Information Disclosure

A flaw was found in ansible-collection-community-general. This vulnerability allows for information exposure (IE) of sensitive credentials, specifically plaintext passwords, via verbose output when running Ansible with debug modes. Attackers with access to logs could retrieve these secrets and potentially compromise Keycloak accounts or administrative access.

Unauthenticated attackers can access configuration files from WordPress sites running the WebP Express plugin (≤0.25.9) on NGINX because the plugin generates predictable config file names, potentially exposing sensitive settings. No active exploitation or public exploit code has been identified, and the EPSS score of 0.06% indicates a low probability of exploitation.

LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. Prior to 1.6.52, an out-of-bounds read vulnerability in libpng's simplified API allows reading up to 1012 bytes beyond the png_sRGB_base[512] array when processing valid palette PNG images with partial transparency and gamma correction. The PNG files that trigger this vulnerability are valid per the PNG specification; the bug is in libpng's internal state management. Upgrade to libpng 1.6.52 or later.

Coder allows organizations to provision remote development environments via Terraform. Prior to 2.26.5, 2.27.7, and 2.28.4, Workspace Agent manifests containing sensitive values were logged in plaintext unsanitized. An attacker with limited local access to the Coder Workspace (VM, K8s Pod etc.) or a third-party system (SIEM, logging stack) could access those logs. This vulnerability is fixed in 2.26.5, 2.27.7, and 2.28.4.

An excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate. For example a constraint that excludes the subdomain test.example.com does not prevent a leaf certificate from claiming the SAN *.example.com.

Envoy is a high-performance edge/middle/service proxy. In 1.33.12, 1.34.10, 1.35.6, 1.36.2, and earlier, Envoy’s mTLS certificate matcher for match_typed_subject_alt_names may incorrectly treat certificates containing an embedded null byte (\0) inside an OTHERNAME SAN value as valid matches.

NVIDIA TAO contains a vulnerability where an attacker may cause a resource to be loaded via an uncontrolled search path. A successful exploit of this vulnerability may lead to escalation of privileges, data tampering, denial of service, information disclosure.

Side-channel information leakage in Navigation and Loading in Google Chrome prior to 139.0.7258.66 allowed a remote attacker to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium)

Untrusted search path in auth_query connection handler in PgBouncer before 1.25.1 allows an unauthenticated attacker to execute arbitrary SQL during authentication via a malicious search_path parameter in the StartupMessage.

CVE-2025-12084 is a security vulnerability (CVSS 5.3). Remediation should follow standard vulnerability management procedures. Vendor patch is available.

Rejected reason: This CVE is a duplicate of CVE-2025-55182. Public exploit code available and no vendor patch available.

Envoy is a high-performance edge/middle/service proxy. In 1.33.12, 1.34.10, 1.35.6, 1.36.2, and earlier, when Envoy is configured in TCP proxy mode to handle CONNECT requests, it accepts client data before issuing a 2xx response and forwards that data to the upstream TCP connection. If a forwarding proxy upstream from Envoy then responds with a non-2xx status, this can cause a de-synchronized CONNECT tunnel state. By default Envoy continues to allow early CONNECT data to avoid disrupting existing deployments. The envoy.reloadable_features.reject_early_connect_data runtime flag can be set to reject CONNECT requests that send data before a 2xx response when intermediaries upstream from Envoy may reject establishment of a CONNECT tunnel.

A security vulnerability in MCP Gateway (CVSS 9.6). Critical severity with potential for significant impact on affected systems. Vendor patch is available.

In Splunk Universal Forwarder for Windows versions below 10.0.2, 9.4.6, 9.3.8, and 9.2.10, a new installation of or an upgrade to an affected version can result in incorrect permissions assignment in the Universal Forwarder for Windows Installation directory. This lets non-administrator users on the machine access the directory and all its contents.

In Splunk Enterprise for Windows versions below 10.0.2, 9.4.6, 9.3.8, and 9.2.10, a new installation of or an upgrade to an affected version can result in incorrect permissions assignment in the Splunk Enterprise for Windows Installation directory. This lets non-administrator users on the machine access the directory and all its contents.

A security vulnerability in Splunk Enterprise (CVSS 5.3) that allows them. Remediation should follow standard vulnerability management procedures.

In Splunk Enterprise versions below 10.0.2, 9.4.6, 9.3.8, and 9.2.10, and below 3.9.10, 3.8.58, and 3.7.28 of Splunk Secure Gateway app in Splunk Cloud Platform, a low-privileged user that does not hold the "admin" or "power" Splunk roles and subscribes to mobile push notifications could receive notifications that disclose the title and description of the report or alert even if they do not have access to view the report or alert.

Masa CMS is an open source Enterprise Content Management platform. Prior to 7.2.8, 7.3.13, and 7.4.6, there is vulnerable to host header poisoning which allows account takeover via password reset email. This vulnerability is fixed in 7.2.8, 7.3.13, and 7.4.6.

Abacre Restaurant Point of Sale (POS) up to 15.0.0.1656 are vulnerable to Cleartext Storage of Sensitive Information in Memory. The application leaves valid device-bound license keys in process memory during an activation attempt.

A security vulnerability in opsre go-ldap-admin (CVSS 5.6). Remediation should follow standard vulnerability management procedures.

CVE-2025-39665 is a security vulnerability (CVSS 5.3) that allows an unauthenticated attacker. Remediation should follow standard vulnerability management procedures. Vendor patch is available.

We are asked: "Synthesize data from MULTIPLE intelligence sources about a CVE into a comprehensive analysis. Return a JSON object." The provided data includes: CVE-2025-13947, description, CVSS 3.1 vector, CWE, EPSS, tags, patch status, EUVD affected versions, Ubuntu/USN, Debian, references. We need to produce the JSON with the specified fields. I'll analyze each field based on the input data. 1. product_name: "1-3 words ONLY. The specific product or service name affected." It's WebKitGTK. So product_name: "WebKitGTK" 2. summary: "2-3 sentence plain-language summary for security professionals. CRITICAL: Do NOT copy or paraphrase the Description — write an original synthesis using all available data. Do NOT start with 'A vulnerability', 'A problem', 'A flaw', or 'An issue'. Start with the specific impact verb and product, e.g. 'Remote code execution in Apache Tomcat 9.x allows...' or 'Cortex XDR agent on macOS can be disabled by local admins via...'. Explain WHAT the vulnerability is, WHO is affected (specific product/version), and WHAT an attacker can do. Mention if actively exploited (KEV), if POC exists, and EPSS risk if notable." We need to synthesize. Description: "A flaw was found in WebKitGTK. This vulnerability allows remote, user-assisted information disclosure that can reveal any file the user is permitted to read via abusing the file drag-and-drop mechanism where WebKitGTK does not verify that drag operations originate from outside the browser." So impact is information disclosure, user-assisted (requires user interaction). Affected: WebKitGTK versions before 2.50.3 (from EUVD). Not in KEV, so not actively exploited. EPSS 0.06% (low). No POC mentioned, so "no public exploit identified at time of analysis". I'll craft a summary: "Information disclosure in WebKitGTK allows remote attackers to read arbitrary files via a crafted drag-and-drop operation. The flaw arises because WebKitGTK does not verify that drag operations originate from outside the browser, enabling a malicious website to trick a user into dragging a file into the browser window to reveal its contents. This user-assisted vulnerability affects all WebKitGTK versions prior to 2.50.3." That's three sentences. Keep it plain language. 3. technical_context: "Explain the underlying technology/library/protocol involved. Use CPE data to identify exact affected products. Reference the CWE to explain the root cause class. Be specific and educational." We don't have explicit CPE strings, but the affected product is WebKitGTK. Underlying technology: WebKitGTK is a port of the WebKit web rendering engine for GTK. The issue is in the drag-and-drop functionality, where the browser fails to verify the origin of drag operations. CWE-346: Origin Validation Error. So root cause: missing origin validation in drag-and-drop handling. So technical_context: "WebKitGTK is a web rendering engine integrated into GTK-based applications. The vulnerability resides in how WebKitGTK handles file drag-and-drop events. CWE-346 (Origin Validation Error) indicates that the browser does not properly verify that a drag operation was initiated by an external source (e.g., the user's file manager) rather than being faked by a malicious web page. This lack of origin validation allows a crafted page to simulate a file drop, causing the browser to read and potentially leak local files. The affected component is the drag-and-drop event processing pipeline, specifically the cross-origin drag verification step." 4. risk_assessment: "Assess real-world risk using ALL available signals: CVSS vector (attack vector, complexity, privileges), EPSS exploitation probability, KEV status, POC availability, SSVC decision framework (exploitation status, automatable, technical impact). Compare and contrast these signals. Is this a real priority or just a high-CVSS-but-low-real-risk issue? If any key data is missing or conflicting, STATE IT EXPLICITLY, e.g.: 'CVSS indicates network vector but description implies local access — verify with vendor.' or 'EPSS score is low despite KEV listing, suggesting targeted rather than widespread exploitation.' Do NOT present uncertain information as confirmed fact." CVSS: 7.4, AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N. So network attack, low complexity, no privileges, user interaction required, scope changed, high confidentiality impact, no integrity/availability. EPSS: 0.06% (low probability of exploitation). No KEV, no mention of POC, not publicly exploited. So risk: requires user interaction (drag-and-drop), which limits exploitability. Not automatable in a scalable way because user must perform a drag action. Technical impact is high confidentiality (arbitrary file read). SSVC: Exploitation status: none (no active exploitation), Automatable: no (requires user interaction, not fully automatable without user action), Technical Impact: partial (information disclosure). Overall, a medium priority, not critical due to user interaction and low exploitation likelihood. No contradictory signals; CVSS and EPSS align: high CVSS but low EPSS suggests theoretical severity but low real-world exploitation. So risk_assessment: "The CVSS 3.1 score of 7.4 reflects a high confidentiality impact but is contingent on user interaction (UI:R). The EPSS score of 0.06% indicates a very low probability of exploitation in the wild. No active exploitation (not in CISA KEV) and no public exploit code have been identified. The attack requires a user to be tricked into performing a drag-and-drop operation into a browser window, which significantly reduces the feasibility of automated mass exploitation. While the technical impact of arbitrary file read is severe, the real-world risk is moderate due to the high level of social engineering required. This is a case of high CVSS score but low real-world urgency." I'll note the missing POC and KEV explicitly. "No public exploit identified" already covered. No conflicting data. 5. affected_products: "Write a concise paragraph listing affected products with their versions. Include product name, version range, CPE if available, and link to vendor advisory from references. Do NOT use bullet points, JSON, or key-value formatting." Given EUVD list: "webkitgtk 0 <2.50.3" then many Red Hat Enterprise Linux versions with specific patched versions. So I'll say: "WebKitGTK versions prior to 2.50.3 are affected. Red Hat has released updates for multiple Enterprise Linux streams: RHEL 7 Extended Lifecycle Support (2.50.3-2.el7_9), RHEL 8 (2.50.3-1.el8_10), RHEL 9 (2.50.3-1.el9_7), and various EUS/AUS/SAP solutions. See Red Hat advisories: RHSA-2025:22789, RHSA-2025:22790, RHSA-2025:23110, RHSA-2025:23433, RHSA-2025:23434, RHSA-2025:23451, RHSA-2025:23452, RHSA-2025:23583, RHSA-2025:23591, RHSA-2025:23742, RHSA-2025:23743. Ubuntu and Debian have also issued updates (USN-7941-1, DLA-4399-1, DSA-6074-1)." I'll incorporate advisory URLs from references? The references list includes many Red Hat errata links; I'll mention the advisory IDs. I'll write a paragraph. 6. remediation: "Write a concise paragraph with actionable remediation steps. Start with the primary fix (patch/upgrade with exact version), then mention workarounds if relevant. Include advisory URLs from references. If no patch is available, suggest SPECIFIC compensating controls with their trade-offs — not generic 'apply defense in depth' but actionable: 'Disable X feature', 'Block Y port', 'Restrict access to Z endpoint'. Note side effects of each mitigation. Do NOT use bullet points, JSON, or key-value formatting." Patch available: Upgrade to WebKitGTK 2.50.3 or later. Red Hat, Ubuntu, Debian have patches. Provide advisory links: I'll mention the Red Hat errata and USN/DSA. No workaround mentioned. So: "Upgrade to WebKitGTK version 2.50.3 or apply the vendor-provided patches for your distribution. Red Hat users should apply updates per RHSA-2025:22789 et al., Ubuntu users USN-7941-1, Debian users DLA-4399-1 or DSA-6074-1. No effective workarounds are known; disabling drag-and-drop entirely may break web application functionality." 7. exploit_scenario: "Brief realistic attack scenario in 2-3 sentences. If POC exists, note that. Factor in attack vector and complexity from CVSS." Attack vector: network, complexity low, but user interaction required. So scenario: An attacker lures a victim to a malicious website that triggers a crafted drag-and-drop operation. The website can simulate a file drop from the local file system, and by specifying a filename, it can read the contents of a known file (e.g., SSH keys) and exfiltrate it to the attacker. So: "A victim visits a malicious page that requests a drag action (e.g., a ‘drag here to upload’ prompt) while subtly reading a sensitive file from the user’s home directory. The page uses JavaScript to initiate a fake drop with a file path of the attacker’s choice, causing WebKitGTK to load and leak the file’s content to the attacker’s server. No public proof-of-concept code was identified at the time of analysis." 8. exploitation_conditions: "CRITICAL FIELD — security teams make real decisions based on this. Extract SPECIFIC, CONCRETE prerequisites from the CVE description. Name the EXACT product feature, protocol, configuration setting, or deployment mode required. If the description says 'when configured with...' or 'if the X feature is enabled' — that IS the condition. If genuinely no special conditions (AV:N/AC:L/PR:N/UI:N), state: 'No special conditions — remote unauthenticated exploitation against default configurations of [PRODUCT NAME].' Also state what LIMITS exploitation: required user interaction, authentication level, non-default configuration, specific platform/version. These limiting factors help defenders assess realistic risk beyond raw CVSS score. FORBIDDEN generic phrases: 'Network access required.' / 'Specific configuration needed.' / 'Depends on deployment.'" Description: "abusing the file drag-and-drop mechanism where WebKitGTK does not verify that drag operations originate from outside the browser." So the condition is that the user must be using a WebKitGTK-based browser or application that supports drag-and-drop of files, and the user must perform a drag action (or be tricked into it). It doesn't require any special configuration beyond default functionality. So I'll state: "Exploitation requires the user to visit a malicious website and perform a drag-and-drop operation into the browser window. The vulnerability exists in the default drag-and-drop handling of WebKitGTK; no non-default settings or additional software are required. The attack is limited by the need for user interaction (UI:R) and the requirement that the attacker knows or can guess the path of the target file." This is specific. No bullet points. 9. attack_chain: "3-7 short steps separated by ' → ' (arrow), following kill chain phases. Use as many steps as the attack realistically requires. Each step is 3-8 words. Must be grounded in actual CVE data (attack vector, privileges, scope from CVSS)." Phases: Recon not really needed; user is lured to site. So: Delivery (user visits malicious page), Exploit (page triggers fake drop), Impact (file read). 3 steps: "User visits attacker-controlled website → Website initiates drag event with crafted file path → Browser reads file and leaks content to attacker". That's clear. 10. confidence_notes: "1-3 sentences about data completeness and confidence. State what is CONFIRMED (by vendor, NVD, CISA), what is INFERRED (from CVSS vector, description), and what is UNKNOWN or MISSING." We have vendor confirmation: Red Hat Bugzilla, Red Hat errata, Ubuntu USN, Debian DSA. NVD entry exists. CVSS from NVD. EPSS from external. No KEV. No POC mentioned. So: "The vulnerability is confirmed by Red Hat (Bugzilla 2418576), and patches are available across major Linux distributions (Red Hat, Ubuntu, Debian). The CVSS 3.1 score and vector are provided by NVD. The exploitation conditions (user-assisted drag-and-drop) are inferred from the description. No public exploit code or active exploitation reports exist at the time of analysis." That covers confirmed, inferred, unknown (expl

We are asked to synthesize data about CVE-2025-12585 into a JSON object with specific fields. We need to follow the instructions meticulously. First, parse the provided data: - CVE ID: CVE-2025-12585 - Description: The MxChat - AI Chatbot for WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.5.5 via upload filenames. This makes it possible for unauthenticated attackers to extract session values that can subsequently be used to access conversation data. - CVSS Score: 5.3 - CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - CWE: CWE-200 - EPSS Score: 0.05% (percentile 16%) - Reported by: security@wordfence.com - Tags: WordPress, Information Disclosure - ENISA EUVD ID: EUVD-2025-200727 - Affected versions (EUVD): ["MxChat – AI Chatbot for WordPress * ≤2.5.5"] - References: - plugins.trac.wordpress.org ... class-mxchat-integrator.php#L107 - plugins.trac.wordpress.org/changeset... (likely patch commit) - wordfence.com threat intel page - nvd.nist.gov/vuln/detail/CVE-2025-12585 (euvd advisory) - github.com/d0n601/CVE-2025-12585 (likely POC) - ryankozak.com/posts/cve-2025-12585 (maybe analysis) - ryankozak.com/posts/cve-2025-12585/ (same) Now, fill the fields: product_name: "MxChat for WordPress" (1-3 words). It's a WordPress plugin. Could be "MxChat plugin" but "MxChat" is the name, so "MxChat for WordPress" is fine. Alternative: "MxChat - AI Chatbot". But instruction: "1-3 words ONLY. The specific product or service name affected." So "MxChat" or "MxChat for WordPress". I'll go with "MxChat for WordPress" (3 words). The description says "The MxChat - AI Chatbot for WordPress plugin", so product name is "MxChat". summary: 2-3 sentence plain-language synthesis. Start with specific impact verb and product. E.g.: "Sensitive information exposure in MxChat for WordPress allows unauthenticated attackers to extract session values from upload filenames." Then mention affected versions, impact (access conversation data). Mention EPSS low, no KEV, POC exists? The references include a GitHub repo for CVE-2025-12585 (d0n601), likely a POC. So mention POC publicly available. Also note EPSS low. Not actively exploited per KEV (no KEV). So summary: "Sensitive information exposure in the MxChat plugin for WordPress ≤2.5.5 allows unauthenticated attackers to extract session values from uploaded filenames, enabling access to user conversation data. A public proof-of-concept is available, but exploitation is currently assessed as low probability (EPSS 0.05%) and no active exploitation has been confirmed." technical_context: Explain underlying technology, CPE not provided but affected product is a WordPress plugin. Use CWE-200. The vulnerability involves upload filenames exposing session values. Likely the plugin's file upload mechanism inadvertently leaks session identifiers in the filename or its metadata. CWE-200: Exposure of Sensitive Information to an Unauthorized Actor. CPE data might be missing, but references point to the plugin's code. So: "MxChat is an AI chatbot plugin for WordPress that handles conversations and likely uses file uploads for data exchange. The vulnerability stems from improper sanitization of upload filenames that directly embed session values (CWE-200). The affected file class-mxchat-integrator.php at line 107 indicates the upload handling logic. No CPE data provided, but the plugin version range is confirmed up to 2.5.5." risk_assessment: Use all signals: CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) — network, low complexity, no privileges, no user interaction, scope unchanged, confidentiality low, integrity none, availability none. EPSS 0.05% (low). KEV: no KEV. POC: exists (GitHub link). Compare: CVSS 5.3 medium, but low EPSS and no active exploitation suggests low real-world risk, but POC exists. So: "CVSS 5.3 (Medium) indicates network-accessible, low-complexity information disclosure requiring no authentication. EPSS score of 0.05% suggests a very low likelihood of exploitation in the wild. While a public proof-of-concept exists on GitHub, no active exploitation has been confirmed (no KEV listing). The vulnerability exposes only low-impact data (conversation sessions), limiting the overall risk. This is likely a lower priority for patching, though site owners should still update to prevent passive information harvesting." Mention if any data missing: No missing data explicitly, but we can state that patch is available from Wordfence references. affected_products: List affected products: "MxChat – AI Chatbot for WordPress plugin versions up to and including 2.5.5. Affected product details are available in the EUVD advisory (EUVD-2025-200727) and the Wordfence vulnerability report (ID 7cf1a90d-6157-40e7-aed8-4d18bc22432d). The vendor fixed the issue in a later version, but the exact patched release number is not explicitly stated in the provided data; the changeset link suggests the fix is in the repository." remediation: Primary fix: "Upgrade the MxChat plugin to the latest available version beyond 2.5.5. The Wordfence advisory recommends updating to a patched version; the changeset at plugins.trac.wordpress.org indicates the fix has been committed. If immediate update is not possible, restrict access to the uploads directory via .htaccess rules or web server configuration to prevent direct access to uploaded files. Monitor for any unusual access to conversation data. The vulnerability does not allow code execution, so targeted mitigation mainly involves blocking unauthenticated access to uploaded filenames." exploit_scenario: "An unauthenticated attacker sends a crafted request to the vulnerable upload endpoint, causing the plugin to save a file with a filename containing a session value. The attacker then retrieves the list of uploaded files (or the filename itself) to extract the session, and uses it to impersonate a user and access their conversation history." Factor attack vector: network, no user interaction. So realistic scenario: automated scanner could detect exposed filenames. exploitation_conditions: "The vulnerability is present in all default installations of MxChat plugin versions ≤2.5.5; no special configuration is required. The attacker only needs network access to the WordPress site and the ability to trigger the file upload functionality (which appears to be accessible without authentication). The exposed session values are embedded in upload filenames, so the attacker must be able to read those filenames, likely via directory listing or direct file access." Since AV:N and PR:N, no authentication. The description says "via upload filenames" and "unauthenticated attackers" so conditions: unauthenticated, and the upload endpoint must be accessible (default). No special config. attack_chain: "Send upload request to vulnerable endpoint → Filename embeds session value → Attacker retrieves uploaded filenames (e.g., via directory listing) → Extract session from filename → Use session to access conversation data". Phases: Access (network access to endpoint), Deliver (upload payload), Exploit (filename leak), Execution (extract session), Impact (access conversations). So: "Access WordPress site network → Send crafted upload request to plugin endpoint → Filename leak exposes session value → Attacker extracts session from directory listing → Session used to access user conversations". That's 5 steps. Combine: "Access WordPress site → Send upload request with attacker-controlled session capture → Retrieve uploaded filenames via directory listing → Extract session value from filename → Use session to access conversation data". That's good. confidence_notes: "Vulnerability confirmed by Wordfence (security@wordfence.com) and referenced in NVD. A public proof-of-concept is available on GitHub (d0n601/CVE-2025-12585), confirming reproducibility. The patched changeset is linked from WordPress.org, though the exact fixed version number is not explicitly stated in the provided data—update to a version after 2.5.5 is recommended. No active exploitation reported via KEV." So confidence: confirmed by vendor/reporter. prevalence: one word: "medium" (WordPress plugins are common, but this specific AI chatbot plugin might not be ubiquitous. I'd estimate medium, given it's a niche plugin but popular in its category. Could be "low" but I'll go with "medium" as it's a functional plugin, not extremely rare. But we need to justify: "prevalence_basis" will be "niche WordPress chatbot plugin". So "medium" might be too high; "low" is more appropriate for a specific chatbot plugin. I'll choose "low". prevalence: "low". basis: "niche WordPress AI chatbot plugin". The plugin has few active installations? Not given, but likely not high. I'll set to low. assessed_cvss_vector: My own independent CVSS 3.1 vector. The provided one is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. This seems appropriate. I'll keep it the same, but the instruction says "Your OWN independent CVSS 3.1 base-metric vector for THIS vulnerability, grounded in the description and exploitation conditions — NOT a copy of any score in the input." I need to independently assess. The conditions: unauthenticated attacker can extract session values from filenames, then access conversation data. Confidentiality impact is low (session and conversation data), no integrity/availability. Attack vector is network, complexity low (no user interaction), privileges none, scope unchanged. So same vector indeed. I'll output CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. Rationale: "Unauthenticated network access to upload filenames leaks low-confidentiality session values; no privilege, user interaction, or impact beyond confidentiality." assessed_cvss40_vector: Convert to CVSS 4.0. Need to map: AV:N → AV:N, AC:L → AC:L, privileges none → PR:N, no UI → UI:N. Vulnerable system metrics: Confidentiality (VC) low, Integrity (VI) none, Availability (VA) none. No scope change (Subsequent system SC/SI/SA are N). Attack requirements: AT:N (none). So CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N. Rationale can be omitted, but the field "assessed_cvss_rationale" is required for 3.1, not for 4.0. So I'll output that vector. Now construct the JSON. Ensure all strings are plain text. product_name: "MxChat for WordPress" summary: "Sensitive information exposure in MxChat for WordPress ≤2.5.5 allows unauthenticated attackers to extract session values from upload filenames, enabling access to user conversation data. A public proof-of-concept is available, but exploitation is assessed as low probability (EPSS 0.05%) and no active exploitation has been confirmed." technical_context: "MxChat is an AI chatbot plugin for WordPress that handles file uploads; the vulnerability resides in the upload filename sanitization within class-mxchat-integrator.php (CWE-200). No CPE data is provided, but the affected product is the WordPress plugin up to version 2.5.5, as listed in the EUVD advisory." risk_assessment: "CVSS 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) indicates unauthenticated network-accessible low-impact information disclosure. EPSS 0.05% suggests very low exploitation likelihood, and no active exploitation is confirmed (not in KEV). A public PoC exists, but the limited data exposure reduces overall risk; patch promptly but prioritization may be moderate." affected_products: "MxChat – AI Chatbot for WordPress plugin versions up to and including 2.5.5. The vulnerability is documented in EUVD-2025-200727 and Wordfence report ID 7cf1a90d. A fix has been committed in the

Vim is an open source, command line text editor. Prior to version 9.1.1947, an uncontrolled search path vulnerability on Windows allows Vim to execute malicious executables placed in the current working directory for the current edited file. On Windows, when using cmd.exe as a shell, Vim resolves external commands by searching the current working directory before system paths. When Vim invokes tools such as findstr for :grep, external commands or filters via :!, or compiler/:make commands, it may inadvertently run a malicious executable present in the same directory as the file being edited. The issue affects Vim for Windows prior to version 9.1.1947.

NMIS/BioDose V22.02 and previous versions' installation directory paths by default have insecure file permissions, which in certain deployment scenarios can enable users on client workstations to modify the program executables and libraries.

NMIS/BioDose V22.02 and previous version installations where the embedded Microsoft SQLServer Express is used are exposed in the Windows share accessed by clients in networked installs. By default, this directory has insecure directory paths that allow access to the SQL Server database and configuration files, which can contain sensitive data.

CVE-2025-61940 is a security vulnerability (CVSS 8.3). High severity vulnerability requiring prompt remediation.

Lvzhou CMS before commit c4ea0eb9cab5f6739b2c87e77d9ef304017ed615 (2025-09-22) is vulnerable to SQL injection via the 'title' parameter in com.wanli.lvzhoucms.service.ContentService#findPage. The parameter is concatenated directly into a dynamic SQL query without sanitization or prepared statements, enabling attackers to read sensitive data from the database.

ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In 5.5.1, 5.4.3, 5.3.4, 5.2.6, 5.1.6, and earlier, when AVRCP is enabled on ESP32, receiving a malformed VENDOR DEPENDENT command from a peer device can cause the Bluetooth stack to access memory before validating the command buffer length. This may lead to an out-of-bounds read, potentially exposing unintended memory content or causing unexpected behavior.

Within HostnameError.Error(), when constructing an error string, there is no limit to the number of hosts that will be printed out. Furthermore, the error string is constructed by repeated string concatenation, leading to quadratic runtime. Therefore, a certificate provided by a malicious actor can result in excessive resource consumption.

Race in v8 in Google Chrome prior to 143.0.7499.41 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)

Bad cast in Loader in Google Chrome prior to 143.0.7499.41 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)

A security vulnerability in DevTools in Google Chrome (CVSS 5.4). Remediation should follow standard vulnerability management procedures.

Type Confusion in V8 in Google Chrome prior to 143.0.7499.41 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

A remote code execution vulnerability in Apptainer (CVSS 4.5). Remediation should follow standard vulnerability management procedures. Vendor patch is available.

A remote code execution vulnerability (CVSS 4.5). Remediation should follow standard vulnerability management procedures.

dcat-admin v2.2.3-beta and before is vulnerable to file inclusion in admin/src/Extend/VersionManager.php.

An issue was discovered in 5.2 before 5.2.9, 5.1 before 5.1.15, and 4.2 before 4.2.27. Algorithmic complexity in `django.core.serializers.xml_serializer.getInnerText()` allows a remote attacker to cause a potential denial-of-service attack triggering CPU and memory exhaustion via specially crafted XML input processed by the XML `Deserializer`. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Seokchan Yoon for reporting this issue.

An out-of-bounds read vulnerability exists in the EMF functionality of PDF-XChange Co. Ltd PDF-XChange Editor 10.7.3.401. By using a specially crafted EMF file, an attacker could exploit this vulnerability to perform an out-of-bounds read, potentially leading to the disclosure of sensitive information.

A security vulnerability in nocobase (CVSS 5.6). Remediation should follow standard vulnerability management procedures.

A security vulnerability in Upload.am WordPress (CVSS 4.9). Remediation should follow standard vulnerability management procedures.

A privilege escalation vulnerability (CVSS 7.2) that allows a physically proximate attacker with elevated privileges. Risk factors: public PoC available.

Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7, allow a physically proximate attacker (with elevated privileges) to read and modify the Appliance SSD contents (because they are unencrypted).

Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7, allow a physically proximate attacker with root access to modify the Recovery Partition (because of a lack of integrity protection).

CVE-2025-59698 is a security vulnerability (CVSS 6.8) that allows a physically proximate attacker. Risk factors: public PoC available.

CVE-2025-59696 is a security vulnerability (CVSS 3.2) that allows a physically proximate attacker. Risk factors: public PoC available.

CVE-2025-59694 is a security vulnerability (CVSS 6.8) that allows a physically proximate attacker. Risk factors: public PoC available.

Horde Groupware v5.2.22 has a user enumeration vulnerability that allows an unauthenticated attacker to determine the existence of valid accounts on the system. To exploit the vulnerability, an HTTP request must be sent to ‘/imp/attachment.php’ including the parameters ‘id’ and ‘u’. If the specified user exists, the server will return the download of an empty file; if it does not exist, no download will be initiated, which unequivocally reveals the validity of the user.

User Enumeration Vulnerability in TCMAN GIM v11 version 20250304. This vulnerability allows an unauthenticated attacker to determine whether a user exists on the system. The vulnerability is exploitable through the 'pda:username' parameter with 'soapaction GetUserQuestionAndAnswer' in '/WS/PDAWebService.asmx'.

User Enumeration Vulnerability in TCMAN GIM v11 version 20250304. This vulnerability allows an unauthenticated attacker to determine whether a user exists on the system. The vulnerability is exploitable through the 'pda:username' parameter with 'soapaction GetLastDatePasswordChange' in '/WS/PDAWebService.asmx'.

Insertion of Sensitive Information Into Sent Data vulnerability in Argus Technology Inc. BILGER allows Choosing Message Identifier.This issue affects BILGER: before 2.4.9.

Out-of-bounds read vulnerability in Circutor SGE-PLC1000/SGE-PLC50 v9.0.2. The 'DownloadFile' function converts a parameter to an integer using 'atoi()' and then uses it as an index in the 'FilesDownload' array with '(&FilesDownload)[iVar2]'. If the parameter is too large, it will access memory beyond the limits.

CVE-2025-41744 is a security vulnerability (CVSS 9.1) that allows an unprivileged remote attacker. Critical severity with potential for significant impact on affected systems.

Insufficient encryption strength in Sprecher Automation SPRECON-E-C, SPRECON-E-P, and SPRECON-E-T3 allows a local unprivileged attacker to extract data from update images and thus obtain limited information about the architecture and internal processes.

In gokey versions <0.2.0, a flaw in the seed decryption logic resulted in passwords incorrectly being derived solely from the initial vector and the AES-GCM authentication tag of the key seed. This issue has been fixed in gokey version 0.2.0. This is a breaking change. The fix has invalidated any passwords/secrets that were derived from the seed file (using the -s option). Even if the input seed file stays the same, version 0.2.0 gokey will generate different secrets. Impact This vulnerability impacts generated keys/secrets using a seed file as an entropy input (using the -s option). Keys/secrets generated just from the master password (without the -s option) are not impacted. The confidentiality of the seed itself is also not impacted (it is not required to regenerate the seed itself). Specific impact includes: * keys/secrets generated from a seed file may have lower entropy: it was expected that the whole seed would be used to generate keys (240 bytes of entropy input), where in vulnerable versions only 28 bytes was used * a malicious entity could have recovered all passwords, generated from a particular seed, having only the seed file in possession without the knowledge of the seed master password Patches The code logic bug has been fixed in gokey version 0.2.0 and above. Due to the deterministic nature of gokey, fixed versions will produce different passwords/secrets using seed files, as all seed entropy will be used now. System secret rotation guidance It is advised for users to regenerate passwords/secrets using the patched version of gokey (0.2.0 and above), and provision/rotate these secrets into respective systems in place of the old secret. A specific rotation procedure is system-dependent, but most common patterns are described below. Systems that do not require the old password/secret for rotation Such systems usually have a "Forgot password" facility or a similar facility allowing users to rotate their password/secrets by sending a unique "magic" link to the user's email or phone. In such cases users are advised to use this facility and input the newly generated password secret, when prompted by the system. Systems that require the old password/secret for rotation Such systems usually have a modal password rotation window usually in the user settings section requiring the user to input the old and the new password sometimes with a confirmation. To generate/recover the old password in such cases users are advised to: * temporarily download gokey version 0.1.3 https://github.com/cloudflare/gokey/releases/tag/v0.1.3 for their respective operating system to recover the old password * use gokey version 0.2.0 or above to generate the new password * populate the system provided password rotation form Systems that allow multiple credentials for the same account to be provisioned Such systems usually require a secret or a cryptographic key as a credential for access, but allow several credentials at the same time. One example is SSH: a particular user may have several authorized public keys configured on the SSH server for access. For such systems users are advised to: * generate a new secret/key/credential using gokey version 0.2.0 or above * provision the new secret/key/credential in addition to the existing credential on the system * verify that the access or required system operation is still possible with the new secret/key/credential * revoke authorization for the existing/old credential from the system Credit This vulnerability was found by Théo Cusnir ( @mister_mime https://hackerone.com/mister_mime ) and responsibly disclosed through Cloudflare's bug bounty program.

A security vulnerability in Eclipse Paho Go MQTT (CVSS 5.3). Remediation should follow standard vulnerability management procedures.

The Zigaform plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 7.6.5. This is due to the plugin exposing a public AJAX endpoint that retrieves form submission data without performing authorization checks to verify ownership or access rights. This makes it possible for unauthenticated attackers to extract sensitive form submission data including personal information, payment details, and other private data via the rocket_front_payment_seesummary action by enumerating sequential form_r_id values.

Insecure Storage of Sensitive Information vulnerability in MeetMe on iOS, Android allows Retrieve Embedded Sensitive Data. This issue affects MeetMe: through v2.2.5.

In GPU pdma, there is a possible information disclosure due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. Patch ID: ALPS10117741; Issue ID: MSV-4538.

In display, there is a possible out of bounds read due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10184297; Issue ID: MSV-4759.

In display, there is a possible out of bounds read due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10196993; Issue ID: MSV-4805.

In Modem, there is a possible out of bounds read due to a missing bounds check. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01673760; Issue ID: MSV-4650.

CVE-2024-45675 is a security vulnerability (CVSS 8.4) that allows a local user. High severity vulnerability requiring prompt remediation.

Improper verification of source of a communication channel in SmartTouchCall prior to version 1.0.1.1 allows remote attackers to access sensitive information. User interaction is required for triggering this vulnerability.

A security vulnerability in Samsung Account (CVSS 4.0) that allows local attacker. Remediation should follow standard vulnerability management procedures.

A security vulnerability in Samsung Account (CVSS 4.0) that allows local attacker. Remediation should follow standard vulnerability management procedures.

A security vulnerability in Samsung Cloud Assistant (CVSS 4.0) that allows local attacker. Remediation should follow standard vulnerability management procedures.

A security vulnerability in Galaxy Store for Galaxy Watch (CVSS 5.9) that allows local attacker. Remediation should follow standard vulnerability management procedures.

A security vulnerability in MPLocalService of MotionPhoto (CVSS 7.3) that allows local attackers. High severity vulnerability requiring prompt remediation.

A security vulnerability in MPRemoteService of MotionPhoto (CVSS 7.3) that allows local attackers. High severity vulnerability requiring prompt remediation.

Out-of-bounds read in libimagecodec.quram.so prior to SMR Dec-2025 Release 1 allows remote attackers to access out-of-bounds memory.

Out-of-bounds read vulnerability in bootloader prior to SMR Dec-2025 Release 1 allows physical attackers to access out-of-bounds memory.

HackerOne community member Kassem S.(kassem_s94) has reported that username handling in Revive Adserver was still vulnerable to impersonation attacks after the fix for CVE-2025-52672, via several alternate techniques. Homoglyphs based impersonation has been independently reported by other HackerOne users, such as itz_hari_ and khoof.

A security vulnerability in Dynamic Lockscreen (CVSS 6.2) that allows local attackers. Remediation should follow standard vulnerability management procedures.

A security vulnerability in to forward the current HTTP request to another server. (CVSS 5.4). Remediation should follow standard vulnerability management procedures. Vendor patch is available.

mdast-util-to-hast is an mdast utility to transform to hast. From 13.0.0 to before 13.2.1, multiple (unprefixed) classnames could be added in markdown source by using character references. This could make rendered user supplied markdown code elements appear like the rest of the page. This vulnerability is fixed in 13.2.1.

A security vulnerability in This admin (CVSS 6.5). Risk factors: public PoC available. Vendor patch is available.

Grav is a file-based Web platform. Prior to 1.8.0-beta.27, users with read access on the user account management section of the admin panel can view the password hashes of all users, including the admin user. This exposure can potentially lead to privilege escalation if an attacker can crack these password hashes. This vulnerability is fixed in 1.8.0-beta.27.

Grav is a file-based Web platform. Prior to 1.8.0-beta.27, having a simple form on site can reveal the whole Grav configuration details (including plugin configuration details) by using the correct POST payload to exploit a Server-Side Template (SST) vulnerability. Sensitive information may be contained in the configuration details. This vulnerability is fixed in 1.8.0-beta.27.

Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. Rated low severity (CVSS 2.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CVE-2025-51682 is a security vulnerability (CVSS 9.8) that allows an attacker. Risk factors: public PoC available.

In Search Guard FLX versions from 3.1.0 up to 4.0.0 with enterprise modules being disabled, there exists an issue which allows authenticated users to use specially crafted requests to read documents from data streams without having the respective privileges.

Rejected reason: DO NOT USE THIS CVE RECORD. No vendor patch available.

Rejected reason: DO NOT USE THIS CVE RECORD. No vendor patch available.

nopCommerce v4.70 and prior, and version 4.80.3, does not invalidate session cookies after logout or session termination, allowing an attacker who has a a valid session cookie access to privileged endpoints (such as /admin) even after the legitimate user has logged out, enabling session hijacking. Any version above 4.70 that is not 4.80.3 fixes the vulnerability.

A cleartext transmission vulnerability exists in the WEBVIEW-M functionality of Socomec DIRIS Digiware M-70 1.6.9. A specially crafted HTTP request can lead to a disclosure of sensitive information. An attacker can sniff network traffic to trigger this vulnerability.

Kerlink gateways running KerOS prior to version 5.10 expose their web interface exclusively over HTTP, without HTTPS support. This lack of transport layer security allows a man-in-the-middle attacker to intercept and modify traffic between the client and the device.

FeehiCMS version 2.1.1 fails to enforce server-side immutability for parameters that are presented to clients as "read-only." An authenticated attacker can intercept and modify the parameter in transit and the backend accepts the changes. This can lead to unintended username changes.

A remote code execution vulnerability (CVSS 4.3). Remediation should follow standard vulnerability management procedures.

CVE-2025-49642 is a security vulnerability (CVSS 5.8). Remediation should follow standard vulnerability management procedures.