DuyTa/cve-kgrag-db huggingface dataset:
CVE-2025-2354
A vulnerability has been found in VAM Virtual Airlines Manager 2.6.2 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /vam/index.php. The manipulation of the argument registry_id/plane_icao/hub_id leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v3.1 Score: 4.3 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N
Related CWEs: CWE-94, CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
MITRE ATT&CK Techniques: T1027.006, T1564.009, T1027.009
MITRE ATT&CK Tactics: T1564, T1027
References: https://vuldb.com/?ctiid.299821, https://vuldb.com/?id.299821, https://vuldb.com/?submit.513287
CWE: CWE-94, CWE-79
MITRE ATT&CK techniques: T1027.006, T1564.009, T1027.009
MITRE ATT&CK tactics: T1564, T1027
CVE-2025-54353
An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability [CWE-79] vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.2, FortiSandbox 4.4.0 through 4.4.7, FortiSandbox 4.2 all versions, FortiSandbox 4.0 all versions may allow an attacker to perform an XSS attack via crafted HTTP requests.
CVSS v3.1 Score: 5.4 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Affected Products: fortisandbox
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: https://fortiguard.fortinet.com/psirt/FG-IR-25-477
CWE: CWE-79
CVE-2025-23484
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cojecto Predict When predict-when allows Reflected XSS.This issue affects Predict When: from n/a through <= 1.3.
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: https://patchstack.com/database/Wordpress/Plugin/predict-when/vulnerability/wordpress-predict-when-plugin-1-3-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CWE: CWE-79
CVE-2025-40751
A vulnerability has been identified in SIMATIC RTLS Locating Manager (All versions < V3.3). Affected SIMATIC RTLS Locating Manager Report Clients do not properly protect credentials that are used to authenticate to the server. This could allow an authenticated local attacker to extract the credentials and use them to escalate their access rights from the Manager to the Systemadministrator role.
CVSS v3.1 Score: 6.3 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
Affected Products: simatic_rtls_locating_manager
Related CWEs: CWE-522
Related CAPECs: CAPEC-560, CAPEC-644, CAPEC-653
MITRE ATT&CK Techniques: T1550.003, T1021.002, T1133
MITRE ATT&CK Tactics: T1110, T1114, T1558
References: https://cert-portal.siemens.com/productcert/html/ssa-707630.html
CWE: CWE-522
MITRE ATT&CK techniques: T1550.003, T1021.002, T1133, T1114.002, T1110.004, T1543, T1552.004, T1558.003, T1558, T1021, T1550.002, T1078
MITRE ATT&CK tactics: T1110, T1114, T1558, T1550, T1552, T1021
CVE-2025-11812
The Reuse Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'reuse_builder_single_post_title' shortcode in all versions up to, and including, 1.7. This is due to insufficient input sanitization and output escaping on the 'style' attribute. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS v3.1 Score: 6.4 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: https://plugins.trac.wordpress.org/browser/reuse-builder/tags/1.7/shortcodes/single_post_title.php#L24, https://wordpress.org/plugins/reuse-builder/, https://www.wordfence.com/threat-intel/vulnerabilities/id/f796ade5-db48-4334-9a76-15326f62c9a5?source=cve
CWE: CWE-79
CVE-2025-68584
Cross-Site Request Forgery (CSRF) vulnerability in Constantin Boiangiu Vimeotheque codeflavors-vimeo-video-post-lite allows Cross Site Request Forgery.This issue affects Vimeotheque: from n/a through <= 2.3.5.2.
CVSS v3.1 Score: 8.8 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Related CWEs: CWE-352
Related CAPECs: CAPEC-467, CAPEC-111, CAPEC-462
References: https://patchstack.com/database/Wordpress/Plugin/codeflavors-vimeo-video-post-lite/vulnerability/wordpress-vimeotheque-plugin-2-3-5-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CWE: CWE-352
CVE-2025-70650
Tenda AX-1806 v1.0.0.1 was discovered to contain a stack overflow in the deviceList parameter of the formSetMacFilterCfg function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request.
CVSS v3.1 Score: 7.5 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products: ax1806_firmware, ax1806
Related CWEs: CWE-121
References: https://github.com/0-fool/VulnbyCola/blob/main/Tenda/AX-1806/1/1.md
CWE: CWE-121
CVE-2025-60207
Unrestricted Upload of File with Dangerous Type vulnerability in Addify Custom User Registration Fields for WooCommerce user-registration-plugin-for-woocommerce allows Upload a Web Shell to a Web Server.This issue affects Custom User Registration Fields for WooCommerce: from n/a through <= 2.1.2.
CVSS v3.1 Score: 10.0 (CRITICAL)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Related CWEs: CWE-434
Related CAPECs: CAPEC-1
MITRE ATT&CK Techniques: T1574.010
MITRE ATT&CK Tactics: T1574
References: https://patchstack.com/database/Wordpress/Plugin/user-registration-plugin-for-woocommerce/vulnerability/wordpress-custom-user-registration-fields-for-woocommerce-plugin-2-1-2-arbitrary-file-upload-vulnerability?_s_id=cve
CWE: CWE-434
MITRE ATT&CK techniques: T1574.010
MITRE ATT&CK tactics: T1574
CVE-2025-53055
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: PIA Core Technology).  Supported versions that are affected are 8.60, 8.61 and  8.62. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in PeopleSoft Enterprise PeopleTools, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data as well as  unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).
CVSS v3.1 Score: 6.1 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected Products: peoplesoft_enterprise_peopletools
Related CWEs: CWE-125
Related CAPECs: CAPEC-540
References: https://www.oracle.com/security-alerts/cpuoct2025.html
CWE: CWE-125
CVE-2025-34434
AVideo versions prior to 20.1 with the ImageGallery plugin enabled is vulnerable to unauthenticated file upload and deletion. Plugin endpoints responsible for managing gallery images fail to enforce authentication checks and do not validate ownership, allowing unauthenticated attackers to upload or delete images associated with any image-based video.
CVSS v3.1 Score: 9.1 (CRITICAL)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Affected Products: avideo
Related CWEs: CWE-306
Related CAPECs: CAPEC-216, CAPEC-12, CAPEC-36
References: https://chocapikk.com/posts/2025/avideo-security-vulnerabilities/, https://github.com/WWBN/AVideo/commit/4a53ab2056, https://github.com/WWBN/AVideo/commit/c279999cbd
CWE: CWE-306
CVE-2025-49906
Missing Authorization vulnerability in StellarWP WPComplete wpcomplete allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WPComplete: from n/a through <= 2.9.5.3.
CVSS v3.1 Score: 5.3 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Related CWEs: CWE-862
Related CAPECs: CAPEC-665
MITRE ATT&CK Techniques: T1211, T1556, T1542.002
MITRE ATT&CK Tactics: T1542
References: https://patchstack.com/database/Wordpress/Plugin/wpcomplete/vulnerability/wordpress-wpcomplete-plugin-2-9-5-3-broken-access-control-vulnerability?_s_id=cve
CWE: CWE-862
MITRE ATT&CK techniques: T1211, T1556, T1542.002
MITRE ATT&CK tactics: T1542
CVE-2025-25524
Buffer overflow vulnerability in TOTOLink X6000R routers V9.4.0cu.652_B20230116 due to the lack of length verification, which is related to the addition of Wi-Fi filtering rules. Attackers who successfully exploit this vulnerability can cause the remote target device to crash or execute arbitrary commands.
CVSS v3.1 Score: 5.1 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Affected Products: x6000r_firmware, x6000r
Related CWEs: CWE-120
Related CAPECs: CAPEC-14, CAPEC-92, CAPEC-45
References: https://gist.github.com/XiaoCurry/ce1f80afd2d8be8ca543437f16eae96b
CWE: CWE-120
CVE-2025-9566
There's a vulnerability in podman where an attacker may use the kube play command to overwrite host files when the kube file container a Secrete or a ConfigMap volume mount and such volume contains a symbolic link to a host file path. In a successful attack, the attacker can only control the target file to be overwritten but not the content to be written into the file.

Binary-Affected: podman
Upstream-version-introduced: v4.0.0
Upstream-version-fixed: v5.6.1
CVSS v3.1 Score: 8.1 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Related CWEs: CWE-22
Related CAPECs: CAPEC-78, CAPEC-126, CAPEC-76
References: https://access.redhat.com/errata/RHBA-2025:15692, https://access.redhat.com/errata/RHBA-2025:15712, https://access.redhat.com/errata/RHBA-2025:16158
CWE: CWE-22
CVE-2025-39524
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in bPlugins Html5 Audio Player html5-audio-player allows Stored XSS.This issue affects Html5 Audio Player: from n/a through <= 2.2.28.
Related CWEs: CWE-80
Related CAPECs: CAPEC-193, CAPEC-32, CAPEC-18
References: https://patchstack.com/database/Wordpress/Plugin/html5-audio-player/vulnerability/wordpress-html5-audio-player-2-2-28-cross-site-scripting-xss-vulnerability?_s_id=cve
CWE: CWE-80
CVE-2025-39990
In the Linux kernel, the following vulnerability has been resolved:

bpf: Check the helper function is valid in get_helper_proto

kernel test robot reported verifier bug [1] where the helper func
pointer could be NULL due to disabled config option.

As Alexei suggested we could check on that in get_helper_proto
directly. Marking tail_call helper func with BPF_PTR_POISON,
because it is unused by design.

  [1] https://lore.kernel.org/oe-lkp/202507160818.68358831-lkp@intel.com
References: https://git.kernel.org/stable/c/3d429cb1278e995e22995ef117fa96d223a67e93, https://git.kernel.org/stable/c/6233715b4b714068d6c831d214a4e8792109875a, https://git.kernel.org/stable/c/e4414b01c1cd9887bbde92f946c1ba94e40d6d64
CVE-2025-7733
The WP JobHunt plugin for WordPress, used by the JobCareer theme, is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 7.7 via the 'cs_update_application_status_callback' due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Candidate-level access and above, to send a site-generated email with injected HTML to any user.
CVSS v3.1 Score: 4.3 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Related CWEs: CWE-639
References: https://themeforest.net/item/jobcareer-job-board-responsive-wordpress-theme/14221636, https://www.wordfence.com/threat-intel/vulnerabilities/id/409bcd8c-6cd3-4022-a67f-57e901c83d66?source=cve
CWE: CWE-639
CVE-2025-57870
A SQL Injection vulnerability exists in Esri ArcGIS Server versions 11.3, 11.4 and 11.5 on Windows, Linux and Kubernetes. This vulnerability allows a remote, unauthenticated attacker to execute arbitrary SQL commands via a specific ArcGIS Feature Service operation. Successful exploitation can potentially result in unauthorized access, modification, or deletion of data from the underlying Enterprise Geodatabase.
CVSS v3.1 Score: 10.0 (CRITICAL)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Affected Products: linux_kernel, kubernetes, windows, arcgis_server
Related CWEs: CWE-89
Related CAPECs: CAPEC-7, CAPEC-470, CAPEC-108
References: https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/arcgis-server-feature-services-security-patch
CWE: CWE-89
CVE-2025-24644
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels print-invoices-packing-slip-labels-for-woocommerce allows Stored XSS.This issue affects WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels: from n/a through <= 4.7.1.
CVSS v3.1 Score: 4.8 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Affected Products: woocommerce_pdf_invoices\,_packing_slips\,_delivery_notes_and_shipping_labels
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: https://patchstack.com/database/Wordpress/Plugin/print-invoices-packing-slip-labels-for-woocommerce/vulnerability/wordpress-woocommerce-pdf-invoices-plugin-4-7-1-stored-cross-site-scripting-xss-vulnerability?_s_id=cve
CWE: CWE-79
CVE-2025-67638
Jenkins 2.540 and earlier, LTS 2.528.2 and earlier does not mask build authorization tokens displayed on the job configuration form, increasing the potential for attackers to observe and capture them.
CVSS v3.1 Score: 4.3 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Affected Products: jenkins
Related CWEs: CWE-312
Related CAPECs: CAPEC-37
MITRE ATT&CK Techniques: T1005, T1552.004
MITRE ATT&CK Tactics: T1552
References: https://www.jenkins.io/security/advisory/2025-12-10/#SECURITY-783
CWE: CWE-312
MITRE ATT&CK techniques: T1005, T1552.004
MITRE ATT&CK tactics: T1552
CVE-2025-14046
An improper neutralization of input vulnerability was identified in GitHub Enterprise Server that allowed user-supplied HTML to inject DOM elements with IDs that collided with server-initialized data islands. These collisions could overwrite or shadow critical application state objects used by certain Project views, leading to unintended server-side POST requests or other unauthorized backend interactions. Successful exploitation requires an attacker to have access to the target GitHub Enterprise Server instance and to entice a privileged user to view crafted malicious content that includes conflicting HTML elements. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.18.3, 3.17.9, 3.16.12, 3.15.16, and 3.14.21.
CVSS v3.1 Score: 6.1 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected Products: enterprise_server
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: https://docs.github.com/en/enterprise-server@3.14/admin/release-notes#3.14.21, https://docs.github.com/en/enterprise-server@3.15/admin/release-notes#3.15.16, https://docs.github.com/en/enterprise-server@3.16/admin/release-notes#3.16.12
CWE: CWE-79
CVE-2025-57483
A reflected cross-site scripting (XSS) vulnerability in tawk.to chatbox widget v4 allows attackers to execute arbitrary Javascript in the context of the user's browser via injecting a crafted payload into the vulnerable parameter.
CVSS v3.1 Score: 8.1 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: https://github.com/Jainil-89/CVE/blob/main/cve.md, https://ticketsmonk.com/events/details/412291
CWE: CWE-79
CVE-2025-39816
In the Linux kernel, the following vulnerability has been resolved:

io_uring/kbuf: always use READ_ONCE() to read ring provided buffer lengths

Since the buffers are mapped from userspace, it is prudent to use
READ_ONCE() to read the value into a local variable, and use that for
any other actions taken. Having a stable read of the buffer length
avoids worrying about it changing after checking, or being read multiple
times.

Similarly, the buffer may well change in between it being picked and
being committed. Ensure the looping for incremental ring buffer commit
stops if it hits a zero sized buffer, as no further progress can be made
at that point.
CVSS v3.1 Score: 5.5 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Affected Products: linux_kernel
References: https://git.kernel.org/stable/c/390a61d284e1ced088d43928dfcf6f86fffdd780, https://git.kernel.org/stable/c/695673eb5711ee5eb1769481cf1503714716a7d1, https://git.kernel.org/stable/c/91f262ea2a76a02d9e37dba6637cfe6feebb20a8
CVE-2025-27531
Deserialization of Untrusted Data vulnerability in Apache InLong. 

This issue affects Apache InLong: from 1.13.0 before 2.1.0, 

this issue would allow an authenticated attacker to read arbitrary files by double writing the param.





Users are recommended to upgrade to version 2.1.0, which fixes the issue.
CVSS v3.1 Score: 9.8 (CRITICAL)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Products: inlong
Related CWEs: CWE-502
Related CAPECs: CAPEC-586
References: https://lists.apache.org/thread/r62lkqrr739wvcb60j6ql6q63rh4bxx5, http://www.openwall.com/lists/oss-security/2025/02/28/2
CWE: CWE-502
CVE-2025-32187
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Quý Lê 91 Administrator Z administrator-z allows DOM-Based XSS.This issue affects Administrator Z: from n/a through <= 2026.03.02.
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: https://patchstack.com/database/Wordpress/Plugin/administrator-z/vulnerability/wordpress-administrator-z-plugin-2025-03-04-cross-site-scripting-xss-vulnerability?_s_id=cve
CWE: CWE-79
CVE-2025-42915
Fiori app Manage Payment Blocks does not perform the necessary authorization checks, allowing an attacker with basic user privileges to abuse functionalities that should be restricted to specific user groups.This issue could impact both the confidentiality and integrity of the application without affecting the availability.
CVSS v3.1 Score: 5.4 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Related CWEs: CWE-862
Related CAPECs: CAPEC-665
MITRE ATT&CK Techniques: T1211, T1556, T1542.002
MITRE ATT&CK Tactics: T1542
References: https://me.sap.com/notes/3409013, https://url.sap/sapsecuritypatchday
CWE: CWE-862
MITRE ATT&CK techniques: T1211, T1556, T1542.002
MITRE ATT&CK tactics: T1542
CVE-2025-13156
The Vitepos – Point of Sale (POS) for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the insert_media_attachment() function in all versions up to, and including, 3.3.0. This is due to the save_update_category_img() function accepting user-supplied file types without validation when processing category images. This makes it possible for authenticated attackers, with subscriber level access and above, to upload arbitrary files on the affected site's server which makes remote code execution possible.
CVSS v3.1 Score: 8.8 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Related CWEs: CWE-434
Related CAPECs: CAPEC-1
MITRE ATT&CK Techniques: T1574.010
MITRE ATT&CK Tactics: T1574
References: https://plugins.trac.wordpress.org/changeset/3398044, https://www.wordfence.com/threat-intel/vulnerabilities/id/bd478bb7-f0d7-4a29-8236-96ad69b5ae67?source=cve
CWE: CWE-434
MITRE ATT&CK techniques: T1574.010
MITRE ATT&CK tactics: T1574
CVE-2025-36353
IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 - 11.5.9 and 12.1.0 - 12.1.3 could allow a local user to cause a denial of service due to improper neutralization of special elements in data query logic.
CVSS v3.1 Score: 6.2 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products: db2
Related CWEs: CWE-943
Related CAPECs: CAPEC-676
References: https://www.ibm.com/support/pages/node/7257632
CWE: CWE-943
CVE-2025-32223
Authorization Bypass Through User-Controlled Key vulnerability in Themeum Tutor LMS tutor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Tutor LMS: from n/a through <= 3.9.4.
Related CWEs: CWE-639
References: https://patchstack.com/database/Wordpress/Plugin/tutor/vulnerability/wordpress-tutor-lms-plugin-3-9-4-insecure-direct-object-references-idor-vulnerability-2?_s_id=cve
CWE: CWE-639
CVE-2025-61666
Traccar is an open source GPS tracking system. Default installs of Traccar on Windows between versions 6.1-  6.8.1 and non default installs between versions 5.8 - 6.0 are vulnerable to unauthenticated local file inclusion attacks which can lead to leakage of passwords or any file on the file system including the Traccar configuration file. Versions 5.8 - 6.0 are only vulnerable if <entry key='web.override'>./override</entry> is set in the configuration file. Versions 6.1 - 6.8.1 are vulnerable by default as the web override is enabled by default. The vulnerable code is removed in version 6.9.0.
Related CWEs: CWE-22
Related CAPECs: CAPEC-78, CAPEC-126, CAPEC-76
References: https://github.com/traccar/traccar/blob/v6.8.1/src/main/java/org/traccar/web/DefaultOverrideServlet.java, https://github.com/traccar/traccar/security/advisories/GHSA-hprc-rph8-fj87, https://projectblack.io/blog/jetty-addpath-lfi
CWE: CWE-22
CVE-2025-8829
A vulnerability was identified in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 up to 20250801. Affected by this vulnerability is the function um_red of the file /goform/RP_setBasicAuto. The manipulation of the argument hname leads to os command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v3.1 Score: 6.3 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CVSS v2.0 Score: 6.5 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P
Affected Products: re9000, re7000, re6300_firmware, re6500_firmware, re6500
Related CWEs: CWE-78, CWE-77
Related CAPECs: CAPEC-43, CAPEC-6, CAPEC-88
References: https://github.com/wudipjq/my_vuln/blob/main/Linksys1/vuln_45/45.md, https://github.com/wudipjq/my_vuln/blob/main/Linksys1/vuln_45/45.md#poc, https://vuldb.com/?ctiid.319363
CWE: CWE-78, CWE-77
CVE-2025-54011
Missing Authorization vulnerability in SMTP2GO SMTP2GO smtp2go allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SMTP2GO: from n/a through <= 1.12.1.
Related CWEs: CWE-862
Related CAPECs: CAPEC-665
MITRE ATT&CK Techniques: T1211, T1556, T1542.002
MITRE ATT&CK Tactics: T1542
References: https://patchstack.com/database/Wordpress/Plugin/smtp2go/vulnerability/wordpress-smtp2go-plugin-1-12-1-broken-access-control-vulnerability?_s_id=cve
CWE: CWE-862
MITRE ATT&CK techniques: T1211, T1556, T1542.002
MITRE ATT&CK tactics: T1542
CVE-2025-49846
wire-ios is an iOS client for the Wire secure messaging application. From Wire iOS 3.111.1 to before 3.124.1, messages that were visible in the view port have been logged to the iOS system logs in clear text. Wire application logs created and managed by the application itself were not affected, especially not the logs users can export and send to Wire support. The iOS logs can only be accessed if someone had (physical) access to the underlying unlocked device. The issue manifested itself by calling canOpenUrl() and passing an invalid URL object. When iOS then performs the check and fails, it logs the contents to the system log. This is not documented behaviour. Wire released an emergency fix with version 3.124.1. As a workaround, users can reset their iOS device to remove the offending logs. Since Wire cannot access or modify iOS system logs, there's no other workaround other than a reset.
Related CWEs: CWE-532, CWE-117
Related CAPECs: CAPEC-215, CAPEC-93, CAPEC-268
MITRE ATT&CK Techniques: T1562.002, T1070, T1562.008
MITRE ATT&CK Tactics: T1562
References: https://github.com/wireapp/wire-ios/commit/0cff0e4298d87c2c56de07f3fb18d3e8e5a68fa3, https://github.com/wireapp/wire-ios/releases/tag/appstore%2F3.124.1, https://github.com/wireapp/wire-ios/security/advisories/GHSA-pj5p-96xx-hc7m
CWE: CWE-532, CWE-117
MITRE ATT&CK techniques: T1562.002, T1070, T1562.008, T1562.003
MITRE ATT&CK tactics: T1562
CVE-2025-47700
Mattermost Server versions 10.5.x <= 10.5.9 utilizing the Agents plugin fail to reject empty request bodies which allows users to trick users into clicking malicious links via post actions
CVSS v3.1 Score: 3.5 (LOW)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
Affected Products: mattermost_server
Related CWEs: CWE-918
Related CAPECs: CAPEC-664
References: https://mattermost.com/security-updates
CWE: CWE-918
CVE-2025-0075
In process_service_search_attr_req of sdp_server.cc, there is a possible way to execute arbitrary code due to a use after free. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS v3.1 Score: 9.8 (CRITICAL)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Products: android
Related CWEs: CWE-416
References: https://android.googlesource.com/platform/packages/modules/Bluetooth/+/5959f8bcf4efe924b0ba4dbcbfe83e602f0eb0ac, https://source.android.com/security/bulletin/2025-03-01
CWE: CWE-416
CVE-2025-47089
Adobe Experience Manager versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
CVSS v3.1 Score: 5.4 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected Products: experience_manager
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: https://helpx.adobe.com/security/products/experience-manager/apsb25-48.html
CWE: CWE-79
CVE-2025-10985
OS command injection in the admin panel of Ivanti EPMM before version 12.6.0.2, 12.5.0.4, and 12.4.0.4 allows a remote authenticated attacker with admin privileges to achieve remote code execution.
CVSS v3.1 Score: 7.2 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Affected Products: endpoint_manager_mobile
Related CWEs: CWE-78
Related CAPECs: CAPEC-43, CAPEC-6, CAPEC-88
References: https://forums.ivanti.com/s/article/Security-Advisory-Endpoint-Manager-Mobile-EPMM-10-2025-Multiple-CVEs?language=en_US
CWE: CWE-78
CVE-2025-55335
Use after free in Windows NTFS allows an unauthorized attacker to elevate privileges locally.
CVSS v3.1 Score: 7.4 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Products: windows_10_1809, windows_server_2012, windows_11_22h2, windows_11_23h2, windows_11_24h2
Related CWEs: CWE-362, CWE-416
Related CAPECs: CAPEC-29, CAPEC-26
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-55335
CWE: CWE-362, CWE-416
CVE-2025-68597
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BlueGlass Interactive AG Jobs for WordPress job-postings allows Stored XSS.This issue affects Jobs for WordPress: from n/a through <= 2.8.1.
CVSS v3.1 Score: 5.4 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: https://patchstack.com/database/Wordpress/Plugin/job-postings/vulnerability/wordpress-jobs-for-wordpress-plugin-2-7-17-cross-site-scripting-xss-vulnerability?_s_id=cve
CWE: CWE-79
CVE-2025-31391
Cross-Site Request Forgery (CSRF) vulnerability in regen Script Compressor script-compressor allows Stored XSS.This issue affects Script Compressor: from n/a through <= 1.7.1.
Related CWEs: CWE-352
Related CAPECs: CAPEC-467, CAPEC-111, CAPEC-462
References: https://patchstack.com/database/Wordpress/Plugin/script-compressor/vulnerability/wordpress-script-compressor-plugin-1-7-1-csrf-to-stored-xss-vulnerability?_s_id=cve
CWE: CWE-352
CVE-2025-40624
SQL injection in TCMAN's GIM v11. This vulnerability allows an unauthenticated attacker to inject an SQL statement to obtain, update and delete all information in the database. This vulnerability was found in each of the following parameters according to the vulnerability identifier ‘User’ and “email” parameters of the ‘updatePassword’ endpoint.
CVSS v3.1 Score: 9.8 (CRITICAL)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Products: gim
Related CWEs: CWE-89
Related CAPECs: CAPEC-7, CAPEC-470, CAPEC-108
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-tcmans-gim
CWE: CWE-89
CVE-2025-22003
In the Linux kernel, the following vulnerability has been resolved:

can: ucan: fix out of bound read in strscpy() source

Commit 7fdaf8966aae ("can: ucan: use strscpy() to instead of strncpy()")
unintentionally introduced a one byte out of bound read on strscpy()'s
source argument (which is kind of ironic knowing that strscpy() is meant
to be a more secure alternative :)).

Let's consider below buffers:

  dest[len + 1]; /* will be NUL terminated */
  src[len]; /* may not be NUL terminated */

When doing:

  strncpy(dest, src, len);
  dest[len] = '\0';

strncpy() will read up to len bytes from src.

On the other hand:

  strscpy(dest, src, len + 1);

will read up to len + 1 bytes from src, that is to say, an out of bound
read of one byte will occur on src if it is not NUL terminated. Note
that the src[len] byte is never copied, but strscpy() still needs to
read it to check whether a truncation occurred or not.

This exact pattern happened in ucan.

The root cause is that the source is not NUL terminated. Instead of
doing a copy in a local buffer, directly NUL terminate it as soon as
usb_control_msg() returns. With this, the local firmware_str[] variable
can be removed.

On top of this do a couple refactors:

  - ucan_ctl_payload->raw is only used for the firmware string, so
    rename it to ucan_ctl_payload->fw_str and change its type from u8 to
    char.

  - ucan_device_request_in() is only used to retrieve the firmware
    string, so rename it to ucan_get_fw_str() and refactor it to make it
    directly handle all the string termination logic.
CVSS v3.1 Score: 5.5 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Affected Products: linux_kernel
Related CWEs: CWE-125
Related CAPECs: CAPEC-540
References: https://git.kernel.org/stable/c/1d22a122ffb116c3cf78053e812b8b21f8852ee9, https://git.kernel.org/stable/c/8cec9e314d3360fc1d8346297c41a6ee45cb45a9, https://git.kernel.org/stable/c/a4994161a61bc8fd71d105c579d847cefee99262
CWE: CWE-125
CVE-2025-28882
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Omnify, Inc. Omnify omnify-widget allows Reflected XSS.This issue affects Omnify: from n/a through <= 2.0.3.
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: https://patchstack.com/database/Wordpress/Plugin/omnify-widget/vulnerability/wordpress-omnify-plugin-2-0-3-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CWE: CWE-79
CVE-2025-59559
Missing Authorization vulnerability in payrexx Payrexx Payment Gateway for WooCommerce woo-payrexx-gateway allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Payrexx Payment Gateway for WooCommerce: from n/a through <= 3.1.5.
Related CWEs: CWE-862
Related CAPECs: CAPEC-665
MITRE ATT&CK Techniques: T1211, T1556, T1542.002
MITRE ATT&CK Tactics: T1542
References: https://patchstack.com/database/Wordpress/Plugin/woo-payrexx-gateway/vulnerability/wordpress-payrexx-payment-gateway-for-woocommerce-plugin-3-1-5-broken-access-control-vulnerability?_s_id=cve
CWE: CWE-862
MITRE ATT&CK techniques: T1211, T1556, T1542.002
MITRE ATT&CK tactics: T1542
CVE-2025-10150
Webserver crash caused by scanning on TCP port 80 in Softing Industrial Automation GmbH gateways and switch.This issue affects

smartLink HW-PN: from 1.02 through 1.03

smartLink HW-DP: 1.31
Related CWEs: CWE-833
Related CAPECs: CAPEC-25
MITRE ATT&CK Techniques: T1499.004
MITRE ATT&CK Tactics: T1499
References: https://industrial.softing.com/fileadmin/psirt/downloads/2025/CVE-2025-10150.html, https://industrial.softing.com/fileadmin/psirt/downloads/2025/CVE-2025-10150.json
CWE: CWE-833
MITRE ATT&CK techniques: T1499.004
MITRE ATT&CK tactics: T1499
CVE-2025-57945
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in cedcommerce WP Advanced PDF wp-advanced-pdf allows Stored XSS.This issue affects WP Advanced PDF: from n/a through <= 1.1.7.
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: https://patchstack.com/database/Wordpress/Plugin/wp-advanced-pdf/vulnerability/wordpress-wp-advanced-pdf-plugin-1-1-7-cross-site-scripting-xss-vulnerability?_s_id=cve
CWE: CWE-79
CVE-2025-23283
NVIDIA vGPU software for Linux-style hypervisors contains a vulnerability in the Virtual GPU Manager, where a malicious guest could cause stack buffer overflow. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, or data tampering.
CVSS v3.1 Score: 7.8 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Related CWEs: CWE-121
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5670
CWE: CWE-121
CVE-2025-9429
A security vulnerability has been detected in mtons mblog up to 3.5.0. This vulnerability affects unknown code of the file /post/submit of the component Post Handler. The manipulation of the argument content/title/ leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used.
CVSS v3.1 Score: 3.5 (LOW)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
CVSS v2.0 Score: 4.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:S/C:N/I:P/A:N
Affected Products: mblog
Related CWEs: CWE-94, CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
MITRE ATT&CK Techniques: T1027.006, T1564.009, T1027.009
MITRE ATT&CK Tactics: T1564, T1027
References: https://gitee.com/mtons/mblog/issues/ICPMLJ, https://gitee.com/mtons/mblog/issues/ICPMLW, https://vuldb.com/?ctiid.321270
CWE: CWE-94, CWE-79
MITRE ATT&CK techniques: T1027.006, T1564.009, T1027.009
MITRE ATT&CK tactics: T1564, T1027
CVE-2025-34313
IPFire versions prior to 2.29 (Core Update 198) contain a stored cross-site scripting (XSS) vulnerability that allows an authenticated attacker to inject arbitrary JavaScript code through the QUOTA_USERS parameter when creating a user quota rule. When a user adds a new user quota rule the application issues an HTTP POST request to /cgi-bin/urlfilter.cgi with the MODE parameter set to USERQUOTA and the assigned user(s) provided in the QUOTA_USERS parameter. The value of this parameter is stored and later rendered in the web interface without proper sanitation or encoding, allowing injected scripts to execute in the context of other users who view the affected quota entry.
CVSS v3.1 Score: 5.4 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected Products: ipfire
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: https://bugzilla.ipfire.org/show_bug.cgi?id=13888, https://www.ipfire.org/blog/ipfire-2-29-core-update-198-released, https://www.vulncheck.com/advisories/ipfire-stored-xss-via-user-quota-rule-url-filter
CWE: CWE-79
CVE-2025-2542
The Your Simple SVG Support plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
CVSS v3.1 Score: 6.4 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: https://plugins.trac.wordpress.org/browser/your-simple-svg-support/tags/1.0.0/your-simple-svg-support.php#L16, https://plugins.trac.wordpress.org/browser/your-simple-svg-support/tags/1.0.0/your-simple-svg-support.php#L20, https://plugins.trac.wordpress.org/changeset/3259951/
CWE: CWE-79
CVE-2025-61148
An Insecure Direct Object Reference (IDOR) vulnerability in the EduplusCampus 3.0.1 Student Payment API allows authenticated users to access other students personal and financial records by modifying the 'rec_no' parameter in the /student/get-receipt endpoint.
CVSS v3.1 Score: 6.5 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected Products: edupluscampus
Related CWEs: CWE-639
References: https://drive.google.com/file/d/1BRZRurbl7TY6KU4uaelAUn7L9Cn6XfjC/view?usp=sharing, https://github.com/sharma19d/CVE-2025-61148, https://medium.com/@Charon19d/how-i-hacked-all-universities-in-my-city-d6b8e320455c
CWE: CWE-639
CVE-2025-54381
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. In versions 1.4.0 until 1.4.19, the file upload processing system contains an SSRF vulnerability that allows unauthenticated remote attackers to force the server to make arbitrary HTTP requests. The vulnerability stems from the multipart form data and JSON request handlers, which automatically download files from user-provided URLs without validating whether those URLs point to internal network addresses, cloud metadata endpoints, or other restricted resources. The documentation explicitly promotes this URL-based file upload feature, making it an intended design that exposes all deployed services to SSRF attacks by default. Version 1.4.19 contains a patch for the issue.
CVSS v3.1 Score: 9.9 (CRITICAL)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:L
Affected Products: bentoml
Related CWEs: CWE-918
Related CAPECs: CAPEC-664
References: https://github.com/bentoml/BentoML/commit/534c3584621da4ab954bdc3d814cc66b95ae5fb8, https://github.com/bentoml/BentoML/security/advisories/GHSA-mrmq-3q62-6cc8, https://github.com/bentoml/BentoML/security/advisories/GHSA-mrmq-3q62-6cc8
CWE: CWE-918
CVE-2025-2334
A vulnerability classified as problematic has been found in 274056675 springboot-openai-chatgpt e84f6f5. This affects the function deleteChat of the file /api/mjkj-chat/chat/ai/delete/chat of the component Chat History Handler. The manipulation of the argument chatListId leads to improper access controls. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS v3.1 Score: 5.4 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
CVSS v2.0 Score: 5.5 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:S/C:N/I:P/A:P
Affected Products: springboot-openai-chatgpt
Related CWEs: CWE-266, CWE-284
Related CAPECs: CAPEC-563, CAPEC-536, CAPEC-478
MITRE ATT&CK Techniques: T1014, T1562.001, T1543.003
MITRE ATT&CK Tactics: T1556, T1546, T1547
References: https://vuldb.com/?ctiid.299799, https://vuldb.com/?id.299799, https://vuldb.com/?submit.505688
CWE: CWE-266, CWE-284
MITRE ATT&CK techniques: T1014, T1562.001, T1543.003, T1546.008, T1037, T1562.007, T1027.009, T1543.001, T1547, T1543.004, T1562.002, T1553.004, T1546.016, T1080, T1574.011, T1556.006, T1543, T1546.004, T1547.006, T1546.001, T1562.004, T1542.003, T1505.005, T1562.008, T1562.009
MITRE ATT&CK tactics: T1556, T1546, T1547, T1542, T1505, T1553, T1562, T1574, T1543, T1027
CVE-2025-23300
NVIDIA Display Driver for Linux contains a vulnerability in the kernel driver, where a user could cause a null pointer dereference by allocating a specific memory resource. A successful exploit of this vulnerability might lead to denial of service.
CVSS v3.1 Score: 5.5 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Related CWEs: CWE-476
References: https://nvd.nist.gov/vuln/detail/CVE-2025-23300, https://nvidia.custhelp.com/app/answers/detail/a_id/5703, https://www.cve.org/CVERecord?id=CVE-2025-23300
CWE: CWE-476
CVE-2025-2366
A vulnerability, which was classified as problematic, was found in gougucms 4.08.18. This affects the function add of the file /admin/department/add of the component Add Department Page. The manipulation of the argument title leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v3.1 Score: 2.4 (LOW)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N
CVSS v2.0 Score: 3.3 (LOW)
CVSS v2.0 Vector: AV:N/AC:L/Au:M/C:N/I:P/A:N
Related CWEs: CWE-94, CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
MITRE ATT&CK Techniques: T1027.006, T1564.009, T1027.009
MITRE ATT&CK Tactics: T1564, T1027
References: https://github.com/caigo8/CVE-md/blob/main/gougucms/gougucms_v4.08.18_XSS.md, https://vuldb.com/?ctiid.299865, https://vuldb.com/?id.299865
CWE: CWE-94, CWE-79
MITRE ATT&CK techniques: T1027.006, T1564.009, T1027.009
MITRE ATT&CK tactics: T1564, T1027
CVE-2025-25525
Buffer overflow vulnerability in H3C FA3010L access points SWFA1B0V100R005 due to the lack of length verification, which is related to the setting of firewall rules. Attackers who successfully exploit this vulnerability can cause the remote target device to crash or execute arbitrary commands.
CVSS v3.1 Score: 5.1 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Related CWEs: CWE-120
Related CAPECs: CAPEC-14, CAPEC-92, CAPEC-45
References: https://gist.github.com/XiaoCurry/d797c3cce41678028ff2d20c4e12137e
CWE: CWE-120
CVE-2025-6364
A vulnerability has been found in code-projects Simple Pizza Ordering System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /adduser-exec.php. The manipulation of the argument Username leads to sql injection. The attack can be launched remotely.
CVSS v3.1 Score: 7.3 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: simple_pizza_ordering_system
Related CWEs: CWE-89, CWE-74
Related CAPECs: CAPEC-53, CAPEC-51, CAPEC-9
MITRE ATT&CK Techniques: T1574.006, T1574.007, T1027
MITRE ATT&CK Tactics: T1562, T1574
References: https://code-projects.org/, https://github.com/rom4j/cve/issues/6, https://vuldb.com/?ctiid.313357
CWE: CWE-89, CWE-74
MITRE ATT&CK techniques: T1574.006, T1574.007, T1027, T1562.003
MITRE ATT&CK tactics: T1562, T1574
CVE-2025-43328
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Tahoe 26. An app may be able to access sensitive user data.
CVSS v3.1 Score: 3.3 (LOW)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Affected Products: macos
Related CWEs: CWE-284
Related CAPECs: CAPEC-563, CAPEC-536, CAPEC-478
MITRE ATT&CK Techniques: T1014, T1562.001, T1543.003
MITRE ATT&CK Tactics: T1556, T1546, T1547
References: https://support.apple.com/en-us/125110, http://seclists.org/fulldisclosure/2025/Sep/53
CWE: CWE-284
MITRE ATT&CK techniques: T1014, T1562.001, T1543.003, T1546.008, T1037, T1562.007, T1027.009, T1543.001, T1547, T1543.004, T1562.002, T1553.004, T1546.016, T1080, T1574.011, T1556.006, T1543, T1546.004, T1547.006, T1546.001, T1562.004, T1542.003, T1505.005, T1562.008, T1562.009
MITRE ATT&CK tactics: T1556, T1546, T1547, T1542, T1505, T1553, T1562, T1574, T1543, T1027
CVE-2025-8267
Versions of the package ssrfcheck before 1.2.0 are vulnerable to Server-Side Request Forgery (SSRF) due to an incomplete denylist of IP address ranges. Specifically, the package fails to classify the reserved IP address space 224.0.0.0/4 (Multicast) as invalid. This oversight allows attackers to craft requests targeting these multicast addresses.
CVSS v3.1 Score: 8.2 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Affected Products: ssrf_check
Related CWEs: CWE-918
Related CAPECs: CAPEC-664
References: https://gist.github.com/lirantal/2976840639df824cb3abe60d13c65e04, https://github.com/felippe-regazio/ssrfcheck/commit/9507b49fd764f2a1a1d1e3b9ee577b7545e6950e, https://github.com/felippe-regazio/ssrfcheck/issues/5
CWE: CWE-918
CVE-2025-57801
gnark is a zero-knowledge proof system framework. In versions prior to 0.14.0, the Verify function in eddsa.go and ecdsa.go used the S value from a signature without asserting that 0 ≤ S < order, leading to a signature malleability vulnerability. Because gnark’s native EdDSA and ECDSA circuits lack essential constraints, multiple distinct witnesses can satisfy the same public inputs. In protocols where nullifiers or anti-replay checks are derived from R and S, this enables signature malleability and may allow double spending. This issue has been addressed in version 0.14.0.
CVSS v3.1 Score: 9.1 (CRITICAL)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Affected Products: gnark
Related CWEs: CWE-347
Related CAPECs: CAPEC-475, CAPEC-463
References: https://github.com/Consensys/gnark/commit/0ba6730f05537a351517998add89a61a0d82716e, https://github.com/Consensys/gnark/security/advisories/GHSA-95v9-hv42-pwrj
CWE: CWE-347
CVE-2025-20081
in OpenHarmony v5.0.2 and prior versions allow a local attacker arbitrary code execution in pre-installed apps through use after free. This vulnerability can be exploited only in restricted scenarios.
CVSS v3.1 Score: 3.8 (LOW)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
Affected Products: openharmony
Related CWEs: CWE-416
References: https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2025/2025-03.md
CWE: CWE-416
CVE-2025-25604
Totolink X5000R V9.1.0u.6369_B20230113 is vulnerable to command injection via the vif_disable function in mtkwifi.lua.
CVSS v3.1 Score: 6.5 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Affected Products: x5000r, x5000r_firmware
Related CWEs: CWE-77
Related CAPECs: CAPEC-43, CAPEC-183, CAPEC-76
References: https://github.com/sezangel/IOT-vul/tree/main/Totolink/X5000R/5
CWE: CWE-77
CVE-2025-53009
MaterialX is an open standard for the exchange of rich material and look-development content across applications and renderers. In versions 1.39.2 and below, when parsing an MTLX file with multiple nested nodegraph implementations, the MaterialX XML parsing logic can potentially crash due to stack exhaustion. An attacker could intentionally crash a target program that uses OpenEXR by sending a malicious MTLX file. This is fixed in version 1.39.3.
CVSS v3.1 Score: 7.5 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products: materialx
Related CWEs: CWE-121
References: https://github.com/AcademySoftwareFoundation/MaterialX/issues/2504, https://github.com/AcademySoftwareFoundation/MaterialX/pull/2505, https://github.com/AcademySoftwareFoundation/MaterialX/releases/tag/v1.39.3
CWE: CWE-121
CVE-2025-45859
TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain a buffer overflow via the bandstr parameter in the formMapDelDevice interface.
CVSS v3.1 Score: 5.4 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Affected Products: a3002r_firmware, a3002r
Related CWEs: CWE-120
Related CAPECs: CAPEC-14, CAPEC-92, CAPEC-45
References: https://github.com/Jiangxiazhe/IOT_hack/blob/main/TOTOLINK/A3002R/4/overflow.md, https://www.totolink.net/home/menu/detail/menu_listtpl/download/id/258/ids/36.html
CWE: CWE-120
CVE-2025-26523
This vulnerability exists in RupeeWeb trading platform due to insufficient authorization controls on certain API endpoints handling addition and deletion operations. Successful exploitation of this vulnerability could allow an authenticated remote attacker to modify information belonging to other user accounts.
Related CWEs: CWE-266
References: https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2025-0020
CWE: CWE-266