Instruction: Please provide detailed information about CVE-2025-31473

CVE:CVE-2025-31473
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in matthewprice1178 WP Database Optimizer allows Stored XSS. This issue affects WP Database Optimizer: from n/a through 1.2.1.3.
published:2025-03-28T12:15:20.110


Instruction: Please provide detailed information about CVE-2025-31474

CVE:CVE-2025-31474
Description:Cross-Site Request Forgery (CSRF) vulnerability in matthewprice1178 WP Database Optimizer allows Cross Site Request Forgery. This issue affects WP Database Optimizer: from n/a through 1.2.1.3.
published:2025-03-28T12:15:20.257


Instruction: Please provide detailed information about CVE-2025-2908

CVE:CVE-2025-2908
Description:The exposure of credentials in the call forwarding configuration module in MeetMe products in versions prior to 2024-09 allows an attacker to gain access to some important assets via configuration files.
published:2025-03-28T13:15:41.217


Instruction: Please provide detailed information about CVE-2025-2909

CVE:CVE-2025-2909
Description:The lack of encryption in the DuoxMe (formerly Blue) application binary in versions prior to 3.3.1 for iOS devices allows an attacker to gain unauthorised access to the application code and discover sensitive information.
published:2025-03-28T13:15:41.387


Instruction: Please provide detailed information about CVE-2025-2910

CVE:CVE-2025-2910
Description:User enumeration in the password reset module of the MeetMe authentication service in versions prior to 2024-09 allows an attacker to determine whether an email address is registered through specific error messages.
published:2025-03-28T13:15:41.533


Instruction: Please provide detailed information about CVE-2025-2911

CVE:CVE-2025-2911
Description:Unauthorised access to the call forwarding service system in MeetMe products in versions prior to 2024-09 allows an attacker to identify multiple users and perform brute force attacks via extensions.
published:2025-03-28T13:15:41.673


Instruction: Please provide detailed information about CVE-2025-0986

CVE:CVE-2025-0986
Description:IBM PowerVM Hypervisor FW1050.00 through FW1050.30 and FW1060.00 through FW1060.20 could allow a local user, under certain Linux processor combability mode configurations, to cause undetected data loss or errors when performing gzip compression using HW acceleration.
published:2025-03-28T14:15:19.357


Instruction: Please provide detailed information about CVE-2025-1781

CVE:CVE-2025-1781
Description:There is a XXE in W3CSS Validator versions before cssval-20250226 that allows an attacker to use specially-crafted XML objects to coerce server-side request forgery (SSRF).  This could be exploited to read arbitrary local files if an attacker has access to exception messages.
published:2025-03-28T14:15:19.687


Instruction: Please provide detailed information about CVE-2025-28219

CVE:CVE-2025-28219
Description:Netgear DC112A V1.0.0.64 has an OS command injection vulnerability in the usb_adv.cgi, which allows remote attackers to execute arbitrary commands via parameter "deviceName" passed to the binary through a POST request.
published:2025-03-28T14:15:20.253


Instruction: Please provide detailed information about CVE-2025-28220

CVE:CVE-2025-28220
Description:Tenda W6_S v1.0.0.4_510 has a Buffer Overflow vulnerability in the setcfm function, which allows remote attackers to cause web server crash via parameter funcpara1 passed to the binary through a POST request.
published:2025-03-28T14:15:20.377


Instruction: Please provide detailed information about CVE-2025-28221

CVE:CVE-2025-28221
Description:Tenda W6_S v1.0.0.4_510 has a Buffer Overflow vulnerability in the set_local_time function, which allows remote attackers to cause web server crash via parameter time passed to the binary through a POST request.
published:2025-03-28T14:15:20.483


Instruction: Please provide detailed information about CVE-2025-2858

CVE:CVE-2025-2858
Description:Privilege escalation vulnerability in the saTECH BCU firmware version 2.1.3. An attacker with access to the CLI of the device could make use of the nice command to bypass all restrictions and elevate privileges as a superuser.
published:2025-03-28T14:15:20.650


Instruction: Please provide detailed information about CVE-2025-2859

CVE:CVE-2025-2859
Description:An attacker with network access, could capture traffic and obtain user cookies, allowing the attacker to steal the active user session and make changes to the device via web, depending on the privileges obtained by the user.
published:2025-03-28T14:15:20.810


Instruction: Please provide detailed information about CVE-2025-2860

CVE:CVE-2025-2860
Description:SaTECH BCU in its firmware version 2.1.3, allows an authenticated attacker to access information about the credentials that users have within the web (.xml file). In order to exploit this vulnerability, the attacker must know the path, regardless of the user's privileges on the website.
published:2025-03-28T14:15:20.967


Instruction: Please provide detailed information about CVE-2025-2861

CVE:CVE-2025-2861
Description:SaTECH BCU in its firmware version 2.1.3 uses the HTTP protocol. The use of the HTTP protocol for web browsing has the problem that information is exchanged in unencrypted text. Since sensitive data such as credentials are exchanged, an attacker could obtain them and log in legitimately.
published:2025-03-28T14:15:21.113


Instruction: Please provide detailed information about CVE-2025-2862

CVE:CVE-2025-2862
Description:SaTECH BCU, in its firmware version 2.1.3, performs weak password encryption. This allows an attacker with access to the device's system or website to obtain the credentials, as the storage methods used are not strong enough in terms of encryption.
published:2025-03-28T14:15:21.257


Instruction: Please provide detailed information about CVE-2025-2863

CVE:CVE-2025-2863
Description:Cross-site request forgery (CSRF) vulnerability in the web application of saTECH BCU firmware version 2.1.3, which could allow an unauthenticated local attacker to exploit active administrator sessions and perform malicious actions. The malicious actions that can be executed by the attacker depend on the logged-in user, and may include rebooting the device or modifying roles and permissions.
published:2025-03-28T14:15:21.410


Instruction: Please provide detailed information about CVE-2025-2864

CVE:CVE-2025-2864
Description:SaTECH BCU in its firmware version 2.1.3 allows an attacker to inject malicious code into the legitimate website owning the affected device, once the cookie is set. This attack only impacts the victim's browser (reflected XSS).
published:2025-03-28T14:15:21.570


Instruction: Please provide detailed information about CVE-2025-2865

CVE:CVE-2025-2865
Description:SaTECH BCU, in its firmware version 2.1.3, could allow XSS attacks and other malicious resources to be stored on the web server. An attacker with some knowledge of the web application could send a malicious request to the victim users. Through this request, the victims would interpret the code (resources) stored on another malicious website owned by the attacker.
published:2025-03-28T14:15:21.727


Instruction: Please provide detailed information about CVE-2025-2877

CVE:CVE-2025-2877
Description:A flaw was found in the Ansible Automation Platform's Event-Driven Ansible. In configurations where verbosity is set to "debug", inventory passwords are exposed in plain text when starting a rulebook activation. This issue exists for any "debug" action in a rulebook and also affects Event Streams.
published:2025-03-28T14:15:21.877


Instruction: Please provide detailed information about CVE-2025-2901

CVE:CVE-2025-2901
Description:A flaw was found in the JBoss EAP Management Console, where a stored Cross-site scripting vulnerability occurs when an application improperly sanitizes user input before storing it in a data store. When this stored data is later included in web pages without adequate sanitization, malicious scripts can execute in the context of users who view these pages, leading to potential data theft, session hijacking, or other malicious activities.
published:2025-03-28T14:15:22.020


Instruction: Please provide detailed information about CVE-2025-22356

CVE:CVE-2025-22356
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Stencies Stencies allows Reflected XSS. This issue affects Stencies: from n/a through 0.58.
published:2025-03-28T15:15:46.490


Instruction: Please provide detailed information about CVE-2025-22360

CVE:CVE-2025-22360
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound WP Azure offload allows Reflected XSS. This issue affects WP Azure offload: from n/a through 2.0.
published:2025-03-28T15:15:46.653


Instruction: Please provide detailed information about CVE-2025-22501

CVE:CVE-2025-22501
Description:Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Improve My City Improve My City allows Reflected XSS. This issue affects Improve My City: from n/a through 1.6.
published:2025-03-28T15:15:46.790


Instruction: Please provide detailed information about CVE-2025-22523

CVE:CVE-2025-22523
Description:Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in NotFound Schedule allows Blind SQL Injection. This issue affects Schedule: from n/a through 1.0.0.
published:2025-03-28T15:15:46.930


Instruction: Please provide detailed information about CVE-2025-22526

CVE:CVE-2025-22526
Description:Deserialization of Untrusted Data vulnerability in NotFound PHP/MySQL CPU performance statistics allows Object Injection. This issue affects PHP/MySQL CPU performance statistics: from n/a through 1.2.1.
published:2025-03-28T15:15:47.067


Instruction: Please provide detailed information about CVE-2025-22566

CVE:CVE-2025-22566
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound ULTIMATE VIDEO GALLERY allows Reflected XSS. This issue affects ULTIMATE VIDEO GALLERY: from n/a through 1.4.
published:2025-03-28T15:15:47.210


Instruction: Please provide detailed information about CVE-2025-22575

CVE:CVE-2025-22575
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in extendyourweb SUPER RESPONSIVE SLIDER allows Reflected XSS. This issue affects SUPER RESPONSIVE SLIDER: from n/a through 1.4.
published:2025-03-28T15:15:47.350


Instruction: Please provide detailed information about CVE-2025-22767

CVE:CVE-2025-22767
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in globalpayments GlobalPayments WooCommerce allows Reflected XSS. This issue affects GlobalPayments WooCommerce: from n/a through 1.13.0.
published:2025-03-28T15:15:47.490


Instruction: Please provide detailed information about CVE-2025-29928

CVE:CVE-2025-29928
Description:authentik is an open-source identity provider. Prior to versions 2024.12.4 and 2025.2.3, when authentik was configured to use the database for session storage (which is a non-default setting), deleting sessions via the Web Interface or the API would not revoke the session and the session holder would continue to have access to authentik. authentik 2025.2.3 and 2024.12.4 fix this issue. Switching to the cache-based session storage until the authentik instance can be upgraded is recommended. This will however also delete all existing sessions and users will have to re-authenticate.
published:2025-03-28T15:15:49.587


Instruction: Please provide detailed information about CVE-2025-30211

CVE:CVE-2025-30211
Description:Erlang/OTP is a set of libraries for the Erlang programming language. Prior to versions OTP-27.3.1, 26.2.5.10, and 25.3.2.19, a maliciously formed KEX init message can result with high memory usage. Implementation does not verify RFC specified limits on algorithm names (64 characters) provided in KEX init message. Big KEX init packet may lead to inefficient processing of the error data. As a result, large amount of memory will be allocated for processing malicious data. Versions OTP-27.3.1, OTP-26.2.5.10, and OTP-25.3.2.19 fix the issue. Some workarounds are available. One may set option `parallel_login` to `false` and/or reduce the `max_sessions` option.
published:2025-03-28T15:15:50.863


Instruction: Please provide detailed information about CVE-2025-30371

CVE:CVE-2025-30371
Description:Metabase is a business intelligence and embedded analytics tool. Versions prior to v0.52.16.4, v1.52.16.4, v0.53.8, and v1.53.8 are vulnerable to circumvention of local link access protection in GeoJson endpoint. Self hosted Metabase instances that are using the GeoJson feature could be potentially impacted if their Metabase is colocated with other unsecured resources. This is fixed in v0.52.16.4, v1.52.16.4, v0.53.8, and v1.53.8. Migrating to Metabase Cloud or redeploying Metabase in a dedicated subnet with strict outbound port controls is an available workaround.
published:2025-03-28T15:15:51.090


Instruction: Please provide detailed information about CVE-2025-30372

CVE:CVE-2025-30372
Description:Emlog is an open source website building system. Emlog Pro versions pro-2.5.7 and pro-2.5.8 contain an SQL injection vulnerability. `search_controller.php` does not use addslashes after urldecode, allowing the preceeding addslashes to be bypassed by URL double encoding. This could result in potential leakage of sensitive information from the user database. Version pro-2.5.9 fixes the issue.
published:2025-03-28T15:15:51.227


Instruction: Please provide detailed information about CVE-2025-31010

CVE:CVE-2025-31010
Description:Cross-Site Request Forgery (CSRF) vulnerability in ReichertBrothers SimplyRETS Real Estate IDX allows Cross Site Request Forgery. This issue affects SimplyRETS Real Estate IDX: from n/a through 3.0.3.
published:2025-03-28T15:15:51.367


Instruction: Please provide detailed information about CVE-2025-2713

CVE:CVE-2025-2713
Description:Google gVisor's runsc component exhibited a local privilege escalation vulnerability due to incorrect handling of file access permissions, which allowed unprivileged users to access restricted files. This occurred because the process initially ran with root-like permissions until the first fork.
published:2025-03-28T16:15:30.043


Instruction: Please provide detailed information about CVE-2025-2912

CVE:CVE-2025-2912
Description:A vulnerability was found in HDF5 up to 1.14.6. It has been declared as problematic. Affected by this vulnerability is the function H5O_msg_flush of the file src/H5Omessage.c. The manipulation of the argument oh leads to heap-based buffer overflow. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used.
published:2025-03-28T16:15:30.540


Instruction: Please provide detailed information about CVE-2025-2913

CVE:CVE-2025-2913
Description:A vulnerability was found in HDF5 up to 1.14.6. It has been rated as problematic. Affected by this issue is the function H5FL__blk_gc_list of the file src/H5FL.c. The manipulation of the argument H5FL_blk_head_t leads to use after free. An attack has to be approached locally. The exploit has been disclosed to the public and may be used.
published:2025-03-28T17:15:30.260


Instruction: Please provide detailed information about CVE-2025-2914

CVE:CVE-2025-2914
Description:A vulnerability classified as problematic has been found in HDF5 up to 1.14.6. This affects the function H5FS__sinfo_Srialize_Sct_cb of the file src/H5FScache.c. The manipulation of the argument sect leads to heap-based buffer overflow. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used.
published:2025-03-28T17:15:30.510


Instruction: Please provide detailed information about CVE-2025-2915

CVE:CVE-2025-2915
Description:A vulnerability classified as problematic was found in HDF5 up to 1.14.6. This vulnerability affects the function H5F__accum_free of the file src/H5Faccum.c. The manipulation of the argument overlap_size leads to heap-based buffer overflow. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used.
published:2025-03-28T17:15:30.750


Instruction: Please provide detailed information about CVE-2025-2916

CVE:CVE-2025-2916
Description:A vulnerability, which was classified as critical, has been found in Aishida Call Center System up to 20250314. This issue affects some unknown processing of the file /doscall/weixin/open/amr2mp3. The manipulation of the argument File leads to command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-03-28T17:15:30.983


Instruction: Please provide detailed information about CVE-2025-2917

CVE:CVE-2025-2917
Description:A vulnerability, which was classified as problematic, was found in ChestnutCMS up to 1.5.3. Affected is the function readFile of the file /dev-api/cms/file/read. The manipulation of the argument filePath leads to path traversal. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
published:2025-03-28T18:15:17.253


Instruction: Please provide detailed information about CVE-2025-2919

CVE:CVE-2025-2919
Description:A vulnerability was found in Netis WF-2404 1.1.124EN. It has been declared as critical. This vulnerability affects unknown code of the component UART. The manipulation leads to hardware allows activation of test or debug logic at runtime. It is possible to launch the attack on the physical device. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-03-28T18:15:17.450


Instruction: Please provide detailed information about CVE-2025-2920

CVE:CVE-2025-2920
Description:A vulnerability was found in Netis WF-2404 1.1.124EN. It has been rated as problematic. This issue affects some unknown processing of the file /еtc/passwd. The manipulation leads to use of weak hash. It is possible to launch the attack on the physical device. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-03-28T18:15:17.643


Instruction: Please provide detailed information about CVE-2025-2921

CVE:CVE-2025-2921
Description:A vulnerability classified as critical has been found in Netis WF-2404 1.1.124EN. Affected is an unknown function of the file /etc/passwd. The manipulation with the input Realtek leads to use of default password. It is possible to launch the attack on the physical device. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-03-28T18:15:17.830


Instruction: Please provide detailed information about CVE-2025-31162

CVE:CVE-2025-31162
Description:Floating point exception in fig2dev in version 3.2.9a allows an attacker to availability via local input manipulation via get_slope function.
published:2025-03-28T18:15:18.007


Instruction: Please provide detailed information about CVE-2025-31163

CVE:CVE-2025-31163
Description:Segmentation fault in fig2dev in version 3.2.9a allows an attacker to availability via local input manipulation via put_patternarc function.
published:2025-03-28T18:15:18.160


Instruction: Please provide detailed information about CVE-2025-31164

CVE:CVE-2025-31164
Description:heap-buffer overflow in fig2dev in version 3.2.9a allows an attacker to availability via local input manipulation via  create_line_with_spline.
published:2025-03-28T18:15:18.313


Instruction: Please provide detailed information about CVE-2025-2922

CVE:CVE-2025-2922
Description:A vulnerability classified as problematic was found in Netis WF-2404 1.1.124EN. Affected by this vulnerability is an unknown functionality of the component BusyBox Shell. The manipulation leads to cleartext storage of sensitive information. It is possible to launch the attack on the physical device. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-03-28T19:15:23.063


Instruction: Please provide detailed information about CVE-2025-2923

CVE:CVE-2025-2923
Description:A vulnerability, which was classified as problematic, has been found in HDF5 up to 1.14.6. Affected by this issue is the function H5F_addr_encode_len of the file src/H5Fint.c. The manipulation of the argument pp leads to heap-based buffer overflow. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used.
published:2025-03-28T19:15:24.003


Instruction: Please provide detailed information about CVE-2025-2924

CVE:CVE-2025-2924
Description:A vulnerability, which was classified as problematic, was found in HDF5 up to 1.14.6. This affects the function H5HL__fl_deserialize of the file src/H5HLcache.c. The manipulation of the argument free_block leads to heap-based buffer overflow. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used.
published:2025-03-28T20:15:26.147


Instruction: Please provide detailed information about CVE-2025-2925

CVE:CVE-2025-2925
Description:A vulnerability has been found in HDF5 up to 1.14.6 and classified as problematic. This vulnerability affects the function H5MM_realloc of the file src/H5MM.c. The manipulation of the argument mem leads to double free. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used.
published:2025-03-28T20:15:26.440


Instruction: Please provide detailed information about CVE-2025-2926

CVE:CVE-2025-2926
Description:A vulnerability was found in HDF5 up to 1.14.6 and classified as problematic. This issue affects the function H5O__cache_chk_serialize of the file src/H5Ocache.c. The manipulation leads to null pointer dereference. An attack has to be approached locally. The exploit has been disclosed to the public and may be used.
published:2025-03-28T20:15:26.980


Instruction: Please provide detailed information about CVE-2025-22953

CVE:CVE-2025-22953
Description:A SQL injection vulnerability exists in the Epicor HCM 2021 1.9, specifically in the filter parameter of the JsonFetcher.svc endpoint. An attacker can exploit this vulnerability by injecting malicious SQL payloads into the filter parameter, enabling the unauthorized execution of arbitrary SQL commands on the backend database. If certain features (like xp_cmdshell) are enabled, this may lead to remote code execution.
published:2025-03-28T21:15:17.617


Instruction: Please provide detailed information about CVE-2025-28254

CVE:CVE-2025-28254
Description:Cross Site Scripting vulnerability in Leantime v3.2.1 and before allows an authenticated attacker to execute arbitrary code and obtain sensitive information via the first name field in processMentions().
published:2025-03-28T21:15:17.710


Instruction: Please provide detailed information about CVE-2025-28256

CVE:CVE-2025-28256
Description:An issue in TOTOLINK A3100R V4.1.2cu.5247_B20211129 allows a remote attacker to execute arbitrary code via the setWebWlanIdx of the file /lib/cste_modules/wireless.so.
published:2025-03-28T21:15:17.810


Instruction: Please provide detailed information about CVE-2025-2927

CVE:CVE-2025-2927
Description:A vulnerability was found in ESAFENET CDG 5.6.3.154.205. It has been classified as critical. Affected is an unknown function of the file /parameter/getFileTypeList.jsp. The manipulation of the argument typename leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-03-28T21:15:18.150


Instruction: Please provide detailed information about CVE-2025-25579

CVE:CVE-2025-25579
Description:TOTOLINK A3002R V4.0.0-B20230531.1404 is vulnerable to Command Injection in /bin/boa via bandstr.
published:2025-03-28T22:15:17.597


Instruction: Please provide detailed information about CVE-2025-28087

CVE:CVE-2025-28087
Description:Sourcecodester Online Exam System 1.0 is vulnerable to SQL Injection via dash.php.
published:2025-03-28T22:15:17.717


Instruction: Please provide detailed information about CVE-2025-28089

CVE:CVE-2025-28089
Description:maccms10 v2025.1000.4047 is vulnerable to Server-Side Request Forgery (SSRF) via the Scheduled Task function.
published:2025-03-28T22:15:17.847


Instruction: Please provide detailed information about CVE-2025-28090

CVE:CVE-2025-28090
Description:maccms10 v2025.1000.4047 is vulnerable to Server-Side Request Forgery (SSRF) in the Collection Custom Interface feature.
published:2025-03-28T22:15:17.980


Instruction: Please provide detailed information about CVE-2025-28091

CVE:CVE-2025-28091
Description:maccms10 v2025.1000.4047 has a Server-Side Request Forgery (SSRF) vulnerability via Add Article.
published:2025-03-28T22:15:18.107


Instruction: Please provide detailed information about CVE-2025-28092

CVE:CVE-2025-28092
Description:ShopXO v6.4.0 is vulnerable to Server-Side Request Forgery (SSRF) via image upload function.
published:2025-03-28T22:15:18.237


Instruction: Please provide detailed information about CVE-2025-28093

CVE:CVE-2025-28093
Description:ShopXO v6.4.0 is vulnerable to Server-Side Request Forgery (SSRF) in Email Settings.
published:2025-03-28T22:15:18.410


Instruction: Please provide detailed information about CVE-2025-28094

CVE:CVE-2025-28094
Description:shopxo v6.4.0 has a ssrf/xss vulnerability in multiple places.
published:2025-03-28T22:15:18.563


Instruction: Please provide detailed information about CVE-2025-28096

CVE:CVE-2025-28096
Description:OneNav 1.1.0 is vulnerable to Server-Side Request Forgery (SSRF) in custom headers.
published:2025-03-28T22:15:18.700


Instruction: Please provide detailed information about CVE-2025-28097

CVE:CVE-2025-28097
Description:OneNav 1.1.0 is vulnerable to Cross Site Scripting (XSS) in custom headers.
published:2025-03-28T22:15:18.827


Instruction: Please provide detailed information about CVE-2025-2781

CVE:CVE-2025-2781
Description:The WatchGuard Mobile VPN with SSL Client on Windows does not properly configure directory permissions when installed in a non-default directory. This could allow an authenticated local attacker to escalate to SYSTEM privileges on a vulnerable system.    This issue affects Mobile VPN with SSL Client: from 11.0 through 12.11.
published:2025-03-28T23:15:18.157


Instruction: Please provide detailed information about CVE-2025-2782

CVE:CVE-2025-2782
Description:The WatchGuard Terminal Services Agent on Windows does not properly configure directory permissions when installed in a non-default directory. This could allow an authenticated local attacker to escalate to SYSTEM privileges on a vulnerable system.    This issue affects Terminal Services Agent: from 12.0 through 12.10.
published:2025-03-28T23:15:18.310


Instruction: Please provide detailed information about CVE-2025-31367

CVE:CVE-2025-31367
Description:Rejected reason: Not used
published:2025-03-29T04:15:24.037


Instruction: Please provide detailed information about CVE-2025-31368

CVE:CVE-2025-31368
Description:Rejected reason: Not used
published:2025-03-29T04:15:29.740


Instruction: Please provide detailed information about CVE-2025-31369

CVE:CVE-2025-31369
Description:Rejected reason: Not used
published:2025-03-29T04:15:38.600


Instruction: Please provide detailed information about CVE-2025-31370

CVE:CVE-2025-31370
Description:Rejected reason: Not used
published:2025-03-29T04:15:38.677


Instruction: Please provide detailed information about CVE-2025-31371

CVE:CVE-2025-31371
Description:Rejected reason: Not used
published:2025-03-29T04:15:38.813


Instruction: Please provide detailed information about CVE-2025-31372

CVE:CVE-2025-31372
Description:Rejected reason: Not used
published:2025-03-29T04:15:38.950


Instruction: Please provide detailed information about CVE-2025-31373

CVE:CVE-2025-31373
Description:Rejected reason: Not used
published:2025-03-29T04:15:39.090


Instruction: Please provide detailed information about CVE-2025-31374

CVE:CVE-2025-31374
Description:Rejected reason: Not used
published:2025-03-29T04:15:39.340


Instruction: Please provide detailed information about CVE-2025-1217

CVE:CVE-2025-1217
Description:In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when http request module parses HTTP response obtained from a server, folded headers are parsed incorrectly, which may lead to misinterpreting the response and using incorrect headers, MIME types, etc.
published:2025-03-29T06:15:36.557


Instruction: Please provide detailed information about CVE-2025-2006

CVE:CVE-2025-2006
Description:The Inline Image Upload for BBPress plugin for WordPress is vulnerable to arbitrary file uploads due to missing file extension validation in the file uploading functionality in all versions up to, and including, 1.1.19. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. This may be exploitable by unauthenticated attackers when the "Allow guest users without accounts to create topics and replies" setting is enabled.
published:2025-03-29T07:15:17.220


Instruction: Please provide detailed information about CVE-2025-2249

CVE:CVE-2025-2249
Description:The SoJ SoundSlides plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the soj_soundslides_options_subpanel() function in all versions up to, and including, 1.2.2. This makes it possible for authenticated attackers, with Contributor-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
published:2025-03-29T07:15:17.747


Instruction: Please provide detailed information about CVE-2025-2266

CVE:CVE-2025-2266
Description:The Checkout Mestres do WP for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the cwmpUpdateOptions() function in versions 8.6.5 to 8.7.5. This makes it possible for unauthenticated attackers to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site.
published:2025-03-29T07:15:18.247


Instruction: Please provide detailed information about CVE-2025-2803

CVE:CVE-2025-2803
Description:The So-Called Air Quotes plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 0.1. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
published:2025-03-29T07:15:18.770


Instruction: Please provide detailed information about CVE-2025-2840

CVE:CVE-2025-2840
Description:The DAP to Autoresponders Email Syncing plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0 through the publicly accessible phpinfo.php script. This makes it possible for unauthenticated attackers to view potentially sensitive information contained in the exposed file.
published:2025-03-29T07:15:19.317


Instruction: Please provide detailed information about CVE-2025-1219

CVE:CVE-2025-1219
Description:In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when requesting a HTTP resource using the DOM or SimpleXML extensions, the wrong content-type header is used to determine the charset when the requested resource performs a redirect. This may cause the resulting document to be parsed incorrectly or bypass validations.
published:2025-03-30T06:15:13.570


Instruction: Please provide detailed information about CVE-2025-1734

CVE:CVE-2025-1734
Description:In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when receiving headers from HTTP server, the headers missing a colon (:) are treated as valid headers even though they are not. This may confuse applications into accepting invalid headers.
published:2025-03-30T06:15:14.603


Instruction: Please provide detailed information about CVE-2025-1736

CVE:CVE-2025-1736
Description:In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when user-supplied headers are sent, the insufficient validation of the end-of-line characters may prevent certain headers from being sent or lead to certain headers be misinterpreted.
published:2025-03-30T06:15:14.803


Instruction: Please provide detailed information about CVE-2025-1861

CVE:CVE-2025-1861
Description:In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when parsing HTTP redirect in the response to an HTTP request, there is currently limit on the location value size caused by limited size of the location buffer to 1024. However as per RFC9110, the limit is recommended to be 8000. This may lead to incorrect URL truncation and redirecting to a wrong location.
published:2025-03-30T06:15:14.957


Instruction: Please provide detailed information about CVE-2025-2951

CVE:CVE-2025-2951
Description:A vulnerability classified as critical has been found in Bluestar Micro Mall 1.0. Affected is an unknown function of the file /api/data.php. The manipulation of the argument Search leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
published:2025-03-30T12:15:27.347


Instruction: Please provide detailed information about CVE-2025-2952

CVE:CVE-2025-2952
Description:A vulnerability classified as critical was found in Bluestar Micro Mall 1.0. Affected by this vulnerability is an unknown functionality of the file /api/api.php?mod=upload&type=1. The manipulation of the argument File leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
published:2025-03-30T15:15:28.830


Instruction: Please provide detailed information about CVE-2025-2953

CVE:CVE-2025-2953
Description:A vulnerability, which was classified as problematic, has been found in PyTorch 2.6.0+cu124. Affected by this issue is the function torch.mkldnn_max_pool2d. The manipulation leads to denial of service. An attack has to be approached locally. The exploit has been disclosed to the public and may be used.
published:2025-03-30T16:15:14.380


Instruction: Please provide detailed information about CVE-2025-2954

CVE:CVE-2025-2954
Description:A vulnerability, which was classified as problematic, was found in mannaandpoem OpenManus up to 2025.3.13. This affects the function execute of the file app/tool/file_saver.py of the component File Handler. The manipulation leads to improper access controls. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-03-30T17:15:19.890


Instruction: Please provide detailed information about CVE-2025-2955

CVE:CVE-2025-2955
Description:A vulnerability has been found in TOTOLINK A3000RU up to 5.9c.5185 and classified as problematic. This vulnerability affects unknown code of the file /cgi-bin/ExportIbmsConfig.sh of the component IBMS Configuration File Handler. The manipulation leads to improper access controls. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
published:2025-03-30T18:15:14.767


Instruction: Please provide detailed information about CVE-2025-2956

CVE:CVE-2025-2956
Description:A vulnerability was found in TRENDnet TI-G102i 1.0.7.S0_ /1.0.8.S0_ and classified as problematic. This issue affects the function plugins_call_handle_uri_raw of the file /usr/sbin/lighttpd of the component HTTP Request Handler. The manipulation leads to null pointer dereference. The attack can only be done within the local network. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-03-30T18:15:15.783


Instruction: Please provide detailed information about CVE-2025-2957

CVE:CVE-2025-2957
Description:A vulnerability was found in TRENDnet TEW-411BRP+ 2.07. It has been classified as problematic. Affected is the function sub_401DB0 of the file /usr/sbin/httpd of the component HTTP Request Handler. The manipulation leads to null pointer dereference. The attack can only be initiated within the local network. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-03-30T19:15:14.933


Instruction: Please provide detailed information about CVE-2025-2958

CVE:CVE-2025-2958
Description:A vulnerability was found in TRENDnet TEW-818DRU 1.0.14.6. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /usr/sbin/httpd of the component HTTP Request Handler. The manipulation leads to denial of service. The attack needs to be done within the local network. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-03-30T20:15:14.490


Instruction: Please provide detailed information about CVE-2025-2959

CVE:CVE-2025-2959
Description:A vulnerability was found in TRENDnet TEW-410APB 1.3.06b. It has been rated as problematic. Affected by this issue is the function sub_4019A0 of the file /usr/sbin/httpd of the component HTTP Request Handler. The manipulation leads to null pointer dereference. The attack needs to be initiated within the local network. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-03-30T21:15:31.960


Instruction: Please provide detailed information about CVE-2025-2960

CVE:CVE-2025-2960
Description:A vulnerability classified as problematic has been found in TRENDnet TEW-637AP and TEW-638APB 1.2.7/1.3.0.106. This affects the function sub_41DED0 of the file /bin/goahead of the component HTTP Request Handler. The manipulation leads to null pointer dereference. Access to the local network is required for this attack. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-03-30T21:15:32.143


Instruction: Please provide detailed information about CVE-2025-2961

CVE:CVE-2025-2961
Description:A vulnerability classified as problematic was found in opensolon up to 3.1.0. This vulnerability affects the function render_mav of the file /aa of the component org.noear.solon.core.handle.RenderManager. The manipulation of the argument template with the input ../org/example/HelloApp.class leads to path traversal: '../filedir'. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
published:2025-03-30T22:15:15.293


Instruction: Please provide detailed information about CVE-2025-2963

CVE:CVE-2025-2963
Description:Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
published:2025-03-30T22:15:15.597


Instruction: Please provide detailed information about CVE-2025-2964

CVE:CVE-2025-2964
Description:Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
published:2025-03-30T23:15:40.477


Instruction: Please provide detailed information about CVE-2025-2965

CVE:CVE-2025-2965
Description:Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
published:2025-03-30T23:15:41.523


Instruction: Please provide detailed information about CVE-2025-2966

CVE:CVE-2025-2966
Description:Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
published:2025-03-31T00:15:14.633


Instruction: Please provide detailed information about CVE-2025-2967

CVE:CVE-2025-2967
Description:Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
published:2025-03-31T01:15:40.113


Instruction: Please provide detailed information about CVE-2025-2968

CVE:CVE-2025-2968
Description:Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
published:2025-03-31T01:15:40.303


Instruction: Please provide detailed information about CVE-2025-1268

CVE:CVE-2025-1268
Description:Out-of-bounds vulnerability in EMF Recode processing of Generic Plus PCL6 Printer Driver / Generic Plus UFR II Printer Driver / Generic Plus LIPS4 Printer Driver / Generic Plus LIPSLX Printer Driver / Generic Plus PS Printer Driver
published:2025-03-31T02:15:17.097


Instruction: Please provide detailed information about CVE-2025-2969

CVE:CVE-2025-2969
Description:Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
published:2025-03-31T02:15:21.367


Instruction: Please provide detailed information about CVE-2025-2970

CVE:CVE-2025-2970
Description:Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
published:2025-03-31T02:15:21.583


Instruction: Please provide detailed information about CVE-2025-2971

CVE:CVE-2025-2971
Description:Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
published:2025-03-31T02:15:21.767


Instruction: Please provide detailed information about CVE-2025-2972

CVE:CVE-2025-2972
Description:Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
published:2025-03-31T03:15:14.013


Instruction: Please provide detailed information about CVE-2025-2973

CVE:CVE-2025-2973
Description:A vulnerability, which was classified as critical, was found in code-projects College Management System 1.0. This affects an unknown part of the file /Admin/student.php. The manipulation of the argument profile_image leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
published:2025-03-31T03:15:14.267


Instruction: Please provide detailed information about CVE-2025-2974

CVE:CVE-2025-2974
Description:A vulnerability has been found in CodeCanyon Perfex CRM up to 3.2.1 and classified as problematic. This vulnerability affects unknown code of the file /contract of the component Contracts. The manipulation of the argument content leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
published:2025-03-31T04:15:17.633


Instruction: Please provide detailed information about CVE-2025-2975

CVE:CVE-2025-2975
Description:A vulnerability was found in GFI KerioConnect 10.0.6 and classified as problematic. This issue affects some unknown processing of the file Settings/Email/Signature/EditHtmlSource of the component Signature Handler. The manipulation leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-03-31T04:15:17.927


Instruction: Please provide detailed information about CVE-2025-3011

CVE:CVE-2025-3011
Description:SOOP-CLM from PiExtract has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read, modify, and delete database contents.
published:2025-03-31T04:15:19.037


Instruction: Please provide detailed information about CVE-2025-3013

CVE:CVE-2025-3013
Description:Insecure Direct Object References (IDOR) in access control in Customer Portal before 2.1.4 on NightWolf Penetration Testing allows an attacker to access via manipulating request parameters or object references.
published:2025-03-31T04:15:21.297


Instruction: Please provide detailed information about CVE-2025-3014

CVE:CVE-2025-3014
Description:Insecure Direct Object References (IDOR) in access control in Tracking 2.1.4 on NightWolf Penetration Testing allows an attacker to access via manipulating request parameters or object references.
published:2025-03-31T04:15:33.730


Instruction: Please provide detailed information about CVE-2025-24517

CVE:CVE-2025-24517
Description:Use of client-side authentication issue exists in CHOCO TEI WATCHER mini (IB-MCT001) all versions. If this issue is exploited, a remote attacker may obtain the product login password without authentication.
published:2025-03-31T05:15:15.420


Instruction: Please provide detailed information about CVE-2025-24852

CVE:CVE-2025-24852
Description:Storing passwords in a recoverable format issue exists in CHOCO TEI WATCHER mini (IB-MCT001) all versions. If this issue is exploited, an attacker who can access the microSD card used on the product may obtain the product login password.
published:2025-03-31T05:15:15.620


Instruction: Please provide detailed information about CVE-2025-25211

CVE:CVE-2025-25211
Description:Weak password requirements issue exists in CHOCO TEI WATCHER mini (IB-MCT001) all versions. If this issue is exploited, a brute-force attack may allow an attacker unauthorized access and login.
published:2025-03-31T05:15:15.773


Instruction: Please provide detailed information about CVE-2025-26689

CVE:CVE-2025-26689
Description:Direct request ('Forced Browsing') issue exists in CHOCO TEI WATCHER mini (IB-MCT001) all versions. If a remote attacker sends a specially crafted HTTP request to the product, the product data may be obtained or deleted, and/or the product settings may be altered.
published:2025-03-31T05:15:15.933


Instruction: Please provide detailed information about CVE-2025-2976

CVE:CVE-2025-2976
Description:A vulnerability was found in GFI KerioConnect 10.0.6. It has been classified as problematic. Affected is an unknown function of the component File Upload. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-03-31T05:15:16.090


Instruction: Please provide detailed information about CVE-2025-2977

CVE:CVE-2025-2977
Description:A vulnerability was found in GFI KerioConnect 10.0.6. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the component PDF File Handler. The manipulation leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-03-31T05:15:16.310


Instruction: Please provide detailed information about CVE-2025-31103

CVE:CVE-2025-31103
Description:Untrusted data deserialization vulnerability exists in a-blog cms. Processing a specially crafted request may store arbitrary files on the server where the product is running. This can be leveraged to execute an arbitrary script on the server.
published:2025-03-31T05:15:16.500


Instruction: Please provide detailed information about CVE-2025-0613

CVE:CVE-2025-0613
Description:The Photo Gallery by 10Web  WordPress plugin before 1.8.34 does not sanitised and escaped comment added on images by unauthenticated users, leading to an Unauthenticated Stored-XSS attack when comments are displayed
published:2025-03-31T06:15:29.463


Instruction: Please provide detailed information about CVE-2025-2978

CVE:CVE-2025-2978
Description:A vulnerability was found in WCMS 11. It has been rated as critical. Affected by this issue is some unknown functionality of the file /index.php?articleadmin/upload/?&CKEditor=container&CKEditorFuncNum=1 of the component Article Publishing Page. The manipulation of the argument Upload leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-03-31T06:15:29.627


Instruction: Please provide detailed information about CVE-2025-2979

CVE:CVE-2025-2979
Description:A vulnerability classified as problematic has been found in WCMS 11. This affects an unknown part of the file /index.php?anonymous/setregister of the component Registration. The manipulation of the argument Username leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-03-31T06:15:29.857


Instruction: Please provide detailed information about CVE-2025-30835

CVE:CVE-2025-30835
Description:Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Bastien Ho Accounting for WooCommerce allows PHP Local File Inclusion. This issue affects Accounting for WooCommerce: from n/a through 1.6.8.
published:2025-03-31T06:15:30.123


Instruction: Please provide detailed information about CVE-2025-30855

CVE:CVE-2025-30855
Description:Missing Authorization vulnerability in Ads by WPQuads Ads by WPQuads allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Ads by WPQuads: from n/a through 2.0.87.1.
published:2025-03-31T06:15:30.310


Instruction: Please provide detailed information about CVE-2025-30987

CVE:CVE-2025-30987
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound JetBlocks For Elementor allows Stored XSS. This issue affects JetBlocks For Elementor: from n/a through 1.3.16.
published:2025-03-31T06:15:30.487


Instruction: Please provide detailed information about CVE-2025-31016

CVE:CVE-2025-31016
Description:Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Crocoblock JetWooBuilder allows PHP Local File Inclusion.This issue affects JetWooBuilder: from n/a through 2.1.18.
published:2025-03-31T06:15:30.650


Instruction: Please provide detailed information about CVE-2025-31043

CVE:CVE-2025-31043
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound JetSearch allows DOM-Based XSS. This issue affects JetSearch: from n/a through 3.5.7.
published:2025-03-31T06:15:30.827


Instruction: Please provide detailed information about CVE-2025-31387

CVE:CVE-2025-31387
Description:Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in InstaWP InstaWP Connect allows PHP Local File Inclusion. This issue affects InstaWP Connect: from n/a through 0.1.0.82.
published:2025-03-31T06:15:30.990


Instruction: Please provide detailed information about CVE-2025-31412

CVE:CVE-2025-31412
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound JetProductGallery allows DOM-Based XSS. This issue affects JetProductGallery: from n/a through 2.1.22.
published:2025-03-31T06:15:31.147


Instruction: Please provide detailed information about CVE-2025-31414

CVE:CVE-2025-31414
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Stylemix Cost Calculator Builder allows Stored XSS. This issue affects Cost Calculator Builder: from n/a through 3.2.65.
published:2025-03-31T06:15:31.317


Instruction: Please provide detailed information about CVE-2025-31417

CVE:CVE-2025-31417
Description:Missing Authorization vulnerability in Fahad Mahmood WP Docs allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WP Docs: from n/a through n/a.
published:2025-03-31T06:15:31.480


Instruction: Please provide detailed information about CVE-2025-2402

CVE:CVE-2025-2402
Description:A hard-coded, non-random password for the object store (minio) of KNIME Business Hub in all versions except the ones listed below allows an unauthenticated remote attacker in possession of the password to read and manipulate swapped jobs or read and manipulate in- and output data of active jobs. It is also possible to cause a denial-of-service of most functionality of KNIME Business Hub by writing large amounts of data to the object store directly.     There are no viable workarounds therefore we strongly recommend to update to one of the following versions of KNIME Business Hub:       *  1.13.2 or later          *  1.12.3 or later          *  1.11.3 or later          *  1.10.3 or later
published:2025-03-31T07:15:18.280


Instruction: Please provide detailed information about CVE-2025-2980

CVE:CVE-2025-2980
Description:A vulnerability classified as problematic was found in Legrand SMS PowerView 1.x. This vulnerability affects unknown code. The manipulation of the argument redirect leads to open redirect. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-03-31T07:15:18.710


Instruction: Please provide detailed information about CVE-2025-2981

CVE:CVE-2025-2981
Description:A vulnerability, which was classified as problematic, has been found in Legrand SMS PowerView 1.x. This issue affects some unknown processing. The manipulation of the argument redirect leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-03-31T07:15:18.937


Instruction: Please provide detailed information about CVE-2025-3019

CVE:CVE-2025-3019
Description:KNIME Business Hub is affected by several cross-site scripting vulnerabilities in its web pages. If a user clicks on a malicious link or opens a malicious web page, arbitrary Java Script may be executed with this user's permissions. This can lead to information loss and/or modification of existing data. The issues are caused by a  bug https://github.com/Baroshem/nuxt-security/issues/610  in the widely used nuxt-security module.      There are no viable workarounds therefore we strongly recommend to update to one of the following versions of KNIME Business Hub:        *  1.13.3 or later         *  1.12.4 or later
published:2025-03-31T07:15:19.133


Instruction: Please provide detailed information about CVE-2025-2982

CVE:CVE-2025-2982
Description:A vulnerability, which was classified as critical, was found in Legrand SMS PowerView 1.x. Affected is an unknown function. The manipulation of the argument redirect leads to file inclusion. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-03-31T08:15:27.073


Instruction: Please provide detailed information about CVE-2025-2983

CVE:CVE-2025-2983
Description:A vulnerability has been found in Legrand SMS PowerView 1.x and classified as critical. Affected by this vulnerability is an unknown functionality. The manipulation of the argument redirect leads to os command injection. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-03-31T08:15:27.723


Instruction: Please provide detailed information about CVE-2025-2071

CVE:CVE-2025-2071
Description:A critical OS Command Injection vulnerability has been identified in the FAST LTA Silent Brick WebUI, allowing remote attackers to execute arbitrary operating system commands via specially crafted input. This vulnerability arises due to improper handling of untrusted input, which is passed directly to system-level commands without adequate sanitization or validation. Successful exploitation could allow attackers to execute arbitrary commands on the affected system, potentially resulting in unauthorized access, data leakage, or full system compromise. Affected WebUI parameters are "hd" and "pi".
published:2025-03-31T09:15:14.807


Instruction: Please provide detailed information about CVE-2025-2072

CVE:CVE-2025-2072
Description:A Reflected Cross-Site Scripting (XSS) vulnerability has been discovered in FAST LTA Silent Brick WebUI, allowing attackers to inject malicious JavaScript code into web pages viewed by users. This issue arises when user-supplied input is improperly handled and reflected directly in the output of a web page without proper sanitization or encoding. Exploiting this vulnerability, an attacker can execute arbitrary JavaScript in the context of the victim's browser, potentially leading to session hijacking, data theft, and other malicious actions. Affected WebUI parameters are "h", "hd", "p", "pi", "s", "t", "x", "y".
published:2025-03-31T09:15:14.987


Instruction: Please provide detailed information about CVE-2025-2984

CVE:CVE-2025-2984
Description:A vulnerability was found in code-projects Payroll Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /delete.php. The manipulation of the argument emp_id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
published:2025-03-31T09:15:16.607


Instruction: Please provide detailed information about CVE-2025-2985

CVE:CVE-2025-2985
Description:A vulnerability was found in code-projects Payroll Management System 1.0. It has been classified as critical. This affects an unknown part of the file update_account.php. The manipulation of the argument deduction leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.
published:2025-03-31T09:15:16.803


Instruction: Please provide detailed information about CVE-2025-30961

CVE:CVE-2025-30961
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tinuzz Trackserver allows DOM-Based XSS.This issue affects Trackserver: from n/a through 5.0.3.
published:2025-03-31T09:15:16.987


Instruction: Please provide detailed information about CVE-2025-31406

CVE:CVE-2025-31406
Description:Subscriber Broken Access Control in ELEX WooCommerce Request a Quote <= 2.3.3 versions.
published:2025-03-31T09:15:17.143


Instruction: Please provide detailed information about CVE-2025-31410

CVE:CVE-2025-31410
Description:Cross-Site Request Forgery (CSRF) vulnerability in Ashish Ajani WP Church Donation allows Cross Site Request Forgery.This issue affects WP Church Donation: from n/a through 1.7.
published:2025-03-31T09:15:17.297


Instruction: Please provide detailed information about CVE-2025-2989

CVE:CVE-2025-2989
Description:A vulnerability was found in Tenda FH1202 1.2.0.14(408). It has been declared as critical. This vulnerability affects unknown code of the file /goform/AdvSetWrl of the component Web Management Interface. The manipulation leads to improper access controls. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
published:2025-03-31T10:15:16.080


Instruction: Please provide detailed information about CVE-2025-2990

CVE:CVE-2025-2990
Description:A vulnerability was found in Tenda FH1202 1.2.0.14(408). It has been rated as critical. This issue affects some unknown processing of the file /goform/AdvSetWrlGstset of the component Web Management Interface. The manipulation leads to improper access controls. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
published:2025-03-31T10:15:16.367


Instruction: Please provide detailed information about CVE-2025-31376

CVE:CVE-2025-31376
Description:Missing Authorization vulnerability in Mayeenul Islam NanoSupport allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects NanoSupport: from n/a through 0.6.0.
published:2025-03-31T10:15:16.560


Instruction: Please provide detailed information about CVE-2025-31386

CVE:CVE-2025-31386
Description:Missing Authorization vulnerability in Simplepress Simple:Press allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simple:Press: from n/a through 6.10.11.
published:2025-03-31T10:15:16.733


Instruction: Please provide detailed information about CVE-2025-23995

CVE:CVE-2025-23995
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ta2g Tantyyellow allows Reflected XSS.This issue affects Tantyyellow: from n/a through 1.0.0.5.
published:2025-03-31T11:15:38.443


Instruction: Please provide detailed information about CVE-2025-2991

CVE:CVE-2025-2991
Description:A vulnerability classified as critical has been found in Tenda FH1202 1.2.0.14(408). Affected is an unknown function of the file /goform/AdvSetWrlmacfilter of the component Web Management Interface. The manipulation leads to improper access controls. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
published:2025-03-31T11:15:39.160


Instruction: Please provide detailed information about CVE-2025-2992

CVE:CVE-2025-2992
Description:A vulnerability classified as critical was found in Tenda FH1202 1.2.0.14(408). Affected by this vulnerability is an unknown functionality of the file /goform/AdvSetWrlsafeset of the component Web Management Interface. The manipulation leads to improper access controls. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
published:2025-03-31T11:15:39.393


Instruction: Please provide detailed information about CVE-2025-30963

CVE:CVE-2025-30963
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetSmartFilters allows DOM-Based XSS.This issue affects JetSmartFilters: from n/a through 3.6.3.
published:2025-03-31T11:15:39.583


Instruction: Please provide detailed information about CVE-2025-31419

CVE:CVE-2025-31419
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeix Churel allows DOM-Based XSS.This issue affects Churel: from n/a through 1.0.8.
published:2025-03-31T11:15:39.827


Instruction: Please provide detailed information about CVE-2025-3021

CVE:CVE-2025-3021
Description:Path Traversal vulnerability in e-solutions e-management. This vulnerability could allow an attacker to access confidential files outside the expected scope via the ‘file’ parameter in the /downloadReport.php endpoint.
published:2025-03-31T11:15:39.973


Instruction: Please provide detailed information about CVE-2025-3026

CVE:CVE-2025-3026
Description:The vulnerability exists in the EJBCA service, version 8.0 Enterprise. Not tested in higher versions. By modifying the ‘Host’ header in an HTTP request, it is possible to manipulate the generated links and thus redirect the client to a different base URL.  In this way, an attacker could insert his own server for the client to send HTTP requests, provided he succeeds in exploiting it.
published:2025-03-31T11:15:40.127


Instruction: Please provide detailed information about CVE-2025-3027

CVE:CVE-2025-3027
Description:The vulnerability exists in the EJBCA service, version 8.0 Enterprise. By making a small change to the PATH of the URL associated with the service, the server fails to find the requested file and redirects to an external page. This vulnerability could allow users to be redirected to potentially malicious external sites, which can be exploited for phishing or other social engineering attacks.
published:2025-03-31T11:15:40.273


Instruction: Please provide detailed information about CVE-2025-2586

CVE:CVE-2025-2586
Description:A flaw was found in the OpenShift Lightspeed Service, which is vulnerable to unauthenticated API request flooding. Repeated queries to non-existent endpoints inflate metrics storage and processing, consuming excessive resources. This issue can lead to monitoring system degradation, increased disk usage, and potential service unavailability. Since the issue does not require authentication, an external attacker can exhaust CPU, RAM, and disk space, impacting both application and cluster stability.
published:2025-03-31T12:15:15.073


Instruction: Please provide detailed information about CVE-2025-2993

CVE:CVE-2025-2993
Description:A vulnerability, which was classified as critical, has been found in Tenda FH1202 1.2.0.14(408). Affected by this issue is some unknown functionality of the file /default.cfg. The manipulation of the argument these leads to improper access controls. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
published:2025-03-31T12:15:15.700


Instruction: Please provide detailed information about CVE-2025-2994

CVE:CVE-2025-2994
Description:A vulnerability, which was classified as critical, was found in Tenda FH1202 1.2.0.14(408). This affects an unknown part of the file /goform/qossetting of the component Web Management Interface. The manipulation leads to improper access controls. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
published:2025-03-31T12:15:15.900


Instruction: Please provide detailed information about CVE-2025-3022

CVE:CVE-2025-3022
Description:Os command injection vulnerability in e-solutions e-management. This vulnerability allows an attacker to execute arbitrary commands on the server via the ‘client’ parameter in the /data/apache/e-management/api/api3.php endpoint.
published:2025-03-31T12:15:16.130


Instruction: Please provide detailed information about CVE-2025-29266

CVE:CVE-2025-29266
Description:Unraid 7.0.0 before 7.0.1 allows remote users to access the Unraid WebGUI and web console as root without authentication if a container is running in Host networking mode with Use Tailscale enabled.
published:2025-03-31T13:15:43.250


Instruction: Please provide detailed information about CVE-2025-2995

CVE:CVE-2025-2995
Description:A vulnerability has been found in Tenda FH1202 1.2.0.14(408) and classified as critical. This vulnerability affects unknown code of the file /goform/SysToolChangePwd of the component Web Management Interface. The manipulation leads to improper access controls. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
published:2025-03-31T13:15:45.310


Instruction: Please provide detailed information about CVE-2025-2996

CVE:CVE-2025-2996
Description:A vulnerability was found in Tenda FH1202 1.2.0.14(408) and classified as critical. This issue affects some unknown processing of the file /goform/SysToolDDNS of the component Web Management Interface. The manipulation leads to improper access controls. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
published:2025-03-31T13:15:45.503


Instruction: Please provide detailed information about CVE-2025-31526

CVE:CVE-2025-31526
Description:Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in eleopard Behance Portfolio Manager allows SQL Injection. This issue affects Behance Portfolio Manager: from n/a through 1.7.4.
published:2025-03-31T13:15:46.497


Instruction: Please provide detailed information about CVE-2025-31527

CVE:CVE-2025-31527
Description:Server-Side Request Forgery (SSRF) vulnerability in Kishan WP Link Preview allows Server Side Request Forgery. This issue affects WP Link Preview: from n/a through 1.4.1.
published:2025-03-31T13:15:46.650


Instruction: Please provide detailed information about CVE-2025-31528

CVE:CVE-2025-31528
Description:Missing Authorization vulnerability in wokamoto StaticPress allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects StaticPress: from n/a through 0.4.5.
published:2025-03-31T13:15:46.840


Instruction: Please provide detailed information about CVE-2025-31529

CVE:CVE-2025-31529
Description:Missing Authorization vulnerability in Rashid Slider Path for Elementor allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Slider Path for Elementor: from n/a through 3.0.0.
published:2025-03-31T13:15:47.003


Instruction: Please provide detailed information about CVE-2025-31530

CVE:CVE-2025-31530
Description:Missing Authorization vulnerability in smackcoders Google SEO Pressor Snippet allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Google SEO Pressor Snippet: from n/a through 2.0.
published:2025-03-31T13:15:47.143


Instruction: Please provide detailed information about CVE-2025-31532

CVE:CVE-2025-31532
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Team AtomChat AtomChat allows Stored XSS. This issue affects AtomChat: from n/a through 1.1.6.
published:2025-03-31T13:15:47.290


Instruction: Please provide detailed information about CVE-2025-31533

CVE:CVE-2025-31533
Description:Missing Authorization vulnerability in Salesmate.io Salesmate Add-On for Gravity Forms allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Salesmate Add-On for Gravity Forms: from n/a through 2.0.3.
published:2025-03-31T13:15:47.437


Instruction: Please provide detailed information about CVE-2025-31535

CVE:CVE-2025-31535
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PressTigers Simple Owl Carousel allows DOM-Based XSS. This issue affects Simple Owl Carousel: from n/a through 1.1.1.
published:2025-03-31T13:15:47.580


Instruction: Please provide detailed information about CVE-2025-31538

CVE:CVE-2025-31538
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in checklistcom Checklist allows Stored XSS. This issue affects Checklist: from n/a through 1.1.9.
published:2025-03-31T13:15:47.730


Instruction: Please provide detailed information about CVE-2025-31539

CVE:CVE-2025-31539
Description:Missing Authorization vulnerability in Blocksera Cryptocurrency Widgets Pack allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Cryptocurrency Widgets Pack: from n/a through 2.0.1.
published:2025-03-31T13:15:47.880


Instruction: Please provide detailed information about CVE-2025-31540

CVE:CVE-2025-31540
Description:Missing Authorization vulnerability in acmemediakits ACME Divi Modules allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects ACME Divi Modules: from n/a through 1.3.5.
published:2025-03-31T13:15:48.047


Instruction: Please provide detailed information about CVE-2025-31542

CVE:CVE-2025-31542
Description:Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in wphocus My auctions allegro allows Blind SQL Injection. This issue affects My auctions allegro: from n/a through 3.6.20.
published:2025-03-31T13:15:48.203


Instruction: Please provide detailed information about CVE-2025-31543

CVE:CVE-2025-31543
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Twice Commerce Twice Commerce allows DOM-Based XSS. This issue affects Twice Commerce: from n/a through 1.3.1.
published:2025-03-31T13:15:48.360


Instruction: Please provide detailed information about CVE-2025-31544

CVE:CVE-2025-31544
Description:Missing Authorization vulnerability in WP Messiah Swiss Toolkit For WP allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Swiss Toolkit For WP: from n/a through 1.3.0.
published:2025-03-31T13:15:48.507


Instruction: Please provide detailed information about CVE-2025-31545

CVE:CVE-2025-31545
Description:Missing Authorization vulnerability in WP Messiah Safe Ai Malware Protection for WP allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Safe Ai Malware Protection for WP: from n/a through 1.0.20.
published:2025-03-31T13:15:48.673


Instruction: Please provide detailed information about CVE-2025-31546

CVE:CVE-2025-31546
Description:Missing Authorization vulnerability in WP Messiah Swiss Toolkit For WP allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Swiss Toolkit For WP: from n/a through 1.3.0.
published:2025-03-31T13:15:48.820


Instruction: Please provide detailed information about CVE-2025-31547

CVE:CVE-2025-31547
Description:Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Aphotrax Uptime Robot Plugin for WordPress allows SQL Injection. This issue affects Uptime Robot Plugin for WordPress: from n/a through 2.3.
published:2025-03-31T13:15:48.973


Instruction: Please provide detailed information about CVE-2025-31549

CVE:CVE-2025-31549
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Agency Dominion Inc. Fusion allows DOM-Based XSS. This issue affects Fusion: from n/a through 1.6.3.
published:2025-03-31T13:15:49.137


Instruction: Please provide detailed information about CVE-2025-31555

CVE:CVE-2025-31555
Description:Missing Authorization vulnerability in ContentMX ContentMX Content Publisher allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects ContentMX Content Publisher: from n/a through 1.0.6.
published:2025-03-31T13:15:49.307


Instruction: Please provide detailed information about CVE-2025-31556

CVE:CVE-2025-31556
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in IDX Broker IMPress for IDX Broker allows Stored XSS. This issue affects IMPress for IDX Broker: from n/a through 3.2.3.
published:2025-03-31T13:15:49.460


Instruction: Please provide detailed information about CVE-2025-31557

CVE:CVE-2025-31557
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MiKa OSM – OpenStreetMap allows DOM-Based XSS. This issue affects OSM – OpenStreetMap: from n/a through 6.1.6.
published:2025-03-31T13:15:49.613


Instruction: Please provide detailed information about CVE-2025-31559

CVE:CVE-2025-31559
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Caspio Bridge Custom Database Applications by Caspio allows DOM-Based XSS. This issue affects Custom Database Applications by Caspio: from n/a through 2.1.
published:2025-03-31T13:15:49.770


Instruction: Please provide detailed information about CVE-2025-31562

CVE:CVE-2025-31562
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Aphotrax Uptime Robot Plugin for WordPress allows DOM-Based XSS. This issue affects Uptime Robot Plugin for WordPress: from n/a through 2.3.
published:2025-03-31T13:15:49.920


Instruction: Please provide detailed information about CVE-2025-31566

CVE:CVE-2025-31566
Description:Cross-Site Request Forgery (CSRF) vulnerability in riosisgroup Rio Video Gallery allows Stored XSS. This issue affects Rio Video Gallery: from n/a through 2.3.6.
published:2025-03-31T13:15:50.073


Instruction: Please provide detailed information about CVE-2025-31567

CVE:CVE-2025-31567
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themesflat Themesflat Addons For Elementor allows Stored XSS. This issue affects Themesflat Addons For Elementor: from n/a through 2.2.5.
published:2025-03-31T13:15:50.227


Instruction: Please provide detailed information about CVE-2025-31569

CVE:CVE-2025-31569
Description:Cross-Site Request Forgery (CSRF) vulnerability in wp-buy wordpress related Posts with thumbnails allows Stored XSS. This issue affects wordpress related Posts with thumbnails: from n/a through 3.0.0.1.
published:2025-03-31T13:15:50.367


Instruction: Please provide detailed information about CVE-2025-31570

CVE:CVE-2025-31570
Description:Cross-Site Request Forgery (CSRF) vulnerability in wp-buy Related Posts Widget with Thumbnails allows Stored XSS. This issue affects Related Posts Widget with Thumbnails: from n/a through 1.2.
published:2025-03-31T13:15:50.507


Instruction: Please provide detailed information about CVE-2025-31572

CVE:CVE-2025-31572
Description:Cross-Site Request Forgery (CSRF) vulnerability in v20202020 Multi Days Events and Multi Events in One Day Calendar allows Cross Site Request Forgery. This issue affects Multi Days Events and Multi Events in One Day Calendar: from n/a through 1.1.3.
published:2025-03-31T13:15:50.657


Instruction: Please provide detailed information about CVE-2025-31574

CVE:CVE-2025-31574
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SoftHopper Custom Content Scrollbar allows Stored XSS. This issue affects Custom Content Scrollbar: from n/a through 1.3.
published:2025-03-31T13:15:50.793


Instruction: Please provide detailed information about CVE-2025-31575

CVE:CVE-2025-31575
Description:Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Vasilis Triantafyllou Flag Icons allows Stored XSS. This issue affects Flag Icons: from n/a through 2.2.
published:2025-03-31T13:15:50.930


Instruction: Please provide detailed information about CVE-2025-31576

CVE:CVE-2025-31576
Description:Missing Authorization vulnerability in Gagan Deep Singh PostmarkApp Email Integrator allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects PostmarkApp Email Integrator: from n/a through 2.4.
published:2025-03-31T13:15:51.090


Instruction: Please provide detailed information about CVE-2025-31577

CVE:CVE-2025-31577
Description:Unrestricted Upload of File with Dangerous Type vulnerability in appointify Appointify allows Upload a Web Shell to a Web Server. This issue affects Appointify: from n/a through 1.0.8.
published:2025-03-31T13:15:51.240


Instruction: Please provide detailed information about CVE-2025-31583

CVE:CVE-2025-31583
Description:Cross-Site Request Forgery (CSRF) vulnerability in Ashish Ajani WP Copy Media URL allows Stored XSS. This issue affects WP Copy Media URL: from n/a through 2.1.
published:2025-03-31T13:15:51.407


Instruction: Please provide detailed information about CVE-2025-31584

CVE:CVE-2025-31584
Description:Missing Authorization vulnerability in elfsight Elfsight Testimonials Slider allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Elfsight Testimonials Slider: from n/a through 1.0.1.
published:2025-03-31T13:15:51.547


Instruction: Please provide detailed information about CVE-2025-31585

CVE:CVE-2025-31585
Description:Cross-Site Request Forgery (CSRF) vulnerability in leadfox Leadfox for WordPress allows Cross Site Request Forgery. This issue affects Leadfox for WordPress: from n/a through 2.1.8.
published:2025-03-31T13:15:51.710


Instruction: Please provide detailed information about CVE-2025-31586

CVE:CVE-2025-31586
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GhozyLab Gallery – Photo Albums Plugin allows Stored XSS. This issue affects Gallery – Photo Albums Plugin: from n/a through 1.3.170.
published:2025-03-31T13:15:51.863


Instruction: Please provide detailed information about CVE-2025-31587

CVE:CVE-2025-31587
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in elfsight Elfsight Testimonials Slider allows Stored XSS. This issue affects Elfsight Testimonials Slider: from n/a through 1.0.1.
published:2025-03-31T13:15:52.013


Instruction: Please provide detailed information about CVE-2025-31588

CVE:CVE-2025-31588
Description:Cross-Site Request Forgery (CSRF) vulnerability in elfsight Elfsight Testimonials Slider allows Cross Site Request Forgery. This issue affects Elfsight Testimonials Slider: from n/a through 1.0.1.
published:2025-03-31T13:15:52.163


Instruction: Please provide detailed information about CVE-2025-31589

CVE:CVE-2025-31589
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kibru Demeke Ethiopian Calendar allows Stored XSS. This issue affects Ethiopian Calendar: from n/a through 1.1.1.
published:2025-03-31T13:15:52.310


Instruction: Please provide detailed information about CVE-2025-31590

CVE:CVE-2025-31590
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Denra.com WP Date and Time Shortcode allows Stored XSS. This issue affects WP Date and Time Shortcode: from n/a through 2.6.7.
published:2025-03-31T13:15:52.487


Instruction: Please provide detailed information about CVE-2025-31591

CVE:CVE-2025-31591
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in promoz73 Exit Popup Free allows Stored XSS. This issue affects Exit Popup Free: from n/a through 1.0.
published:2025-03-31T13:15:52.643


Instruction: Please provide detailed information about CVE-2025-31592

CVE:CVE-2025-31592
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Paolo Melchiorre Send E-mail allows Stored XSS. This issue affects Send E-mail: from n/a through 1.3.
published:2025-03-31T13:15:52.790


Instruction: Please provide detailed information about CVE-2025-31593

CVE:CVE-2025-31593
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in OpenMenu OpenMenu allows Stored XSS. This issue affects OpenMenu: from n/a through 3.5.
published:2025-03-31T13:15:52.937


Instruction: Please provide detailed information about CVE-2025-31595

CVE:CVE-2025-31595
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpdiscover Timeline Event History allows Stored XSS. This issue affects Timeline Event History: from n/a through 3.2.
published:2025-03-31T13:15:53.087


Instruction: Please provide detailed information about CVE-2025-31596

CVE:CVE-2025-31596
Description:Missing Authorization vulnerability in Chatwee Chat by Chatwee allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Chat by Chatwee: from n/a through 2.1.3.
published:2025-03-31T13:15:53.240


Instruction: Please provide detailed information about CVE-2025-31597

CVE:CVE-2025-31597
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in crazycric Ultimate Live Cricket WordPress Lite allows Stored XSS. This issue affects Ultimate Live Cricket WordPress Lite: from n/a through 1.4.2.
published:2025-03-31T13:15:53.377


Instruction: Please provide detailed information about CVE-2025-31598

CVE:CVE-2025-31598
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFactory Quantity Dynamic Pricing & Bulk Discounts for WooCommerce allows Stored XSS. This issue affects Quantity Dynamic Pricing & Bulk Discounts for WooCommerce: from n/a through 4.0.0.
published:2025-03-31T13:15:53.520


Instruction: Please provide detailed information about CVE-2025-31600

CVE:CVE-2025-31600
Description:Cross-Site Request Forgery (CSRF) vulnerability in designnbuy DesignO allows Cross Site Request Forgery. This issue affects DesignO: from n/a through 2.2.0.
published:2025-03-31T13:15:53.667


Instruction: Please provide detailed information about CVE-2025-31601

CVE:CVE-2025-31601
Description:Cross-Site Request Forgery (CSRF) vulnerability in appointy Appointy Appointment Scheduler allows Cross Site Request Forgery. This issue affects Appointy Appointment Scheduler: from n/a through 4.2.1.
published:2025-03-31T13:15:53.843


Instruction: Please provide detailed information about CVE-2025-31602

CVE:CVE-2025-31602
Description:Cross-Site Request Forgery (CSRF) vulnerability in apimofficiel Apimo Connector allows Cross Site Request Forgery. This issue affects Apimo Connector: from n/a through 2.6.3.1.
published:2025-03-31T13:15:53.993


Instruction: Please provide detailed information about CVE-2025-31603

CVE:CVE-2025-31603
Description:Missing Authorization vulnerability in moshensky CF7 Spreadsheets allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects CF7 Spreadsheets: from n/a through 2.3.2.
published:2025-03-31T13:15:54.133


Instruction: Please provide detailed information about CVE-2025-31604

CVE:CVE-2025-31604
Description:Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Cal.com Cal.com allows Stored XSS. This issue affects Cal.com: from n/a through 1.0.0.
published:2025-03-31T13:15:54.273


Instruction: Please provide detailed information about CVE-2025-31605

CVE:CVE-2025-31605
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WeblineIndia Welcome Popup allows Stored XSS. This issue affects Welcome Popup: from n/a through 1.0.10.
published:2025-03-31T13:15:54.407


Instruction: Please provide detailed information about CVE-2025-31606

CVE:CVE-2025-31606
Description:Missing Authorization vulnerability in softpulseinfotech SP Blog Designer allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects SP Blog Designer: from n/a through 1.0.0.
published:2025-03-31T13:15:54.547


Instruction: Please provide detailed information about CVE-2025-31607

CVE:CVE-2025-31607
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in flomei Simple-Audioplayer allows Stored XSS. This issue affects Simple-Audioplayer: from n/a through 1.1.
published:2025-03-31T13:15:54.703


Instruction: Please provide detailed information about CVE-2025-31608

CVE:CVE-2025-31608
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in reDim GmbH CookieHint WP allows Stored XSS. This issue affects CookieHint WP: from n/a through 1.0.0.
published:2025-03-31T13:15:54.850


Instruction: Please provide detailed information about CVE-2025-31609

CVE:CVE-2025-31609
Description:Missing Authorization vulnerability in Arni Cinco WPCargo Track & Trace allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WPCargo Track & Trace: from n/a through 7.0.6.
published:2025-03-31T13:15:54.983


Instruction: Please provide detailed information about CVE-2025-31610

CVE:CVE-2025-31610
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in gingerplugins Notification Bar, Sticky Notification Bar, Sticky Welcome Bar for any theme allows Stored XSS. This issue affects Notification Bar, Sticky Notification Bar, Sticky Welcome Bar for any theme: from n/a through 1.1.
published:2025-03-31T13:15:55.130


Instruction: Please provide detailed information about CVE-2025-31611

CVE:CVE-2025-31611
Description:Missing Authorization vulnerability in Shaharia Azam Auto Post After Image Upload allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Auto Post After Image Upload: from n/a through 1.6.
published:2025-03-31T13:15:55.283


Instruction: Please provide detailed information about CVE-2025-31613

CVE:CVE-2025-31613
Description:Cross-Site Request Forgery (CSRF) vulnerability in Aboobacker. AB Google Map Travel  allows Cross Site Request Forgery. This issue affects AB Google Map Travel : from n/a through 4.6.
published:2025-03-31T13:15:55.430


Instruction: Please provide detailed information about CVE-2025-31614

CVE:CVE-2025-31614
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hiroprot Terms Before Download allows Stored XSS. This issue affects Terms Before Download: from n/a through 1.0.4.
published:2025-03-31T13:15:55.577


Instruction: Please provide detailed information about CVE-2025-31615

CVE:CVE-2025-31615
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in owenr88 Simple Contact Forms allows Stored XSS. This issue affects Simple Contact Forms: from n/a through 1.6.4.
published:2025-03-31T13:15:55.710


Instruction: Please provide detailed information about CVE-2025-31616

CVE:CVE-2025-31616
Description:Cross-Site Request Forgery (CSRF) vulnerability in AdminGeekZ Varnish WordPress allows Cross Site Request Forgery. This issue affects Varnish WordPress: from n/a through 1.7.
published:2025-03-31T13:15:55.853


Instruction: Please provide detailed information about CVE-2025-31617

CVE:CVE-2025-31617
Description:Cross-Site Request Forgery (CSRF) vulnerability in Gagan Deep Singh PostmarkApp Email Integrator allows Cross Site Request Forgery. This issue affects PostmarkApp Email Integrator: from n/a through 2.4.
published:2025-03-31T13:15:55.993


Instruction: Please provide detailed information about CVE-2025-31618

CVE:CVE-2025-31618
Description:Missing Authorization vulnerability in Jaap Jansma Connector to CiviCRM with CiviMcRestFace allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Connector to CiviCRM with CiviMcRestFace: from n/a through 1.0.9.
published:2025-03-31T13:15:56.137


Instruction: Please provide detailed information about CVE-2025-31620

CVE:CVE-2025-31620
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in carperfer CoverManager allows Stored XSS. This issue affects CoverManager: from n/a through 0.0.1.
published:2025-03-31T13:15:56.283


Instruction: Please provide detailed information about CVE-2025-31621

CVE:CVE-2025-31621
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in davidpaulsson byBrick Accordion allows Stored XSS. This issue affects byBrick Accordion: from n/a through 1.0.
published:2025-03-31T13:15:56.413


Instruction: Please provide detailed information about CVE-2025-31623

CVE:CVE-2025-31623
Description:Cross-Site Request Forgery (CSRF) vulnerability in richtexteditor Rich Text Editor allows Stored XSS. This issue affects Rich Text Editor: from n/a through 1.0.1.
published:2025-03-31T13:15:56.560


Instruction: Please provide detailed information about CVE-2025-31624

CVE:CVE-2025-31624
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LABCAT Processing Projects allows DOM-Based XSS. This issue affects Processing Projects: from n/a through 1.0.2.
published:2025-03-31T13:15:56.710


Instruction: Please provide detailed information about CVE-2025-31625

CVE:CVE-2025-31625
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ramanparashar Useinfluence allows Stored XSS. This issue affects Useinfluence: from n/a through 1.0.8.
published:2025-03-31T13:15:56.863


Instruction: Please provide detailed information about CVE-2025-31627

CVE:CVE-2025-31627
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Lingren Media Library Assistant allows Stored XSS. This issue affects Media Library Assistant: from n/a through 3.24.
published:2025-03-31T13:15:57.007


Instruction: Please provide detailed information about CVE-2025-31629

CVE:CVE-2025-31629
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jacob Allred Infusionsoft Web Form JavaScript allows Stored XSS. This issue affects Infusionsoft Web Form JavaScript: from n/a through 1.1.1.
published:2025-03-31T13:15:57.153


Instruction: Please provide detailed information about CVE-2025-2997

CVE:CVE-2025-2997
Description:A vulnerability was found in zhangyanbo2007 youkefu 4.2.0. It has been classified as critical. Affected is an unknown function of the file /res/url. The manipulation of the argument url leads to server-side request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
published:2025-03-31T14:15:20.137


Instruction: Please provide detailed information about CVE-2025-2998

CVE:CVE-2025-2998
Description:A vulnerability was found in PyTorch 2.6.0. It has been declared as critical. Affected by this vulnerability is the function torch.nn.utils.rnn.pad_packed_sequence. The manipulation leads to memory corruption. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used.
published:2025-03-31T14:15:20.370


Instruction: Please provide detailed information about CVE-2025-22937

CVE:CVE-2025-22937
Description:An issue in Adtran 411 ONT vL80.00.0011.M2 allows attackers to escalate privileges via unspecified vectors.
published:2025-03-31T15:15:43.417


Instruction: Please provide detailed information about CVE-2025-22938

CVE:CVE-2025-22938
Description:Adtran 411 ONT L80.00.0011.M2 was discovered to contain weak default passwords.
published:2025-03-31T15:15:43.530


Instruction: Please provide detailed information about CVE-2025-22939

CVE:CVE-2025-22939
Description:A command injection vulnerability in the telnet service of Adtran 411 ONT L80.00.0011.M2 allows attackers to escalate privileges to root and execute arbitrary commands.
published:2025-03-31T15:15:43.650


Instruction: Please provide detailed information about CVE-2025-22940

CVE:CVE-2025-22940
Description:Incorrect access control in Adtran 411 ONT L80.00.0011.M2 allows unauthorized attackers to arbitrarily set the admin password.
published:2025-03-31T15:15:43.763


Instruction: Please provide detailed information about CVE-2025-22941

CVE:CVE-2025-22941
Description:A command injection vulnerability in the web interface of Adtran 411 ONT L80.00.0011.M2 allows attackers to escalate privileges to root and execute arbitrary commands.
published:2025-03-31T15:15:43.873


Instruction: Please provide detailed information about CVE-2025-2999

CVE:CVE-2025-2999
Description:A vulnerability was found in PyTorch 2.6.0. It has been rated as critical. Affected by this issue is the function torch.nn.utils.rnn.unpack_sequence. The manipulation leads to memory corruption. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used.
published:2025-03-31T15:15:44.657


Instruction: Please provide detailed information about CVE-2025-30095

CVE:CVE-2025-30095
Description:VyOS 1.3 through 1.5 (fixed in 1.4.2) or any Debian-based system using dropbear in combination with live-build has the same Dropbear private host keys across different installations. Thus, an attacker can conduct active man-in-the-middle attacks against SSH connections if Dropbear is enabled as the SSH daemon. I n VyOS, this is not the default configuration for the system SSH daemon, but is for the console service. To mitigate this, one can run "rm -f /etc/dropbear/*key*" and/or "rm -f /etc/dropbear-initramfs/*key*" and then dropbearkey -t rsa -s 4096 -f /etc/dropbear_rsa_host_key and reload the service or reboot the system before using Dropbear as the SSH daemon (this clears out all keys mistakenly built into the release image) or update to the latest version of VyOS 1.4 or 1.5. Note that this vulnerability is not unique to VyOS and may appear in any Debian-based Linux distribution that uses Dropbear in combination with live-build, which has a safeguard against this behavior in OpenSSH but no equivalent one for Dropbear.
published:2025-03-31T15:15:44.843


Instruction: Please provide detailed information about CVE-2025-3000

CVE:CVE-2025-3000
Description:A vulnerability classified as critical has been found in PyTorch 2.6.0. This affects the function torch.jit.script. The manipulation leads to memory corruption. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used.
published:2025-03-31T15:15:46.297


Instruction: Please provide detailed information about CVE-2025-1449

CVE:CVE-2025-1449
Description:A vulnerability exists in the Rockwell Automation Verve Asset Manager due to insufficient variable sanitizing. A portion of the administrative web interface for Verve's Legacy Agentless Device Inventory (ADI) capability (deprecated since the 1.36 release) allows users to change a variable with inadequate sanitizing. If exploited, it could allow a threat actor with administrative access to run arbitrary commands in the context of the container running the service.
published:2025-03-31T16:15:22.770


Instruction: Please provide detailed information about CVE-2025-27095

CVE:CVE-2025-27095
Description:JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to 4.8.0 and 3.10.18, an attacker with a low-privileged account can access the Kubernetes session feature and manipulate the kubeconfig file to redirect API requests to an external server controlled by the attacker. This allows the attacker to intercept and capture the Kubernetes cluster token. This can potentially allow unauthorized access to the cluster and compromise its security. This vulnerability is fixed in 4.8.0 and 3.10.18.
published:2025-03-31T16:15:23.493