: from n/a through 2.5.8.
published:2025-02-16T23:15:09.280


Instruction: Please provide detailed information about CVE-2025-22286

CVE:CVE-2025-22286
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in enituretechnology LTL Freight Quotes – Worldwide Express Edition allows Reflected XSS. This issue affects LTL Freight Quotes – Worldwide Express Edition: from n/a through 5.0.21.
published:2025-02-16T23:15:09.427


Instruction: Please provide detailed information about CVE-2025-22289

CVE:CVE-2025-22289
Description:Missing Authorization vulnerability in NotFound LTL Freight Quotes – Unishippers Edition allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects LTL Freight Quotes – Unishippers Edition: from n/a through 2.5.8.
published:2025-02-16T23:15:09.567


Instruction: Please provide detailed information about CVE-2025-22290

CVE:CVE-2025-22290
Description:Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in enituretechnology LTL Freight Quotes – FreightQuote Edition allows SQL Injection. This issue affects LTL Freight Quotes – FreightQuote Edition: from n/a through 2.3.11.
published:2025-02-16T23:15:09.713


Instruction: Please provide detailed information about CVE-2025-22291

CVE:CVE-2025-22291
Description:Missing Authorization vulnerability in enituretechnology LTL Freight Quotes – Worldwide Express Edition allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects LTL Freight Quotes – Worldwide Express Edition: from n/a through 5.0.20.
published:2025-02-16T23:15:09.877


Instruction: Please provide detailed information about CVE-2025-22676

CVE:CVE-2025-22676
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in upcasted AWS S3 for WordPress Plugin – Upcasted allows Stored XSS. This issue affects AWS S3 for WordPress Plugin – Upcasted: from n/a through 3.0.3.
published:2025-02-16T23:15:10.037


Instruction: Please provide detailed information about CVE-2025-22680

CVE:CVE-2025-22680
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound Ad Inserter Pro allows Reflected XSS. This issue affects Ad Inserter Pro: from n/a through 2.7.39.
published:2025-02-16T23:15:10.183


Instruction: Please provide detailed information about CVE-2025-22689

CVE:CVE-2025-22689
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Levan Tarbor Forex Calculators allows Stored XSS. This issue affects Forex Calculators: from n/a through 1.3.6.
published:2025-02-16T23:15:10.330


Instruction: Please provide detailed information about CVE-2025-23975

CVE:CVE-2025-23975
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound Botnet Attack Blocker allows Stored XSS. This issue affects Botnet Attack Blocker: from n/a through 2.0.0.
published:2025-02-16T23:15:10.477


Instruction: Please provide detailed information about CVE-2025-26755

CVE:CVE-2025-26755
Description:Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in jgwhite33 WP Airbnb Review Slider allows Blind SQL Injection. This issue affects WP Airbnb Review Slider: from n/a through 3.9.
published:2025-02-16T23:15:10.627


Instruction: Please provide detailed information about CVE-2025-26759

CVE:CVE-2025-26759
Description:Cross-Site Request Forgery (CSRF) vulnerability in alexvtn Content Snippet Manager allows Stored XSS. This issue affects Content Snippet Manager: from n/a through 1.1.5.
published:2025-02-16T23:15:10.777


Instruction: Please provide detailed information about CVE-2025-26761

CVE:CVE-2025-26761
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HashThemes Easy Elementor Addons allows DOM-Based XSS. This issue affects Easy Elementor Addons: from n/a through 2.1.5.
published:2025-02-16T23:15:10.920


Instruction: Please provide detailed information about CVE-2025-26765

CVE:CVE-2025-26765
Description:Missing Authorization vulnerability in enituretechnology Distance Based Shipping Calculator allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Distance Based Shipping Calculator: from n/a through 2.0.22.
published:2025-02-16T23:15:11.063


Instruction: Please provide detailed information about CVE-2025-26766

CVE:CVE-2025-26766
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VaultDweller Leyka allows Stored XSS. This issue affects Leyka: from n/a through 3.31.8.
published:2025-02-16T23:15:11.207


Instruction: Please provide detailed information about CVE-2025-26767

CVE:CVE-2025-26767
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeum Qubely – Advanced Gutenberg Blocks allows Stored XSS. This issue affects Qubely – Advanced Gutenberg Blocks: from n/a through 1.8.12.
published:2025-02-16T23:15:11.350


Instruction: Please provide detailed information about CVE-2025-26768

CVE:CVE-2025-26768
Description:Cross-Site Request Forgery (CSRF) vulnerability in what3words what3words Address Field allows Stored XSS. This issue affects what3words Address Field: from n/a through 4.0.15.
published:2025-02-16T23:15:11.487


Instruction: Please provide detailed information about CVE-2025-26779

CVE:CVE-2025-26779
Description:Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Fahad Mahmood Keep Backup Daily allows Path Traversal. This issue affects Keep Backup Daily: from n/a through 2.1.0.
published:2025-02-16T23:15:11.630


Instruction: Please provide detailed information about CVE-2025-0591

CVE:CVE-2025-0591
Description:Out-of-bounds Read vulnerability (CWE-125) was found in CX-Programmer. Attackers may be able to read sensitive information or cause an application crash by abusing this vulnerability.
published:2025-02-17T00:15:08.987


Instruction: Please provide detailed information about CVE-2025-1365

CVE:CVE-2025-1365
Description:A vulnerability, which was classified as critical, was found in GNU elfutils 0.192. This affects the function process_symtab of the file readelf.c of the component eu-readelf. The manipulation of the argument D/a leads to buffer overflow. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The identifier of the patch is 5e5c0394d82c53e97750fe7b18023e6f84157b81. It is recommended to apply a patch to fix this issue.
published:2025-02-17T00:15:09.140


Instruction: Please provide detailed information about CVE-2025-1366

CVE:CVE-2025-1366
Description:A vulnerability was found in MicroWord eScan Antivirus 7.0.32 on Linux and classified as critical. Affected by this issue is the function strcpy of the component VirusPopUp. The manipulation leads to stack-based buffer overflow. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-02-17T01:15:10.280


Instruction: Please provide detailed information about CVE-2025-1367

CVE:CVE-2025-1367
Description:A vulnerability was found in MicroWord eScan Antivirus 7.0.32 on Linux. It has been classified as critical. This affects the function sprintf of the component USB Password Handler. The manipulation leads to buffer overflow. An attack has to be approached locally. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-02-17T01:15:11.090


Instruction: Please provide detailed information about CVE-2025-1368

CVE:CVE-2025-1368
Description:A vulnerability was found in MicroWord eScan Antivirus 7.0.32 on Linux. It has been declared as problematic. This vulnerability affects the function ReadConfiguration of the file /opt/MicroWorld/etc/mwav.conf. The manipulation of the argument BasePath leads to buffer overflow. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-02-17T02:15:08.643


Instruction: Please provide detailed information about CVE-2025-1369

CVE:CVE-2025-1369
Description:A vulnerability classified as critical was found in MicroWord eScan Antivirus 7.0.32 on Linux. Affected by this vulnerability is an unknown functionality of the component USB Password Handler. The manipulation leads to os command injection. The attack needs to be approached locally. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-02-17T02:15:08.830


Instruction: Please provide detailed information about CVE-2025-1370

CVE:CVE-2025-1370
Description:A vulnerability, which was classified as critical, has been found in MicroWorld eScan Antivirus 7.0.32 on Linux. Affected by this issue is the function sprintf of the file epsdaemon of the component Autoscan USB. The manipulation leads to os command injection. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-02-17T03:15:09.223


Instruction: Please provide detailed information about CVE-2025-1371

CVE:CVE-2025-1371
Description:A vulnerability has been found in GNU elfutils 0.192 and classified as problematic. This vulnerability affects the function handle_dynamic_symtab of the file readelf.c of the component eu-read. The manipulation leads to null pointer dereference. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. The patch is identified as b38e562a4c907e08171c76b8b2def8464d5a104a. It is recommended to apply a patch to fix this issue.
published:2025-02-17T03:15:09.400


Instruction: Please provide detailed information about CVE-2025-1372

CVE:CVE-2025-1372
Description:A vulnerability was found in GNU elfutils 0.192. It has been declared as critical. Affected by this vulnerability is the function dump_data_section/print_string_section of the file readelf.c of the component eu-readelf. The manipulation of the argument z/x leads to buffer overflow. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The identifier of the patch is 73db9d2021cab9e23fd734b0a76a612d52a6f1db. It is recommended to apply a patch to fix this issue.
published:2025-02-17T03:15:09.573


Instruction: Please provide detailed information about CVE-2025-26700

CVE:CVE-2025-26700
Description:Authentication bypass using an alternate path or channel issue exists in ”RoboForm Password Manager" App for Android versions prior to 9.7.4, which may allow an attacker with access to a device where the application is installed to bypass the lock screen and obtain sensitive information.
published:2025-02-17T03:15:09.750


Instruction: Please provide detailed information about CVE-2025-1373

CVE:CVE-2025-1373
Description:A vulnerability was found in FFmpeg up to 7.1. It has been rated as problematic. Affected by this issue is the function mov_read_trak of the file libavformat/mov.c of the component MOV Parser. The manipulation leads to null pointer dereference. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The patch is identified as 43be8d07281caca2e88bfd8ee2333633e1fb1a13. It is recommended to apply a patch to fix this issue.
published:2025-02-17T04:15:08.447


Instruction: Please provide detailed information about CVE-2025-1374

CVE:CVE-2025-1374
Description:A vulnerability classified as critical has been found in code-projects Real Estate Property Management System 1.0. This affects an unknown part of the file /search.php. The manipulation of the argument StateName/CityName/AreaName/CatId leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
published:2025-02-17T04:15:08.643


Instruction: Please provide detailed information about CVE-2025-1387

CVE:CVE-2025-1387
Description:Orca HCM from LEARNING DIGITAL has an Improper Authentication vulnerability, allowing unauthenticated remote attackers to log in to the system as any user.
published:2025-02-17T04:15:08.807


Instruction: Please provide detailed information about CVE-2025-1388

CVE:CVE-2025-1388
Description:Orca HCM from LEARNING DIGITAL has an Arbitrary File Upload vulnerability, allowing remote attackers with regular privileges to upload and run web shells
published:2025-02-17T04:15:08.960


Instruction: Please provide detailed information about CVE-2025-0924

CVE:CVE-2025-0924
Description:The WP Activity Log plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘message’ parameter in all versions up to, and including, 5.2.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
published:2025-02-17T05:15:09.410


Instruction: Please provide detailed information about CVE-2025-1376

CVE:CVE-2025-1376
Description:A vulnerability classified as problematic was found in GNU elfutils 0.192. This vulnerability affects the function elf_strptr in the library /libelf/elf_strptr.c of the component eu-strip. The manipulation leads to denial of service. It is possible to launch the attack on the local host. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The name of the patch is b16f441cca0a4841050e3215a9f120a6d8aea918. It is recommended to apply a patch to fix this issue.
published:2025-02-17T05:15:09.807


Instruction: Please provide detailed information about CVE-2025-1377

CVE:CVE-2025-1377
Description:A vulnerability, which was classified as problematic, has been found in GNU elfutils 0.192. This issue affects the function gelf_getsymshndx of the file strip.c of the component eu-strip. The manipulation leads to denial of service. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. The identifier of the patch is fbf1df9ca286de3323ae541973b08449f8d03aba. It is recommended to apply a patch to fix this issue.
published:2025-02-17T05:15:10.090


Instruction: Please provide detailed information about CVE-2025-1389

CVE:CVE-2025-1389
Description:Orca HCM from Learning Digital has a SQL Injection vulnerability, allowing attackers with regular privileges to inject arbitrary SQL commands to read, modify, and delete database contents.
published:2025-02-17T05:15:10.317


Instruction: Please provide detailed information about CVE-2025-1378

CVE:CVE-2025-1378
Description:A vulnerability, which was classified as problematic, was found in radare2 5.9.9 33286. Affected is an unknown function in the library /libr/main/rasm2.c of the component rasm2. The manipulation leads to memory corruption. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. Upgrading to version 6.0.0 is able to address this issue. The patch is identified as c6c772d2eab692ce7ada5a4227afd50c355ad545. It is recommended to upgrade the affected component.
published:2025-02-17T06:15:13.277


Instruction: Please provide detailed information about CVE-2025-1379

CVE:CVE-2025-1379
Description:A vulnerability has been found in code-projects Real Estate Property Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /Admin/CustomerReport.php. The manipulation of the argument city leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
published:2025-02-17T07:15:08.503


Instruction: Please provide detailed information about CVE-2025-1380

CVE:CVE-2025-1380
Description:A vulnerability was found in Codezips Gym Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /dashboard/admin/del_plan.php. The manipulation of the argument name leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
published:2025-02-17T07:15:08.953


Instruction: Please provide detailed information about CVE-2025-1381

CVE:CVE-2025-1381
Description:A vulnerability was found in code-projects Real Estate Property Management System 1.0. It has been classified as critical. This affects an unknown part of the file /ajax_city.php. The manipulation of the argument CityName leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
published:2025-02-17T08:15:08.540


Instruction: Please provide detailed information about CVE-2025-0001

CVE:CVE-2025-0001
Description:Abacus ERP is versions older than 2024.210.16036, 2023.205.15833, 2022.105.15542 are affected by an authenticated arbitrary file read vulnerability.
published:2025-02-17T10:15:08.550


Instruction: Please provide detailed information about CVE-2025-0714

CVE:CVE-2025-0714
Description:The vulnerability exists in the password storage of Mobateks MobaXterm in versions below 25.0. MobaXTerm uses an initialisation vector (IV) consisting only of zero bytes and a master key to encrypt each password individually. In the default configuration, on opening MobaXTerm, the user is prompted for their password. A derivative of the password is used as the master key. As both the master key and the IV are the same for each stored password, the AES CFB ciphertext depends only on the plaintext (the password). The static IV and master key make it easier to obtain sensitive information and to decrypt data when it is stored at rest.
published:2025-02-17T12:15:27.570


Instruction: Please provide detailed information about CVE-2025-23840

CVE:CVE-2025-23840
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webjema WP-NOTCAPTCHA allows Reflected XSS. This issue affects WP-NOTCAPTCHA: from n/a through 1.3.1.
published:2025-02-17T12:15:27.973


Instruction: Please provide detailed information about CVE-2025-23845

CVE:CVE-2025-23845
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ERA404 ImageMeta allows Reflected XSS. This issue affects ImageMeta: from n/a through 1.1.2.
published:2025-02-17T12:15:28.127


Instruction: Please provide detailed information about CVE-2025-26754

CVE:CVE-2025-26754
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Timeline Block allows Stored XSS. This issue affects Timeline Block: from n/a through 1.1.1.
published:2025-02-17T12:15:28.267


Instruction: Please provide detailed information about CVE-2025-26758

CVE:CVE-2025-26758
Description:Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in RebelCode Spotlight Social Media Feeds allows Retrieve Embedded Sensitive Data. This issue affects Spotlight Social Media Feeds: from n/a through 1.7.1.
published:2025-02-17T12:15:28.407


Instruction: Please provide detailed information about CVE-2025-26769

CVE:CVE-2025-26769
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Webilia Inc. Vertex Addons for Elementor allows Stored XSS. This issue affects Vertex Addons for Elementor: from n/a through 1.2.0.
published:2025-02-17T12:15:28.550


Instruction: Please provide detailed information about CVE-2025-26770

CVE:CVE-2025-26770
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Joe Waymark allows Stored XSS. This issue affects Waymark: from n/a through 1.5.0.
published:2025-02-17T12:15:28.687


Instruction: Please provide detailed information about CVE-2025-26771

CVE:CVE-2025-26771
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sonalsinha21 SKT Blocks – Gutenberg based Page Builder allows Stored XSS. This issue affects SKT Blocks – Gutenberg based Page Builder: from n/a through 1.7.
published:2025-02-17T12:15:28.833


Instruction: Please provide detailed information about CVE-2025-26772

CVE:CVE-2025-26772
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Detheme DethemeKit For Elementor allows Stored XSS. This issue affects DethemeKit For Elementor: from n/a through 2.1.8.
published:2025-02-17T12:15:28.980


Instruction: Please provide detailed information about CVE-2025-26773

CVE:CVE-2025-26773
Description:Missing Authorization vulnerability in Adnan Analytify allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Analytify: from n/a through 5.5.0.
published:2025-02-17T12:15:29.123


Instruction: Please provide detailed information about CVE-2025-26775

CVE:CVE-2025-26775
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RealMag777 BEAR allows Stored XSS. This issue affects BEAR: from n/a through 1.1.4.4.
published:2025-02-17T12:15:29.260


Instruction: Please provide detailed information about CVE-2025-26778

CVE:CVE-2025-26778
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound Gallery allows Stored XSS. This issue affects Gallery: from n/a through 2.2.1.
published:2025-02-17T12:15:29.417


Instruction: Please provide detailed information about CVE-2025-1391

CVE:CVE-2025-1391
Description:A flaw was found in the Keycloak organization feature, which allows the incorrect assignment of an organization to a user if their username or email matches the organization’s domain pattern. This issue occurs at the mapper level, leading to misrepresentation in tokens. If an application relies on these claims for authorization, it may incorrectly assume a user belongs to an organization they are not a member of, potentially granting unauthorized access or privileges.
published:2025-02-17T14:15:08.413


Instruction: Please provide detailed information about CVE-2025-21103

CVE:CVE-2025-21103
Description:Dell NetWorker Management Console, version(s) 19.11 through 19.11.0.3 & Versions prior to 19.10.0.7 contain(s) an improper neutralization of server-side vulnerability. An unauthenticated attacker with local access could potentially exploit this vulnerability and run arbitrary code on the server.
published:2025-02-17T14:15:08.597


Instruction: Please provide detailed information about CVE-2025-1392

CVE:CVE-2025-1392
Description:A vulnerability has been found in D-Link DIR-816 1.01TO and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /cgi-bin/webproc?getpage=html/index.html&var:menu=24gwlan&var:page=24G_basic. The manipulation of the argument SSID leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
published:2025-02-17T16:15:16.120


Instruction: Please provide detailed information about CVE-2025-20075

CVE:CVE-2025-20075
Description:Server-side request forgery (SSRF) vulnerability exists in FileMegane versions above 3.0.0.0 prior to 3.4.0.0. Executing arbitrary backend Web API requests could potentially lead to rebooting the services.
published:2025-02-18T00:15:21.107


Instruction: Please provide detailed information about CVE-2025-25055

CVE:CVE-2025-25055
Description:Authentication bypass by spoofing issue exists in FileMegane versions above 1.0.0.0 prior to 3.4.0.0, which may lead to user impersonation. If exploited, restricted file contents may be accessed.
published:2025-02-18T00:15:21.277


Instruction: Please provide detailed information about CVE-2025-25221

CVE:CVE-2025-25221
Description:The LuxCal Web Calendar prior to 5.3.3M (MySQL version) and prior to 5.3.3L (SQLite version) contains an SQL injection vulnerability in pdf.php. If this vulnerability is exploited, information in a database may be deleted, altered, or retrieved.
published:2025-02-18T01:15:09.070


Instruction: Please provide detailed information about CVE-2025-25222

CVE:CVE-2025-25222
Description:The LuxCal Web Calendar prior to 5.3.3M (MySQL version) and prior to 5.3.3L (SQLite version) contains an SQL injection vulnerability in retrieve.php. If this vulnerability is exploited, information in a database may be deleted, altered, or retrieved.
published:2025-02-18T01:15:09.210


Instruction: Please provide detailed information about CVE-2025-25223

CVE:CVE-2025-25223
Description:The LuxCal Web Calendar prior to 5.3.3M (MySQL version) and prior to 5.3.3L (SQLite version) contains a path traversal vulnerability in dloader.php. If this vulnerability is exploited, arbitrary files on a server may be obtained.
published:2025-02-18T01:15:09.347


Instruction: Please provide detailed information about CVE-2025-25224

CVE:CVE-2025-25224
Description:The LuxCal Web Calendar prior to 5.3.3M (MySQL version) and prior to 5.3.3L (SQLite version) contains a missing authentication vulnerability in dloader.php. If this vulnerability is exploited, arbitrary files on a server may be obtained.
published:2025-02-18T01:15:09.473


Instruction: Please provide detailed information about CVE-2025-1390

CVE:CVE-2025-1390
Description:The PAM module pam_cap.so of libcap configuration supports group names starting with “@”, during actual parsing, configurations not starting with “@” are incorrectly recognized as group names. This may result in nonintended users being granted an inherited capability set, potentially leading to security risks. Attackers can exploit this vulnerability to achieve local privilege escalation on systems where /etc/security/capability.conf is used to configure user inherited privileges by constructing specific usernames.
published:2025-02-18T03:15:10.447


Instruction: Please provide detailed information about CVE-2025-0796

CVE:CVE-2025-0796
Description:The Mortgage Lead Capture System plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 8.2.10. This is due to missing or incorrect nonce validation on the 'wprequal_reset_defaults' action. This makes it possible for unauthenticated attackers to reset the plugin's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
published:2025-02-18T05:15:19.597


Instruction: Please provide detailed information about CVE-2025-0805

CVE:CVE-2025-0805
Description:The Mortgage Calculator / Loan Calculator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'mlcalc' shortcode in all versions up to, and including, 1.5.20 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
published:2025-02-18T05:15:20.053


Instruction: Please provide detailed information about CVE-2025-0422

CVE:CVE-2025-0422
Description:An authenticated user in the "bestinformed Web" application can execute commands on the underlying server running the application. (Remote Code Execution) For this, the user must be able to create "ScriptVars" with the type „script" and preview them by, for example, creating a new "Info". By default, admin users have those permissions, but with the granular permission system, those permissions may be assigned to other users. An attacker is able to execute commands on the server running the "bestinformed Web" application if an account with the correct permissions was compromised before.
published:2025-02-18T08:15:10.147


Instruction: Please provide detailed information about CVE-2025-0423

CVE:CVE-2025-0423
Description:In the "bestinformed Web" application, some user input was not properly sanitized. This leads to multiple unauthenticated stored cross-site scripting vulnerabilities. An unauthenticated attacker is able to compromise the sessions of users on the server by injecting JavaScript code into their session using an "Unauthenticated Stored Cross-Site Scripting". The attacker is then able to ride the session of those users and can abuse their privileges on the "bestinformed Web" application.
published:2025-02-18T08:15:10.360


Instruction: Please provide detailed information about CVE-2025-0424

CVE:CVE-2025-0424
Description:In the "bestinformed Web" application, some user input was not properly sanitized. This leads to multiple authenticated stored cross-site scripting vulnerabilities. An authenticated attacker is able to compromise the sessions of other users on the server by injecting JavaScript code into their session using an "Authenticated Stored Cross-Site Scripting". Those other users might have more privileges than the attacker, enabling a form of horizontal movement.
published:2025-02-18T08:15:10.490


Instruction: Please provide detailed information about CVE-2025-0425

CVE:CVE-2025-0425
Description:Via the GUI of the "bestinformed Infoclient", a low-privileged user is by default able to change the server address of the "bestinformed Server" to which this client connects. This is dangerous as the "bestinformed Infoclient" runs with elevated permissions ("nt authority\system"). By changing the server address to a malicious server, or a script simulating a server, the user is able to escalate his privileges by abusing certain features of the "bestinformed Web" server. Those features include:   *  Pushing of malicious update packages   *  Arbitrary Registry Read as "nt authority\system"   An attacker is able to escalate his privileges to "nt authority\system" on the Windows client running the "bestinformed Infoclient".    This attack is not possible if a custom configuration ("Infoclient.ini") containing the flags "ShowOnTaskbar=false" or "DisabledItems=stPort,stAddress" is deployed.
published:2025-02-18T08:15:10.597


Instruction: Please provide detailed information about CVE-2025-0864

CVE:CVE-2025-0864
Description:The Active Products Tables for WooCommerce. Use constructor to create tables plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'shortcodes_set' parameter in all versions up to, and including, 1.0.6.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
published:2025-02-18T08:15:10.723


Instruction: Please provide detailed information about CVE-2025-0981

CVE:CVE-2025-0981
Description:A vulnerability exists in ChurchCRM 5.13.0 and prior that allows an attacker to hijack a user's session by exploiting a Stored Cross Site Scripting (XSS) vulnerability in the Group Editor page. This allows admin users to inject malicious JavaScript in the description field, which captures the session cookie of authenticated users. The cookie can then be sent to an external server, enabling session hijacking. It can also lead to information disclosure, as exposed session cookies can be used to impersonate users and gain unauthorised access to sensitive information.
published:2025-02-18T10:15:10.333


Instruction: Please provide detailed information about CVE-2025-1023

CVE:CVE-2025-1023
Description:A vulnerability exists in ChurchCRM 5.13.0 and prior that allows an attacker to execute arbitrary SQL queries by exploiting a time-based blind SQL Injection vulnerability in the EditEventTypes functionality. The newCountName parameter is directly concatenated into an SQL query without proper sanitization, allowing an attacker to manipulate database queries and execute arbitrary commands, potentially leading to data exfiltration, modification, or deletion.
published:2025-02-18T10:15:10.500


Instruction: Please provide detailed information about CVE-2025-0521

CVE:CVE-2025-0521
Description:The Post SMTP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the from and subject parameter in all versions up to, and including, 3.0.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
published:2025-02-18T11:15:12.740


Instruction: Please provide detailed information about CVE-2025-0817

CVE:CVE-2025-0817
Description:The FormCraft plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 3.9.11 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
published:2025-02-18T11:15:12.893


Instruction: Please provide detailed information about CVE-2025-1035

CVE:CVE-2025-1035
Description:Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Komtera Technolgies KLog Server allows Manipulating Web Input to File System Calls.This issue affects KLog Server: before 3.1.1.
published:2025-02-18T12:15:16.087


Instruction: Please provide detailed information about CVE-2025-1269

CVE:CVE-2025-1269
Description:URL Redirection to Untrusted Site ('Open Redirect') vulnerability in HAVELSAN Liman MYS allows Cross-Site Flashing.This issue affects Liman MYS: before 2.1.1 - 1010.
published:2025-02-18T14:15:28.513


Instruction: Please provide detailed information about CVE-2025-1414

CVE:CVE-2025-1414
Description:Memory safety bugs present in Firefox 135. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 135.0.1.
published:2025-02-18T14:15:28.670


Instruction: Please provide detailed information about CVE-2025-21702

CVE:CVE-2025-21702
Description:In the Linux kernel, the following vulnerability has been resolved:  pfifo_tail_enqueue: Drop new packet when sch->limit == 0  Expected behaviour: In case we reach scheduler's limit, pfifo_tail_enqueue() will drop a packet in scheduler's queue and decrease scheduler's qlen by one. Then, pfifo_tail_enqueue() enqueue new packet and increase scheduler's qlen by one. Finally, pfifo_tail_enqueue() return `NET_XMIT_CN` status code.  Weird behaviour: In case we set `sch->limit == 0` and trigger pfifo_tail_enqueue() on a scheduler that has no packet, the 'drop a packet' step will do nothing. This means the scheduler's qlen still has value equal 0. Then, we continue to enqueue new packet and increase scheduler's qlen by one. In summary, we can leverage pfifo_tail_enqueue() to increase qlen by one and return `NET_XMIT_CN` status code.  The problem is: Let's say we have two qdiscs: Qdisc_A and Qdisc_B.  - Qdisc_A's type must have '->graft()' function to create parent/child relationship.    Let's say Qdisc_A's type is `hfsc`. Enqueue packet to this qdisc will trigger `hfsc_enqueue`.  - Qdisc_B's type is pfifo_head_drop. Enqueue packet to this qdisc will trigger `pfifo_tail_enqueue`.  - Qdisc_B is configured to have `sch->limit == 0`.  - Qdisc_A is configured to route the enqueued's packet to Qdisc_B.  Enqueue packet through Qdisc_A will lead to:  - hfsc_enqueue(Qdisc_A) -> pfifo_tail_enqueue(Qdisc_B)  - Qdisc_B->q.qlen += 1  - pfifo_tail_enqueue() return `NET_XMIT_CN`  - hfsc_enqueue() check for `NET_XMIT_SUCCESS` and see `NET_XMIT_CN` => hfsc_enqueue() don't increase qlen of Qdisc_A.  The whole process lead to a situation where Qdisc_A->q.qlen == 0 and Qdisc_B->q.qlen == 1. Replace 'hfsc' with other type (for example: 'drr') still lead to the same problem. This violate the design where parent's qlen should equal to the sum of its childrens'qlen.  Bug impact: This issue can be used for user->kernel privilege escalation when it is reachable.
published:2025-02-18T15:15:18.530


Instruction: Please provide detailed information about CVE-2025-21703

CVE:CVE-2025-21703
Description:In the Linux kernel, the following vulnerability has been resolved:  netem: Update sch->q.qlen before qdisc_tree_reduce_backlog()  qdisc_tree_reduce_backlog() notifies parent qdisc only if child qdisc becomes empty, therefore we need to reduce the backlog of the child qdisc before calling it. Otherwise it would miss the opportunity to call cops->qlen_notify(), in the case of DRR, it resulted in UAF since DRR uses ->qlen_notify() to maintain its active list.
published:2025-02-18T15:15:18.633


Instruction: Please provide detailed information about CVE-2025-22207

CVE:CVE-2025-22207
Description:Improperly built order clauses lead to a SQL injection vulnerability in the backend task list of com_scheduler.
published:2025-02-18T16:15:20.467


Instruction: Please provide detailed information about CVE-2025-25300

CVE:CVE-2025-25300
Description:smartbanner.js is a customizable smart app banner for iOS and Android. Prior to version 1.14.1, clicking on smartbanner `View` link and navigating to 3rd party page leaves `window.opener` exposed. It may allow hostile third parties to abuse `window.opener`, e.g. by redirection or injection on the original page with smartbanner. `rel="noopener"` is automatically populated to links as of `v1.14.1` which is a recommended upgrade to resolve the vulnerability. Some workarounds are available for those who cannot upgrade. Ensure `View` link is only taking users to App Store or Google Play Store where security is guarded by respective app store security teams. If `View` link is going to a third party page, limit smartbanner.js to be used on iOS that decreases the scope of the vulnerability since as of Safari 12.1,  `rel="noopener"` is imposed on all `target="_blank"` links. Version 1.14.1 of smartbanner.js contains a fix for the issue.
published:2025-02-18T18:15:35.330


Instruction: Please provide detailed information about CVE-2025-26058

CVE:CVE-2025-26058
Description:Webkul QloApps v1.6.1 exposes authentication tokens in URLs during redirection. When users access the admin panel or other protected areas, the application appends sensitive authentication tokens directly to the URL.
published:2025-02-18T18:15:35.653


Instruction: Please provide detailed information about CVE-2025-26620

CVE:CVE-2025-26620
Description:Duende.AccessTokenManagement is a set of .NET libraries that manage OAuth and OpenId Connect access tokens. Duende.AccessTokenManagement contains a race condition when requesting access tokens using the client credentials flow. Concurrent requests to obtain an access token using differing protocol parameters can return access tokens obtained with the wrong scope, resource indicator, or other protocol parameters. Such usage is somewhat atypical, and only a small percentage of users are likely to be affected. Duende.AccessTokenManagement can request access tokens using the client credentials flow in several ways. In basic usage, the client credentials flow is configured once and the parameters do not vary. In more advanced situations, requests with varying protocol parameters may be made by calling specific overloads of these methods: `HttpContext.GetClientAccessTokenAsync()` and `IClientCredentialsTokenManagementService.GetAccessTokenAsync()`. There are overloads of both of these methods that accept a `TokenRequestParameters` object that customizes token request parameters. However, concurrent requests with varying `TokenRequestParameters` will result in the same token for all concurrent calls. Most users can simply update the NuGet package to the latest version. Customizations of the `IClientCredentialsTokenCache` that derive from the default implementation (`DistributedClientCredentialsTokenCache`) will require a small code change, as its constructor was changed to add a dependency on the `ITokenRequestSynchronization` service. The synchronization service will need to be injected into the derived class and passed to the base constructor. The impact of this vulnerability depends on how Duende.AccessTokenManagement is used and on the security architecture of the solution. Most users will not be vulnerable to this issue. More advanced users may run into this issue by calling the methods specified above with customized token request parameters. The impact of obtaining an access token with different than intended protocol parameters will vary depending on application logic, security architecture, and the authorization policy of the resource servers.
published:2025-02-18T18:15:36.767


Instruction: Please provide detailed information about CVE-2025-21608

CVE:CVE-2025-21608
Description:Meshtastic is an open source mesh networking solution. In affected firmware versions crafted packets over MQTT are able to appear as a DM in client to a node even though they were not decoded with PKC. This issue has been addressed in version 2.5.19 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
published:2025-02-18T19:15:25.220


Instruction: Please provide detailed information about CVE-2025-24894

CVE:CVE-2025-24894
Description:SPID.AspNetCore.Authentication is an AspNetCore Remote Authenticator for SPID. Authentication using Spid and CIE is based on the SAML2 standard which provides two entities: Identity Provider (IDP): the system that authenticates users and provides identity information (SAML affirmation) to the Service Provider, in essence, is responsible for the management of the credentials and identity of users; Service Provider (SP): the system that provides a service to the user and relies on the Identity Provider to authenticate the user, receives SAML assertions from the IdP to grant access to resources. The validation logic of the signature is central as it ensures that you cannot create a SAML response with arbitrary assertions and then impersonate other users. There is no guarantee that the first signature refers to the root object, it follows that if an attacker injects an item signed as the first element, all other signatures will not be verified. The only requirement is to have an XML element legitimately signed by the IdP, a condition that is easily met using the IdP's public metadata. An attacker could create an arbitrary SAML response that would be accepted by SPs using vulnerable SDKs, allowing him to impersonate any Spid and/or CIE user. This vulnerability has been addressed in version 3.4.0 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
published:2025-02-18T19:15:28.090


Instruction: Please provide detailed information about CVE-2025-24895

CVE:CVE-2025-24895
Description:CIE.AspNetCore.Authentication is an AspNetCore Remote Authenticator for CIE 3.0. Authentication using Spid and CIE is based on the SAML2 standard which provides two entities: 1. Identity Provider (IDP): the system that authenticates users and provides identity information (SAML affirmation) to the Service Provider, in essence, is responsible for the management of the credentials and identity of users; 2. Service Provider (SP): the system that provides a service to the user and relies on the Identity Provider to authenticate the user, receives SAML assertions from the IdP to grant access to resources. The library cie-aspnetcore refers to the second entity, the SP, and implements the validation logic of SAML assertions within SAML responses. In affected versions there is no guarantee that the first signature refers to the root object, it follows that if an attacker injects an item signed as the first element, all other signatures will not be verified. The only requirement is to have an XML element legitimately signed by the IdP, a condition that is easily met using the IdP's public metadata. An attacker could create an arbitrary SAML response that would be accepted by SPs using vulnerable SDKs, allowing him to impersonate any Spid and/or CIE user. This issue has been addressed in version 2.1.0 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
published:2025-02-18T19:15:28.240


Instruction: Please provide detailed information about CVE-2025-25284

CVE:CVE-2025-25284
Description:The ZOO-Project is an open source processing platform, released under MIT/X11 Licence. A vulnerability in ZOO-Project's WPS (Web Processing Service) implementation allows unauthorized access to files outside the intended directory through path traversal. Specifically, the Gdal_Translate service, when processing VRT (Virtual Format) files, does not properly validate file paths referenced in the VRTRasterBand element, allowing attackers to read arbitrary files on the system. The vulnerability exists because the service doesn't properly sanitize the SourceFilename parameter in VRT files, allowing relative path traversal sequences (../). When combined with VRT's raw data handling capabilities, this allows reading arbitrary files as raw binary data and converting them to TIFF format, effectively exposing their contents. This vulnerability is particularly severe because it allows attackers to read sensitive system files, potentially exposing configuration data, credentials, or other confidential information stored on the server. An unauthenticated attacker can read arbitrary files from the system through path traversal, potentially accessing sensitive information such as configuration files, credentials, or other confidential data stored on the server. The vulnerability requires no authentication and can be exploited remotely through the WPS service. This issue has been addressed in commit `5f155a8` and all users are advised to upgrade. There are no known workarounds for this vulnerability.
published:2025-02-18T19:15:28.797


Instruction: Please provide detailed information about CVE-2025-25305

CVE:CVE-2025-25305
Description:Home Assistant Core is an open source home automation that puts local control and privacy first. Affected versions are subject to a potential man-in-the-middle attacks due to missing SSL certificate verification in the project codebase and used third-party libraries. In the past, `aiohttp-session`/`request` had the parameter `verify_ssl` to control SSL certificate verification. This was a boolean value. In `aiohttp` 3.0, this parameter was deprecated in favor of the `ssl` parameter. Only when `ssl` is set to `None` or provided with a correct configured SSL context the standard SSL certificate verification will happen. When migrating integrations in Home Assistant and libraries used by Home Assistant, in some cases the `verify_ssl` parameter value was just moved to the new `ssl` parameter. This resulted in these integrations and 3rd party libraries using `request.ssl = True`, which unintentionally turned off SSL certificate verification and opened up a man-in-the-middle attack vector. This issue has been addressed in version 2024.1.6 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
published:2025-02-18T19:15:29.083


Instruction: Please provide detailed information about CVE-2025-26465

CVE:CVE-2025-26465
Description:A vulnerability was found in OpenSSH when the VerifyHostKeyDNS option is enabled. A machine-in-the-middle attack can be performed by a malicious machine impersonating a legit server. This issue occurs due to how OpenSSH mishandles error codes in specific conditions when verifying the host key. For an attack to be considered successful, the attacker needs to manage to exhaust the client's memory resource first, turning the attack complexity high.
published:2025-02-18T19:15:29.230