Explore CVE records

MedPublished 26 Jun 2025, 13:04 WIB

CVE-2025-48497

Cross-site request forgery vulnerability exists in iroha Board versions v0.10.12 and earlier. If a user accesses a specially crafted URL while being logged in to the affected product, arbitrary learning histories may be registered.

Excerpt language: en.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated26 Jun 2025, 20:33 WIB

Official record

MedPublished 26 Jun 2025, 13:04 WIB

CVE-2025-41404

Direct request ('Forced Browsing') issue exists in iroha Board versions v0.10.12 and earlier. If this vulnerability is exploited, non-public contents may be viewed by an attacker who can log in to the affected product.

Excerpt language: en.

MedPublished 26 Jun 2025, 12:31 WIB

CVE-2025-1754

Missing Authentication for Critical Function in GitLab

An issue has been discovered in GitLab CE/EE affecting all versions from 17.2 before 17.11.5, 18.0 before 18.0.3, and 18.1 before 18.1.1 that could have allowed unauthenticated attackers to upload arbitrary files to public projects by sending crafted API requests, potentially leading to resource abuse and unauthorized …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated26 Jun 2025, 20:19 WIB

Official record

LowPublished 26 Jun 2025, 12:31 WIB

CVE-2025-2938

Business Logic Errors in GitLab

An issue has been discovered in GitLab CE/EE affecting all versions from 17.3 before 17.11.5, 18.0 before 18.0.3, and 18.1 before 18.1.1 that could have allowed authenticated users to gain elevated project privileges by requesting access to projects where role modifications during the approval process resulted in unint…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS3.1v3.1KEVNot listedEPSSPresentUpdated27 Feb 2026, 00:50 WIB

Official record

MedPublished 26 Jun 2025, 12:31 WIB

CVE-2025-3279

Allocation of Resources Without Limits or Throttling in GitLab

An issue has been discovered in GitLab CE/EE affecting all versions from 10.7 before 17.11.5, 18.0 before 18.0.3, and 18.1 before 18.1.1 that could have allowed authenticated attackers to create a DoS condition by sending crafted GraphQL requests.

Excerpt language: en.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated26 Jun 2025, 20:22 WIB

Official record

MedPublished 26 Jun 2025, 12:31 WIB

CVE-2025-5315

Missing Authorization in GitLab

An issue has been discovered in GitLab CE/EE affecting all versions from 17.2 before 17.11.5, 18.0 before 18.0.3, and 18.1 before 18.1.1 that could have allowed authenticated users with Guest role permissions to add child items to incident work items by sending crafted API requests that bypassed UI-enforced role restri…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated26 Jun 2025, 20:22 WIB

Official record

LowPublished 26 Jun 2025, 12:31 WIB

CVE-2025-5846

Missing Authorization in GitLab

An issue has been discovered in GitLab EE affecting all versions from 16.10 before 17.11.5, 18.0 before 18.0.3, and 18.1 before 18.1.1 that could have allowed authenticated users to assign unrelated compliance frameworks to projects by sending crafted GraphQL mutations that bypassed framework-specific permission checks…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS2.7v3.1KEVNot listedEPSSPresentUpdated26 Jun 2025, 20:22 WIB

Official record

HighPublished 26 Jun 2025, 12:19 WIB

CVE-2025-37101

HPE OneView for VMware vCenter (OV4VC), Local Elevation of Privilege

A potential security vulnerability has been identified in HPE OneView for VMware vCenter (OV4VC). This vulnerability could be exploited allowing an attacker with read only privilege to cause Vertical Privilege Escalation (operator can perform admin actions).

Excerpt language: en.

CVSS8.7v3.1KEVNot listedEPSSPresentUpdated27 Feb 2026, 00:50 WIB

Official record

HighPublished 26 Jun 2025, 12:00 WIB

CVE-2025-6624

Versions of the package snyk before 1.1297.3 are vulnerable to Insertion of Sensitive Information into Log File through local Snyk CLI debug logs. Container Registry credentials provided via environment variables or command line arguments can be exposed when executing Snyk CLI in DEBUG or DEBUG/TRACE mode. The issue a…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS7.2v3.1KEVNot listedEPSSPresentUpdated26 Jun 2025, 20:32 WIB

Official record

MedPublished 26 Jun 2025, 09:22 WIB

CVE-2025-6540

web-cam <= 3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via slug Parameter

The web-cam plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘slug’ parameter in all versions up to, and including, 3.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary we…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS6.4v3.1KEVNot listedEPSSPresentUpdated09 Apr 2026, 00:25 WIB

Official record

MedPublished 26 Jun 2025, 09:22 WIB

CVE-2025-5813

Amazon Products to WooCommerce <= 1.2.7 - Missing Authorization to Unauthenticated Arbitrary Product Creation

The Amazon Products to WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wcta2w_get_amazon_product_callback() function in all versions up to, and including, 1.2.7. This makes it possible for unauthenticated attackers to create new produces.

Excerpt language: en.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated09 Apr 2026, 00:12 WIB

Official record

MedPublished 26 Jun 2025, 09:22 WIB

CVE-2025-6546

Drive Folder Embedder <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via tablecssclass Parameter

The Drive Folder Embedder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘tablecssclass’ parameter in all versions up to, and including, 1.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and abov…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS6.4v3.1KEVNot listedEPSSPresentUpdated09 Apr 2026, 00:04 WIB

Official record

MedPublished 26 Jun 2025, 09:22 WIB

CVE-2025-5275

Charitable <= 1.8.6.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin's Privacy Settings

The Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the privacy settings fields in all versions up to, and including, 1.8.6.1 due to insufficient input sanitization and output escaping. This makes it possible …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS4.4v3.1KEVNot listedEPSSPresentUpdated08 Apr 2026, 23:49 WIB

Official record

MedPublished 26 Jun 2025, 09:22 WIB

CVE-2025-6537

Namasha By Mdesign <= 1.2.00 - Authenticated (Contributor+) Stored Cross-Site Scripting via playicon_title Parameter

The Namasha By Mdesign plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘playicon_title’ parameter in all versions up to, and including, 1.2.00 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS6.4v3.1KEVNot listedEPSSPresentUpdated29 Jul 2026, 21:45 WIB

Official record

MedPublished 26 Jun 2025, 09:22 WIB

CVE-2025-5932

Homerunner <= 1.0.30 - Cross-Site Request Forgery to Settings Update

The Homerunner plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.30. This is due to missing or incorrect nonce validation on the main_settings() function. This makes it possible for unauthenticated attackers to update plugin settings via a forged request granted …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated29 Jul 2026, 21:43 WIB

Official record

MedPublished 26 Jun 2025, 09:22 WIB

CVE-2025-5929

The Countdown <= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via clientId Parameter

The The Countdown plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘clientId’ parameter in all versions up to, and including, 2.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS6.4v3.1KEVNot listedEPSSPresentUpdated08 Apr 2026, 23:45 WIB

Official record

MedPublished 26 Jun 2025, 09:06 WIB

CVE-2025-5559

TimeZoneCalculator <= 3.37 - Authenticated (Contributor+) Stored Cross-Site Scripting

The TimeZoneCalculator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'timezonecalculator_output' shortcode in all versions up to, and including, 3.37 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated atta…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS6.4v3.1KEVNot listedEPSSPresentUpdated09 Apr 2026, 00:32 WIB

Official record

MedPublished 26 Jun 2025, 09:06 WIB

CVE-2025-5540

Event RSVP and Simple Event Management Plugin <= 4.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Event RSVP and Simple Event Management Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'emd_mb_meta' shortcode in all versions up to, and including, 4.1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for auth…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS6.4v3.1KEVNot listedEPSSPresentUpdated29 Jul 2026, 21:42 WIB

Official record

MedPublished 26 Jun 2025, 09:06 WIB

CVE-2025-6258

WP SoundSystem <= 3.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpsstm-track Shortcode

The WP SoundSystem plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpsstm-track shortcode in all versions up to, and including, 3.4.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contri…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS6.4v3.1KEVNot listedEPSSPresentUpdated09 Apr 2026, 00:32 WIB

Official record

MedPublished 26 Jun 2025, 09:06 WIB

CVE-2025-5564

GC Social wall <= 1.15 - Authenticated (Contributor+) Stored Cross-Site Scripting

The GC Social Wall plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'gc_social_wall' shortcode in all versions up to, and including, 1.15 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with con…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS6.4v3.1KEVNot listedEPSSPresentUpdated09 Apr 2026, 00:24 WIB

Official record

Find the CVE cohort

Severity

Matching records by UTC month

Signal coverage

Find the CVE cohort

Matching cohort composition

Severity

Matching records by UTC month

Signal coverage