DuyTa/cve-kgrag-db huggingface dataset:
CVE-2025-24787
WhoDB is an open source database management tool. In affected versions the application is vulnerable to parameter injection in database connection strings, which allows an attacker to read local files on the machine the application is running on. The application uses string concatenation to build database connection URIs which are then passed to corresponding libraries responsible for setting up the database connections. This string concatenation is done unsafely and without escaping or encoding the user input. This allows an user, in many cases, to inject arbitrary parameters into the URI string. These parameters can be potentially dangerous depending on the libraries used. One of these dangerous parameters is `allowAllFiles` in the library `github.com/go-sql-driver/mysql`. Should this be set to `true`, the library enables running the `LOAD DATA LOCAL INFILE` query on any file on the host machine (in this case, the machine that WhoDB is running on). By injecting `&allowAllFiles=true` into the connection URI and connecting to any MySQL server (such as an attacker-controlled one), the attacker is able to read local files. This issue has been addressed in version 0.45.0 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS v3.1 Score: 8.6 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Affected Products: whodb
Related CWEs: CWE-943
Related CAPECs: CAPEC-676
References: https://github.com/clidey/whodb/security/advisories/GHSA-c7w4-9wv8-7x7c, https://github.com/go-sql-driver/mysql/blob/7403860363ca112af503b4612568c3096fecb466/infile.go#L128, https://github.com/clidey/whodb/security/advisories/GHSA-c7w4-9wv8-7x7c
CWE: CWE-943
CVE-2025-3187
A vulnerability was found in PHPGurukul e-Diary Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /login.php. The manipulation of the argument logindetail leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS v3.1 Score: 7.3 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: e-diary_management_system
Related CWEs: CWE-89, CWE-74
Related CAPECs: CAPEC-53, CAPEC-51, CAPEC-9
MITRE ATT&CK Techniques: T1574.006, T1574.007, T1027
MITRE ATT&CK Tactics: T1562, T1574
References: https://github.com/TiggerT/MyCVE/issues/1, https://phpgurukul.com/, https://vuldb.com/?ctiid.303146
CWE: CWE-89, CWE-74
MITRE ATT&CK techniques: T1574.006, T1574.007, T1027, T1562.003
MITRE ATT&CK tactics: T1562, T1574
CVE-2025-8637
Kenwood DMX958XR Firmware Update Command Injection Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Kenwood DMX958XR devices. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the firmware update process. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-26260.
CVSS v3.0 Score: 6.8 (MEDIUM)
CVSS v3.0 Vector: CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Products: dmx958xr, dmx958xr_firmware
Related CWEs: CWE-78
Related CAPECs: CAPEC-43, CAPEC-6, CAPEC-88
References: https://www.zerodayinitiative.com/advisories/ZDI-25-785/
CWE: CWE-78
CVE-2025-41762
An unauthenticated attacker can abuse the weak hash of the backup generated by the wwwdnload.cgi endpoint to gain unauthorized access to sensitive data, including password hashes and certificates.
CVSS v3.1 Score: 6.2 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected Products: ubr-02, universal_bacnet_router_firmware, ubr-01_mk_ii, ubr-lon
Related CWEs: CWE-328
Related CAPECs: CAPEC-461, CAPEC-68
MITRE ATT&CK Techniques: T1553.002
MITRE ATT&CK Tactics: T1553
References: https://www.mbs-solutions.de/mbs-2025-0001
CWE: CWE-328
MITRE ATT&CK techniques: T1553.002
MITRE ATT&CK tactics: T1553
CVE-2025-38217
In the Linux kernel, the following vulnerability has been resolved:

hwmon: (ftsteutates) Fix TOCTOU race in fts_read()

In the fts_read() function, when handling hwmon_pwm_auto_channels_temp,
the code accesses the shared variable data->fan_source[channel] twice
without holding any locks. It is first checked against
FTS_FAN_SOURCE_INVALID, and if the check passes, it is read again
when used as an argument to the BIT() macro.

This creates a Time-of-Check to Time-of-Use (TOCTOU) race condition.
Another thread executing fts_update_device() can modify the value of
data->fan_source[channel] between the check and its use. If the value
is changed to FTS_FAN_SOURCE_INVALID (0xff) during this window, the
BIT() macro will be called with a large shift value (BIT(255)).
A bit shift by a value greater than or equal to the type width is
undefined behavior and can lead to a crash or incorrect values being
returned to userspace.

Fix this by reading data->fan_source[channel] into a local variable
once, eliminating the race condition. Additionally, add a bounds check
to ensure the value is less than BITS_PER_LONG before passing it to
the BIT() macro, making the code more robust against undefined behavior.

This possible bug was found by an experimental static analysis tool
developed by our team.
CVSS v3.1 Score: 4.7 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Affected Products: linux_kernel
Related CWEs: CWE-367
Related CAPECs: CAPEC-29, CAPEC-27
References: https://git.kernel.org/stable/c/14c9ede9ca4cd078ad76a6ab9617b81074eb58bf, https://git.kernel.org/stable/c/4d646f627d3b7ed1cacca66e598af8bcd632d465, https://git.kernel.org/stable/c/83e2ba8971ccd8fc08319fc7593288f070d80a76
CWE: CWE-367
CVE-2025-51970
A SQL Injection vulnerability exists in the action.php endpoint of PuneethReddyHC Online Shopping System Advanced 1.0 due to improper sanitization of user-supplied input in the keyword POST parameter.
CVSS v3.1 Score: 7.7 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected Products: online_shopping_system_advanced
Related CWEs: CWE-89
Related CAPECs: CAPEC-7, CAPEC-470, CAPEC-108
References: https://gist.github.com/im4x/10738ee219d69024387737fb14cdba9f, https://github.com/jairajparyani/CVE-s/blob/main/CVE-2025-51970%20%E2%80%93%20SQL%20Injection%20Vulnerability%20in%20Online%20Shopping%20System%20Advanced
CWE: CWE-89
CVE-2025-15342
Tanium addressed an improper access controls vulnerability in Reputation.
CVSS v3.1 Score: 4.3 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Affected Products: reputation
Related CWEs: CWE-863
References: https://security.tanium.com/TAN-2025-030
CWE: CWE-863
CVE-2025-23573
Cross-Site Request Forgery (CSRF) vulnerability in sammyb WP Background Tile wp-background-tile allows Stored XSS.This issue affects WP Background Tile: from n/a through <= 1.0.
Related CWEs: CWE-352
Related CAPECs: CAPEC-467, CAPEC-111, CAPEC-462
References: https://patchstack.com/database/Wordpress/Plugin/wp-background-tile/vulnerability/wordpress-wp-background-tile-plugin-1-0-csrf-to-stored-xss-vulnerability?_s_id=cve
CWE: CWE-352
CVE-2025-71192
In the Linux kernel, the following vulnerability has been resolved:

ALSA: ac97: fix a double free in snd_ac97_controller_register()

If ac97_add_adapter() fails, put_device() is the correct way to drop
the device reference. kfree() is not required.
Add kfree() if idr_alloc() fails and in ac97_adapter_release() to do
the cleanup.

Found by code review.
References: https://git.kernel.org/stable/c/21f8bc5179bed91c3f946adb5e55d717b891960c, https://git.kernel.org/stable/c/830988b6cf197e6dcffdfe2008c5738e6c6c3c0f, https://git.kernel.org/stable/c/c80f9b3349a99a9d5b295f5bbc23f544c5995ad7
CVE-2025-40122
In the Linux kernel, the following vulnerability has been resolved:

perf/x86/intel: Fix IA32_PMC_x_CFG_B MSRs access error

When running perf_fuzzer on PTL, sometimes the below "unchecked MSR
 access error" is seen when accessing IA32_PMC_x_CFG_B MSRs.

[   55.611268] unchecked MSR access error: WRMSR to 0x1986 (tried to write 0x0000000200000001) at rIP: 0xffffffffac564b28 (native_write_msr+0x8/0x30)
[   55.611280] Call Trace:
[   55.611282]  <TASK>
[   55.611284]  ? intel_pmu_config_acr+0x87/0x160
[   55.611289]  intel_pmu_enable_acr+0x6d/0x80
[   55.611291]  intel_pmu_enable_event+0xce/0x460
[   55.611293]  x86_pmu_start+0x78/0xb0
[   55.611297]  x86_pmu_enable+0x218/0x3a0
[   55.611300]  ? x86_pmu_enable+0x121/0x3a0
[   55.611302]  perf_pmu_enable+0x40/0x50
[   55.611307]  ctx_resched+0x19d/0x220
[   55.611309]  __perf_install_in_context+0x284/0x2f0
[   55.611311]  ? __pfx_remote_function+0x10/0x10
[   55.611314]  remote_function+0x52/0x70
[   55.611317]  ? __pfx_remote_function+0x10/0x10
[   55.611319]  generic_exec_single+0x84/0x150
[   55.611323]  smp_call_function_single+0xc5/0x1a0
[   55.611326]  ? __pfx_remote_function+0x10/0x10
[   55.611329]  perf_install_in_context+0xd1/0x1e0
[   55.611331]  ? __pfx___perf_install_in_context+0x10/0x10
[   55.611333]  __do_sys_perf_event_open+0xa76/0x1040
[   55.611336]  __x64_sys_perf_event_open+0x26/0x30
[   55.611337]  x64_sys_call+0x1d8e/0x20c0
[   55.611339]  do_syscall_64+0x4f/0x120
[   55.611343]  entry_SYSCALL_64_after_hwframe+0x76/0x7e

On PTL, GP counter 0 and 1 doesn't support auto counter reload feature,
thus it would trigger a #GP when trying to write 1 on bit 0 of CFG_B MSR
which requires to enable auto counter reload on GP counter 0.

The root cause of causing this issue is the check for auto counter
reload (ACR) counter mask from user space is incorrect in
intel_pmu_acr_late_setup() helper. It leads to an invalid ACR counter
mask from user space could be set into hw.config1 and then written into
CFG_B MSRs and trigger the MSR access warning.

e.g., User may create a perf event with ACR counter mask (config2=0xcb),
and there is only 1 event created, so "cpuc->n_events" is 1.

The correct check condition should be "i + idx >= cpuc->n_events"
instead of "i + idx > cpuc->n_events" (it looks a typo). Otherwise,
the counter mask would traverse twice and an invalid "cpuc->assign[1]"
bit (bit 0) is set into hw.config1 and cause MSR accessing error.

Besides, also check if the ACR counter mask corresponding events are
ACR events. If not, filter out these counter mask. If a event is not a
ACR event, it could be scheduled to an HW counter which doesn't support
ACR. It's invalid to add their counter index in ACR counter mask.

Furthermore, remove the WARN_ON_ONCE() since it's easily triggered as
user could set any invalid ACR counter mask and the warning message
could mislead users.
References: https://git.kernel.org/stable/c/43796f30507802d93ead2dc44fc9637f34671a89, https://git.kernel.org/stable/c/c6cca4213b618c92e4972919ee568f0fb87313b1
CVE-2025-69990
phpgurukul News Portal Project V4.1 has an Arbitrary File Deletion Vulnerability in remove_file.php. The parameter file can cause any file to be deleted.
CVSS v3.1 Score: 9.1 (CRITICAL)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Affected Products: news_portal
Related CWEs: CWE-552
Related CAPECs: CAPEC-150, CAPEC-639
MITRE ATT&CK Techniques: T1552.006, T1602, T1555
MITRE ATT&CK Tactics: T1552
References: https://github.com/Y4y17/CVE/blob/main/News%20Portal%20Project/File%20deletion%20vulnerability.md
CWE: CWE-552
MITRE ATT&CK techniques: T1552.006, T1602, T1555, T1213, T1039, T1119, T1552.001, T1003, T1530, T1552.004, T1552.003
MITRE ATT&CK tactics: T1552
CVE-2025-56382
A stored Cross-site scripting (XSS) vulnerability exists in the Customer Management Module of LionCoders SalePro POS 5.4.8. An authenticated attacker can inject arbitrary web script or HTML via the 'Customer Name' parameter when creating or editing customer profiles. This malicious input is improperly sanitized before storage and subsequent rendering, leading to script execution in the browsers of users who view the affected customer details.
CVSS v3.1 Score: 6.1 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected Products: salepro_pos
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: https://github.com/Auspicious-Rook/Vulnerability-Research/tree/main/CVE-2025-56382, https://preview.codecanyon.net/item/lims-stock-manager-pro-with-pos/full_screen_preview/22256829?_ga=2.221768668.538436323.1752589158-1013732256.1752073116
CWE: CWE-79
CVE-2025-36892
Denial of service
CVSS v3.1 Score: 7.5 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products: android
Related CWEs: CWE-400
Related CAPECs: CAPEC-147, CAPEC-492, CAPEC-227
MITRE ATT&CK Techniques: T1499
References: https://source.android.com/security/bulletin/pixel/2025-09-01
CWE: CWE-400
MITRE ATT&CK techniques: T1499
CVE-2025-52022
A vulnerability in the PHP backend of gemsloyalty.aptsys.com.sg thru 2025-05-28 allows unauthenticated remote attackers to trigger detailed error messages that disclose internal file paths, code snippets, and stack traces. This occurs when specially crafted HTTP GET/POST requests are sent to public API endpoints, exposing potentially sensitive information useful for further exploitation. This issue is classified under CWE-209: Information Exposure Through an Error Message.
CVSS v3.1 Score: 5.3 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected Products: gemscms_backend
Related CWEs: CWE-209
Related CAPECs: CAPEC-215, CAPEC-54, CAPEC-7
References: http://aptsys.com, https://gist.github.com/ReverseThatApp/4a6be2b9b2ba39d38c35c8753e0afd39
CWE: CWE-209
CVE-2025-29790
Contao is an Open Source CMS. Users can upload SVG files with malicious code, which is then executed in the back end and/or front end. This vulnerability is fixed in Contao 4.13.54, 5.3.30, or 5.5.6.
CVSS v3.1 Score: 5.4 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected Products: contao
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: https://contao.org/en/security-advisories/cross-site-scripting-through-svg-uploads, https://github.com/contao/contao/security/advisories/GHSA-vqqr-fgmh-f626
CWE: CWE-79
CVE-2025-6952
A vulnerability, which was classified as problematic, has been found in Open5GS up to 2.7.5. This issue affects the function amf_state_operational of the file src/amf/amf-sm.c of the component AMF Service. The manipulation leads to reachable assertion. It is possible to launch the attack on the local host. The identifier of the patch is 53e9e059ed96b940f7ddcd9a2b68cb512524d5db. It is recommended to apply a patch to fix this issue.
CVSS v3.1 Score: 3.3 (LOW)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
CVSS v2.0 Score: 1.7 (LOW)
CVSS v2.0 Vector: AV:L/AC:L/Au:S/C:N/I:N/A:P
Affected Products: open5gs
Related CWEs: CWE-617
References: https://github.com/open5gs/open5gs/commit/53e9e059ed96b940f7ddcd9a2b68cb512524d5db, https://github.com/open5gs/open5gs/issues/3938, https://github.com/open5gs/open5gs/issues/3938#issuecomment-3012139813
CWE: CWE-617
CVE-2025-5731
A flaw was found in Infinispan CLI. A sensitive password, decoded from a Base64-encoded Kubernetes secret, is processed in plaintext and included in a command string that may expose the data in an error message when a command is not found.
CVSS v3.1 Score: 5.5 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected Products: data_grid, infinispan, jboss_enterprise_application_platform_expansion_pack, jboss_enterprise_application_platform
Related CWEs: CWE-209
Related CAPECs: CAPEC-215, CAPEC-54, CAPEC-7
References: https://access.redhat.com/errata/RHSA-2025:10130, https://access.redhat.com/security/cve/CVE-2025-5731, https://bugzilla.redhat.com/show_bug.cgi?id=2370429
CWE: CWE-209
CVE-2025-30391
Improper input validation in Microsoft Dynamics allows an unauthorized attacker to disclose information over a network.
CVSS v3.1 Score: 8.1 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Products: dynamics_365_customer_service
Related CWEs: CWE-20
Related CAPECs: CAPEC-31, CAPEC-53, CAPEC-261
MITRE ATT&CK Techniques: T1574.006, T1553.002, T1574.007
MITRE ATT&CK Tactics: T1562, T1574, T1553
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-30391
CWE: CWE-20
MITRE ATT&CK techniques: T1574.006, T1553.002, T1574.007, T1539, T1036.001, T1562.003, T1027
MITRE ATT&CK tactics: T1562, T1574, T1553, T1036
CVE-2025-8912
Organization Portal System developed by WellChoose has an Arbitrary File Reading vulnerability, allowing unauthenticated remote attackers to exploit Absolute Path Traversal to download arbitrary system files.
CVSS v3.1 Score: 7.5 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected Products: organization_portal_system
Related CWEs: CWE-36, CWE-22
Related CAPECs: CAPEC-78, CAPEC-79, CAPEC-126
References: https://www.twcert.org.tw/en/cp-139-10325-70192-2.html, https://www.twcert.org.tw/tw/cp-132-10321-3cae5-1.html
CWE: CWE-36, CWE-22
CVE-2025-68665
LangChain is a framework for building LLM-powered applications. Prior to @langchain/core versions 0.3.80 and 1.1.8, and prior to langchain versions 0.3.37 and 1.2.3, a serialization injection vulnerability exists in LangChain JS's toJSON() method (and subsequently when string-ifying objects using JSON.stringify(). The method did not escape objects with 'lc' keys when serializing free-form data in kwargs. The 'lc' key is used internally by LangChain to mark serialized objects. When user-controlled data contains this key structure, it is treated as a legitimate LangChain object during deserialization rather than plain user data. This issue has been patched in @langchain/core versions 0.3.80 and 1.1.8, and langchain versions 0.3.37 and 1.2.3
CVSS v3.1 Score: 8.6 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Affected Products: langchain//core, langchain.js
Related CWEs: CWE-502
Related CAPECs: CAPEC-586
References: https://github.com/langchain-ai/langchainjs/commit/e5063f9c6e9989ea067dfdff39262b9e7b6aba62, https://github.com/langchain-ai/langchainjs/releases/tag/%40langchain%2Fcore%401.1.8, https://github.com/langchain-ai/langchainjs/releases/tag/langchain%401.2.3
CWE: CWE-502
CVE-2025-48558
In multiple functions of BatteryService.java, there is a possible way to hijack implicit intent intended for system app due to Implicit intent hijacking. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS v3.1 Score: 7.8 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected Products: android
Related CWEs: CWE-927
References: https://android.googlesource.com/platform/frameworks/base/+/0d30c78c8953adfc969a8dba8a58a8ea3571908c, https://source.android.com/security/bulletin/2025-09-01
CWE: CWE-927
CVE-2025-63016
Missing Authorization vulnerability in quadlayers QuadLayers TikTok Feed wp-tiktok-feed allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects QuadLayers TikTok Feed: from n/a through <= 4.6.5.
Related CWEs: CWE-862
Related CAPECs: CAPEC-665
MITRE ATT&CK Techniques: T1211, T1556, T1542.002
MITRE ATT&CK Tactics: T1542
References: https://patchstack.com/database/Wordpress/Plugin/wp-tiktok-feed/vulnerability/wordpress-quadlayers-tiktok-feed-plugin-4-6-4-broken-access-control-vulnerability?_s_id=cve
CWE: CWE-862
MITRE ATT&CK techniques: T1211, T1556, T1542.002
MITRE ATT&CK tactics: T1542
CVE-2025-22241
File contents overwrite the VirtKey class is called when “on-demand pillar” data is requested and uses un-validated input to create paths to the “pki directory”. The functionality is used to auto-accept Minion authentication keys based on a pre-placed “authorization file” at a specific location and is present in the default configuration.
CVSS v3.1 Score: 5.6 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N
Related CWEs: CWE-22
Related CAPECs: CAPEC-78, CAPEC-126, CAPEC-76
References: https://docs.saltproject.io/en/3006/topics/releases/3006.12.html, https://docs.saltproject.io/en/3007/topics/releases/3007.4.html
CWE: CWE-22
CVE-2025-11021
A flaw was found in the cookie date handling logic of the libsoup HTTP library, widely used by GNOME and other applications for web communication. When processing cookies with specially crafted expiration dates, the library may perform an out-of-bounds memory read. This flaw could result in unintended disclosure of memory contents, potentially exposing sensitive information from the process using libsoup.
CVSS v3.1 Score: 7.5 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Related CWEs: CWE-125
Related CAPECs: CAPEC-540
References: https://access.redhat.com/errata/RHSA-2025:18183, https://access.redhat.com/errata/RHSA-2025:19713, https://access.redhat.com/errata/RHSA-2025:19714
CWE: CWE-125
CVE-2025-4551
A vulnerability, which was classified as problematic, was found in ContiNew Admin up to 3.6.0. Affected is an unknown function of the file /dev-api/common/file. The manipulation of the argument File leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v3.1 Score: 3.5 (LOW)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
CVSS v2.0 Score: 4.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:S/C:N/I:P/A:N
Affected Products: continew_admin
Related CWEs: CWE-94, CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
MITRE ATT&CK Techniques: T1027.006, T1564.009, T1027.009
MITRE ATT&CK Tactics: T1564, T1027
References: https://github.com/uglory-gll/javasec/blob/main/continew-admin.md#1stored-cross-site-scripting, https://vuldb.com/?ctiid.308298, https://vuldb.com/?id.308298
CWE: CWE-94, CWE-79
MITRE ATT&CK techniques: T1027.006, T1564.009, T1027.009
MITRE ATT&CK tactics: T1564, T1027
CVE-2025-53560
Deserialization of Untrusted Data vulnerability in rascals Noisa noisa allows Object Injection.This issue affects Noisa: from n/a through <= 2.6.0.
Related CWEs: CWE-502
Related CAPECs: CAPEC-586
References: https://patchstack.com/database/Wordpress/Theme/noisa/vulnerability/wordpress-noisa-2-6-0-php-object-injection-vulnerability?_s_id=cve
CWE: CWE-502
CVE-2025-31644
When running in Appliance mode, a command injection vulnerability exists in an undisclosed iControl REST and BIG-IP TMOS Shell (tmsh) command which may allow an authenticated attacker with administrator role privileges to execute arbitrary system commands. A successful exploit can allow the attacker to cross a security boundary.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS v3.1 Score: 8.7 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N
Affected Products: big-ip_advanced_firewall_manager, big-ip_application_visibility_and_reporting, big-ip_domain_name_system, big-ip_advanced_web_application_firewall, big-ip_local_traffic_manager
Related CWEs: CWE-77
Related CAPECs: CAPEC-43, CAPEC-183, CAPEC-76
References: https://my.f5.com/manage/s/article/K000148591
CWE: CWE-77
CVE-2025-11255
The Password Policy Manager | Password Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'moppm_ajax' AJAX endpoint in all versions up to, and including, 2.0.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to log out the site's connection to miniorange.
CVSS v3.1 Score: 4.3 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Related CWEs: CWE-862
Related CAPECs: CAPEC-665
MITRE ATT&CK Techniques: T1211, T1556, T1542.002
MITRE ATT&CK Tactics: T1542
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3381127%40password-policy-manager&new=3381127%40password-policy-manager&sfp_email=&sfph_mail=, https://www.wordfence.com/threat-intel/vulnerabilities/id/66ac51f9-3571-4e07-a110-afec43abab37?source=cve
CWE: CWE-862
MITRE ATT&CK techniques: T1211, T1556, T1542.002
MITRE ATT&CK tactics: T1542
CVE-2025-51481
Local File Inclusion in dagster._grpc.impl.get_notebook_data in Dagster 1.10.14 allows attackers with access to the gRPC server to read arbitrary files by supplying path traversal sequences in the notebook_path field of ExternalNotebookData requests, bypassing the intended extension-based check.
CVSS v3.1 Score: 6.6 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L
Affected Products: dagster
Related CWEs: CWE-22
Related CAPECs: CAPEC-78, CAPEC-126, CAPEC-76
References: https://github.com/dagster-io/dagster, https://github.com/dagster-io/dagster/pull/30002, https://www.gecko.security/blog/cve-2025-51481
CWE: CWE-22
CVE-2025-15602
Snipe-IT versions prior to 8.3.7 contain sensitive user attributes related to account privileges that are insufficiently protected against mass assignment. An authenticated, low-privileged user can craft a malicious API request to modify restricted fields of another user account, including the Super Admin account. By changing the email address of the Super Admin and triggering a password reset, an attacker can fully take over the Super Admin account, resulting in complete administrative control of the Snipe-IT instance.
CVSS v3.1 Score: 8.8 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected Products: snipe-it
Related CWEs: CWE-915
References: https://github.com/grokability/snipe-it/releases/tag/v8.3.7, https://snipeitapp.com/, https://www.vulncheck.com/advisories/snipe-it-mass-assignment-vulnerability-leading-to-privilege-escalation
CWE: CWE-915
CVE-2025-30626
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup Multimedia Playlist Slider Addon for WPBakery Page Builder lbg_vp_youtube_vimeo_addon_visual_composer allows Reflected XSS.This issue affects Multimedia Playlist Slider Addon for WPBakery Page Builder: from n/a through <= 2.1.
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: https://patchstack.com/database/Wordpress/Plugin/lbg_vp_youtube_vimeo_addon_visual_composer/vulnerability/wordpress-multimedia-playlist-slider-addon-for-wpbakery-page-builder-2-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CWE: CWE-79
CVE-2025-59440
An issue was discovered in USIM in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, 990, 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, 1580, 2500, 9110, W920, W930, W1000, Modem 5123, Modem 5300, and Modem 5400. Improper handling of SIM card proactive commands leads to a Denial of Service.
CVSS v3.1 Score: 7.5 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products: exynos_1580, exynos_850, exynos_w1000_firmware, exynos_w930, exynos_modem_5300_firmware
Related CWEs: CWE-400
Related CAPECs: CAPEC-147, CAPEC-492, CAPEC-227
MITRE ATT&CK Techniques: T1499
References: https://semiconductor.samsung.com/support/quality-support/product-security-updates/, https://semiconductor.samsung.com/support/quality-support/product-security-updates/cve-2025-59440/
CWE: CWE-400
MITRE ATT&CK techniques: T1499
CVE-2025-64343
(conda) Constructor is a tool that enables users to create installers for conda package collections. In versions 3.12.2 and below, the  installation directory inherits permissions from its parent directory. Outside of restricted directories, the permissions are very permissive and often allow write access by authenticated users. Any logged in user can make modifications during the installation for both single-user and all-user installations. This constitutes a local attack vector if the installation is in a directory local users have access to. For single-user installations in a shared directory, these permissions persist after the installation. This issue is fixed in version 3.13.0.
CVSS v3.1 Score: 7.8 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Related CWEs: CWE-289
References: https://github.com/conda/constructor/commit/c368383710a7c2b81ad1b0ecb9724b38d3577447, https://github.com/conda/constructor/releases/tag/3.13.0, https://github.com/conda/constructor/security/advisories/GHSA-vvpr-2qg4-2mrq
CWE: CWE-289
CVE-2025-38478
In the Linux kernel, the following vulnerability has been resolved:

comedi: Fix initialization of data for instructions that write to subdevice

Some Comedi subdevice instruction handlers are known to access
instruction data elements beyond the first `insn->n` elements in some
cases.  The `do_insn_ioctl()` and `do_insnlist_ioctl()` functions
allocate at least `MIN_SAMPLES` (16) data elements to deal with this,
but they do not initialize all of that.  For Comedi instruction codes
that write to the subdevice, the first `insn->n` data elements are
copied from user-space, but the remaining elements are left
uninitialized.  That could be a problem if the subdevice instruction
handler reads the uninitialized data.  Ensure that the first
`MIN_SAMPLES` elements are initialized before calling these instruction
handlers, filling the uncopied elements with 0.  For
`do_insnlist_ioctl()`, the same data buffer elements are used for
handling a list of instructions, so ensure the first `MIN_SAMPLES`
elements are initialized for each instruction that writes to the
subdevice.
CVSS v3.1 Score: 5.5 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Affected Products: linux_kernel, debian_linux
Related CWEs: CWE-908
References: https://git.kernel.org/stable/c/020eed5681d0f9bced73970368078a92d6cfaa9c, https://git.kernel.org/stable/c/13e4d9038a1e869445a996a3f604a84ef52fe8f4, https://git.kernel.org/stable/c/46d8c744136ce2454aa4c35c138cc06817f92b8e
CWE: CWE-908
CVE-2025-21796
In the Linux kernel, the following vulnerability has been resolved:

nfsd: clear acl_access/acl_default after releasing them

If getting acl_default fails, acl_access and acl_default will be released
simultaneously. However, acl_access will still retain a pointer pointing
to the released posix_acl, which will trigger a WARNING in
nfs3svc_release_getacl like this:

------------[ cut here ]------------
refcount_t: underflow; use-after-free.
WARNING: CPU: 26 PID: 3199 at lib/refcount.c:28
refcount_warn_saturate+0xb5/0x170
Modules linked in:
CPU: 26 UID: 0 PID: 3199 Comm: nfsd Not tainted
6.12.0-rc6-00079-g04ae226af01f-dirty #8
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
1.16.1-2.fc37 04/01/2014
RIP: 0010:refcount_warn_saturate+0xb5/0x170
Code: cc cc 0f b6 1d b3 20 a5 03 80 fb 01 0f 87 65 48 d8 00 83 e3 01 75
e4 48 c7 c7 c0 3b 9b 85 c6 05 97 20 a5 03 01 e8 fb 3e 30 ff <0f> 0b eb
cd 0f b6 1d 8a3
RSP: 0018:ffffc90008637cd8 EFLAGS: 00010282
RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffff83904fde
RDX: dffffc0000000000 RSI: 0000000000000008 RDI: ffff88871ed36380
RBP: ffff888158beeb40 R08: 0000000000000001 R09: fffff520010c6f56
R10: ffffc90008637ab7 R11: 0000000000000001 R12: 0000000000000001
R13: ffff888140e77400 R14: ffff888140e77408 R15: ffffffff858b42c0
FS:  0000000000000000(0000) GS:ffff88871ed00000(0000)
knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000562384d32158 CR3: 000000055cc6a000 CR4: 00000000000006f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 ? refcount_warn_saturate+0xb5/0x170
 ? __warn+0xa5/0x140
 ? refcount_warn_saturate+0xb5/0x170
 ? report_bug+0x1b1/0x1e0
 ? handle_bug+0x53/0xa0
 ? exc_invalid_op+0x17/0x40
 ? asm_exc_invalid_op+0x1a/0x20
 ? tick_nohz_tick_stopped+0x1e/0x40
 ? refcount_warn_saturate+0xb5/0x170
 ? refcount_warn_saturate+0xb5/0x170
 nfs3svc_release_getacl+0xc9/0xe0
 svc_process_common+0x5db/0xb60
 ? __pfx_svc_process_common+0x10/0x10
 ? __rcu_read_unlock+0x69/0xa0
 ? __pfx_nfsd_dispatch+0x10/0x10
 ? svc_xprt_received+0xa1/0x120
 ? xdr_init_decode+0x11d/0x190
 svc_process+0x2a7/0x330
 svc_handle_xprt+0x69d/0x940
 svc_recv+0x180/0x2d0
 nfsd+0x168/0x200
 ? __pfx_nfsd+0x10/0x10
 kthread+0x1a2/0x1e0
 ? kthread+0xf4/0x1e0
 ? __pfx_kthread+0x10/0x10
 ret_from_fork+0x34/0x60
 ? __pfx_kthread+0x10/0x10
 ret_from_fork_asm+0x1a/0x30
 </TASK>
Kernel panic - not syncing: kernel: panic_on_warn set ...

Clear acl_access/acl_default after posix_acl_release is called to prevent
UAF from being triggered.
CVSS v3.1 Score: 7.8 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected Products: linux_kernel
Related CWEs: CWE-416
References: https://git.kernel.org/stable/c/1fd94884174bd20beb1773990fd3b1aa877688d9, https://git.kernel.org/stable/c/2e59b2b68782519560b3d6a41dd66a3d01a01cd3, https://git.kernel.org/stable/c/55d947315fb5f67a35e4e1d3e01bb886b9c6decf
CWE: CWE-416
CVE-2025-27494
A vulnerability has been identified in SiPass integrated AC5102 (ACC-G2) (All versions < V6.4.9), SiPass integrated ACC-AP (All versions < V6.4.9). Affected devices improperly sanitize input for the pubkey endpoint of the REST API. This could allow an authenticated remote administrator to escalate privileges by injecting arbitrary commands that are executed with root privileges.
CVSS v3.1 Score: 9.1 (CRITICAL)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Affected Products: sipass_integrated_ac5102_\(acc-g2\), sipass_integrated_ac5102_\(acc-g2\)_firmware, sipass_integrated_acc-ap_firmware, sipass_integrated_acc-ap
Related CWEs: CWE-20
Related CAPECs: CAPEC-31, CAPEC-53, CAPEC-261
MITRE ATT&CK Techniques: T1574.006, T1553.002, T1574.007
MITRE ATT&CK Tactics: T1562, T1574, T1553
References: https://cert-portal.siemens.com/productcert/html/ssa-515903.html
CWE: CWE-20
MITRE ATT&CK techniques: T1574.006, T1553.002, T1574.007, T1539, T1036.001, T1562.003, T1027
MITRE ATT&CK tactics: T1562, T1574, T1553, T1036
CVE-2025-38132
In the Linux kernel, the following vulnerability has been resolved:

coresight: holding cscfg_csdev_lock while removing cscfg from csdev

There'll be possible race scenario for coresight config:

CPU0                                          CPU1
(perf enable)                                 load module
                                              cscfg_load_config_sets()
                                              activate config. // sysfs
                                              (sys_active_cnt == 1)
...
cscfg_csdev_enable_active_config()
  lock(csdev->cscfg_csdev_lock)
                                              deactivate config // sysfs
                                              (sys_activec_cnt == 0)
                                              cscfg_unload_config_sets()
  <iterating config_csdev_list>               cscfg_remove_owned_csdev_configs()
  // here load config activate by CPU1
  unlock(csdev->cscfg_csdev_lock)

iterating config_csdev_list could be raced with config_csdev_list's
entry delete.

To resolve this race , hold csdev->cscfg_csdev_lock() while
cscfg_remove_owned_csdev_configs()
CVSS v3.1 Score: 5.5 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Affected Products: linux_kernel
References: https://git.kernel.org/stable/c/42f8afb0b161631fd1d814d017f75f955475ad41, https://git.kernel.org/stable/c/53b9e2659719b04f5ba7593f2af0f2335f75e94a
CVE-2025-38249
In the Linux kernel, the following vulnerability has been resolved:

ALSA: usb-audio: Fix out-of-bounds read in snd_usb_get_audioformat_uac3()

In snd_usb_get_audioformat_uac3(), the length value returned from
snd_usb_ctl_msg() is used directly for memory allocation without
validation. This length is controlled by the USB device.

The allocated buffer is cast to a uac3_cluster_header_descriptor
and its fields are accessed without verifying that the buffer
is large enough. If the device returns a smaller than expected
length, this leads to an out-of-bounds read.

Add a length check to ensure the buffer is large enough for
uac3_cluster_header_descriptor.
CVSS v3.1 Score: 7.1 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Affected Products: linux_kernel, debian_linux
Related CWEs: CWE-125
Related CAPECs: CAPEC-540
References: https://git.kernel.org/stable/c/0ee87c2814deb5e42921281116ac3abcb326880b, https://git.kernel.org/stable/c/11e740dc1a2c8590eb7074b5c4ab921bb6224c36, https://git.kernel.org/stable/c/24ff7d465c4284529bbfa207757bffb6f44b6403
CWE: CWE-125
CVE-2025-22271
The application or its infrastructure allows for IP address spoofing by providing its own value in the "X-Forwarded-For" header. Thus, the action logging mechanism in the application loses accountability


This issue affects CyberArk Endpoint Privilege Manager in SaaS version 24.7.1. The status of other versions is unknown. After multiple attempts to contact the vendor we did not receive any answer.
Related CWEs: CWE-290
Related CAPECs: CAPEC-21, CAPEC-459, CAPEC-94
MITRE ATT&CK Techniques: T1134, T1553.002, T1539
MITRE ATT&CK Tactics: T1134, T1550, T1553
References: https://cert.pl/en/posts/2025/02/CVE-2025-22270/, https://cert.pl/posts/2025/02/CVE-2025-22270/, https://docs.cyberark.com/epm/24.7.1/en/content/resources/_topnav/cc_home.htm
CWE: CWE-290
MITRE ATT&CK techniques: T1134, T1553.002, T1539, T1550.004, T1557, T1134.001, T1036.001, T1528
MITRE ATT&CK tactics: T1134, T1550, T1553, T1036
CVE-2025-43003
SAP S/4 HANA allows an authenticated attacker with user privileges to configure a field not intended for their access and create a custom UI layout displaying this field. On performing this step the attacker could gain access to highly sensitive information. This could cause a high impact on confidentiality and minimal impact on integrity and availability of the application.
CVSS v3.1 Score: 6.4 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:L
Related CWEs: CWE-749
Related CAPECs: CAPEC-500
References: https://me.sap.com/notes/3596033, https://url.sap/sapsecuritypatchday
CWE: CWE-749
CVE-2025-54228
InDesign Desktop versions 20.4, 19.5.4 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS v3.1 Score: 5.5 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Affected Products: windows, indesign, macos
Related CWEs: CWE-125
Related CAPECs: CAPEC-540
References: https://helpx.adobe.com/security/products/indesign/apsb25-79.html
CWE: CWE-125
CVE-2025-39429
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Földesi, Mihály Széchenyi 2020 Logo szechenyi-2020-logo allows PHP Local File Inclusion.This issue affects Széchenyi 2020 Logo: from n/a through <= 1.1.
Related CWEs: CWE-98
Related CAPECs: CAPEC-193
References: https://patchstack.com/database/Wordpress/Plugin/szechenyi-2020-logo/vulnerability/wordpress-szechenyi-2020-logo-1-1-local-file-inclusion-vulnerability?_s_id=cve
CWE: CWE-98
CVE-2025-24191
The issue was addressed with improved validation of environment variables. This issue is fixed in macOS Sequoia 15.4. An app may be able to modify protected parts of the file system.
CVSS v3.1 Score: 5.5 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Affected Products: macos
Related CWEs: CWE-20
Related CAPECs: CAPEC-31, CAPEC-53, CAPEC-261
MITRE ATT&CK Techniques: T1574.006, T1553.002, T1574.007
MITRE ATT&CK Tactics: T1562, T1574, T1553
References: https://support.apple.com/en-us/122373, http://seclists.org/fulldisclosure/2025/Apr/8
CWE: CWE-20
MITRE ATT&CK techniques: T1574.006, T1553.002, T1574.007, T1539, T1036.001, T1562.003, T1027
MITRE ATT&CK tactics: T1562, T1574, T1553, T1036
CVE-2025-8737
A vulnerability, which was classified as problematic, was found in zlt2000 microservices-platform up to 6.0.0. This affects the function onLogoutSuccess of the file src/main/java/com/central/oauth/handler/OauthLogoutSuccessHandler.java. The manipulation of the argument redirect_url leads to open redirect. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS v3.1 Score: 3.5 (LOW)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
CVSS v2.0 Score: 4.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:S/C:N/I:P/A:N
Related CWEs: CWE-601
Related CAPECs: CAPEC-178
References: https://github.com/zlt2000/microservices-platform/issues/78, https://github.com/zlt2000/microservices-platform/issues/78#issue-3264847333, https://vuldb.com/?ctiid.319233
CWE: CWE-601
CVE-2025-40803
A vulnerability has been identified in RUGGEDCOM RST2428P (6GK6242-6PA00) (All versions). The affected device exposes certain non-critical information from the device. This could allow an unauthenticated attacker to access sensitive data, potentially leading to a breach of confidentiality.
CVSS v3.1 Score: 3.1 (LOW)
CVSS v3.1 Vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected Products: ruggedcom_rst2428p, ruggedcom_rst2428p_firmware
Related CWEs: CWE-200
Related CAPECs: CAPEC-497, CAPEC-285, CAPEC-59
MITRE ATT&CK Techniques: T1036.005, T1574.007, T1217
MITRE ATT&CK Tactics: T1134, T1036, T1550
References: https://cert-portal.siemens.com/productcert/html/ssa-494539.html
CWE: CWE-200
MITRE ATT&CK techniques: T1036.005, T1574.007, T1217, T1590, T1135, T1069, T1057, T1124, T1595, T1134.001, T1087, T1033, T1574.006, T1111, T1120, T1592, T1016, T1046, T1082, T1049, T1083, T1550.004, T1615, T1007, T1562.003, T1018
MITRE ATT&CK tactics: T1134, T1036, T1550, T1562, T1574
CVE-2025-32951
Jmix is a set of libraries and tools to speed up Spring Boot data-centric application development. In versions 1.0.0 to 1.6.1 and 2.0.0 to 2.3.4, the input parameter, which consists of a file path and name, can be manipulated to return the Content-Type header with text/html if the name part ends with .html. This could allow malicious JavaScript code to be executed in the browser. For a successful attack, a malicious file needs to be uploaded beforehand. This issue has been patched in versions 1.6.2 and 2.4.0. A workaround is provided on the Jmix documentation website.
CVSS v3.1 Score: 6.4 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Affected Products: jmix_framework, cuba_rest_api, cuba_platform, jpa_web_api
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: https://docs.jmix.io/jmix/files-vulnerabilities.html, https://docs.jmix.io/jmix/files-vulnerabilities.html#disable-files-endpoint-in-jmix-application, https://github.com/jmix-framework/jmix/commit/6a66aa3adb967159a30d703e80403406f4c8f7a2
CWE: CWE-79
CVE-2025-14692
A flaw has been found in Mayan EDMS up to 4.10.1. The impacted element is an unknown function of the file /authentication/. This manipulation causes open redirect. It is possible to initiate the attack remotely. The exploit has been published and may be used. Upgrading to version 4.10.2 is sufficient to resolve this issue. The affected component should be upgraded. The vendor confirms that this is "[f]ixed in version 4.10.2". Furthermore, that "[b]ackports for older versions in process and will be out as soon as their respective CI pipelines complete."
CVSS v3.1 Score: 4.3 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N
Affected Products: mayan_edms
Related CWEs: CWE-601
Related CAPECs: CAPEC-178
References: https://docs.mayan-edms.com/chapters/releases/4.10.2.html, https://docs.mayan-edms.com/chapters/releases/4.10.2.html#security, https://github.com/ionutluca888/Mayan-EDMS-OpenRedirect-POC/tree/main
CWE: CWE-601
CVE-2025-46434
Missing Authorization vulnerability in POSIMYTH Innovation The Plus Addons for Elementor Pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects The Plus Addons for Elementor Pro: from n/a before 6.3.7.
CVSS v3.1 Score: 6.5 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Related CWEs: CWE-862
Related CAPECs: CAPEC-665
MITRE ATT&CK Techniques: T1211, T1556, T1542.002
MITRE ATT&CK Tactics: T1542
References: https://patchstack.com/database/wordpress/plugin/theplus_elementor_addon/vulnerability/wordpress-the-plus-addons-for-elementor-pro-plugin-6-3-7-broken-access-control-vulnerability?_s_id=cve
CWE: CWE-862
MITRE ATT&CK techniques: T1211, T1556, T1542.002
MITRE ATT&CK tactics: T1542
CVE-2025-8277
A flaw was found in libssh's handling of key exchange (KEX) processes when a client repeatedly sends incorrect KEX guesses. The library fails to free memory during these rekey operations, which can gradually exhaust system memory. This issue can lead to crashes on the client side, particularly when using libgcrypt, which impacts application stability and availability.
CVSS v3.1 Score: 3.1 (LOW)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L
Related CWEs: CWE-401
References: https://access.redhat.com/security/cve/CVE-2025-8277, https://bugzilla.redhat.com/show_bug.cgi?id=2383888
CWE: CWE-401
CVE-2025-25664
Tenda AC8V4 V16.03.34.06 was discovered to contain a stack overflow via the shareSpeed parameter in the sub_49E098 function.
CVSS v3.1 Score: 9.8 (CRITICAL)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Products: ac8, ac8_firmware
Related CWEs: CWE-787, CWE-120
Related CAPECs: CAPEC-14, CAPEC-92, CAPEC-45
References: https://github.com/jangfan/my-vuln/blob/main/Tenda/AC8V4/SetIpMacBind.md
CWE: CWE-787, CWE-120
CVE-2025-69317
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in scriptsbundle CarSpot carspot allows Reflected XSS.This issue affects CarSpot: from n/a through < 2.4.6.
CVSS v3.1 Score: 6.1 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: https://patchstack.com/database/Wordpress/Theme/carspot/vulnerability/wordpress-carspot-theme-2-4-6-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CWE: CWE-79
CVE-2025-47472
Missing Authorization vulnerability in codepeople Music Player for WooCommerce music-player-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Music Player for WooCommerce: from n/a through <= 1.5.1.
Related CWEs: CWE-862
Related CAPECs: CAPEC-665
MITRE ATT&CK Techniques: T1211, T1556, T1542.002
MITRE ATT&CK Tactics: T1542
References: https://patchstack.com/database/Wordpress/Plugin/music-player-for-woocommerce/vulnerability/wordpress-music-player-for-woocommerce-1-5-1-broken-access-control-vulnerability?_s_id=cve
CWE: CWE-862
MITRE ATT&CK techniques: T1211, T1556, T1542.002
MITRE ATT&CK tactics: T1542
CVE-2025-38701
In the Linux kernel, the following vulnerability has been resolved:

ext4: do not BUG when INLINE_DATA_FL lacks system.data xattr

A syzbot fuzzed image triggered a BUG_ON in ext4_update_inline_data()
when an inode had the INLINE_DATA_FL flag set but was missing the
system.data extended attribute.

Since this can happen due to a maiciouly fuzzed file system, we
shouldn't BUG, but rather, report it as a corrupted file system.

Add similar replacements of BUG_ON with EXT4_ERROR_INODE() ii
ext4_create_inline_data() and ext4_inline_data_truncate().
CVSS v3.1 Score: 5.5 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Affected Products: linux_kernel, debian_linux
Related CWEs: CWE-617
References: https://git.kernel.org/stable/c/099b847ccc6c1ad2f805d13cfbcc83f5b6d4bc42, https://git.kernel.org/stable/c/1199a6399895f4767f0b9a68a6ff47c3f799b7c7, https://git.kernel.org/stable/c/279c87ef7b9da34f65c2e4db586e730b667a6fb9
CWE: CWE-617
CVE-2025-29573
Cross-Site Scripting (XSS) vulnerability exists in Mezzanine CMS 6.0.0 in the "View Entries" feature within the Forms module.
CVSS v3.1 Score: 6.1 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected Products: mezzanine
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: https://github.com/stephenmcd/mezzanine, https://www.squadappsec.com/post/cve-2025-29573-persistent-xss-in-mezzanine-cms-6-0-0-via-malicious-filename
CWE: CWE-79