2025-07-03 Daily Vulns

NEW:

CVE	vendor-product	description	metric	Referenceurl	title	GithubURL
CVE-2025-45424	n/a - n/a	Incorrect access control in Xinference before v1.4.0 allows attackers to access the Web GUI without authentication.	CNA n/a CVSS3.1: 5.3 - MEDIUM	0 1	Exploitation: pocAutomatable: yesTechnical Impact: partial	undefined	github
CVE-2025-20310	Cisco - Cisco Enterprise Chat and Email	A vulnerability in the web UI of Cisco Enterprise Chat and Email (ECE) could allow an unauthenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the interface. This vulnerability exists because the web UI does not properly validate user-supplied input. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. To successfully exploit this vulnerability, an attacker would need valid agent credentials.	CVSS3.1: 6.1 - MEDIUM	0	Exploitation: noneAutomatable: noTechnical Impact: partial	Cisco Enterprise Chat and Email Stored Cross-Site Scripting Vulnerability	github
CVE-2015-0849	pycode-browser - pycode-browser	pycode-browser before version 1.0 is prone to a predictable temporary file vulnerability.	CNA n/a CVSS3.1: 3.9 - LOW	0	Exploitation: noneAutomatable: noTechnical Impact: partial	undefined	github
CVE-2024-11405	hellomohsinkhan - WP Front-end login and register	The WP Front-end login and register plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the email and wpmp_reset_password_token parameters in all versions up to, and including, 2.1.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.	CVSS3.1: 6.1 - MEDIUM	0 1	Exploitation: noneAutomatable: noTechnical Impact: partial	WP Front-end login and register <= 2.1.0 - Reflected Cross-Site Scripting	github