Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-7852 State: PUBLISHED Published: 2025-07-24T04:24:12.852Z Last Updated: 2025-07-24T13:36:47.798Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: iqonicdesign Products: WPBookit Problem Types: CWE-434 Description: The WPBookit plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the image_upload_handle() function hooked via the 'add_new_customer' route in all versions up to, and including, 1.0.6. The plugin’s image‐upload handler calls move_uploaded_file() on client‐supplied files without restricting allowed extensions or MIME types, nor sanitizing the filename. This makes it possible for unaut
iles without restricting allowed extensions or MIME types, nor sanitizing the filename. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/0bb11092-4367-4f51-9dd7-22fbd655a03f?source=cve - https://plugins.trac.wordpress.org/browser/wpbookit/trunk/core/admin/classes/controllers/class.wpb-customer-controller.php#L362 - https://wordpress.org/plugins/wpbookit/#developers - https://plugins.trac.wordpress.org/changeset/3331165/
CVE ID: CVE-2025-7853 State: PUBLISHED Published: 2025-07-19T19:44:07.248Z Last Updated: 2025-07-21T15:55:21.669Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR) Vendors: Tenda Products: FH451 Problem Types: CWE-121, CWE-119 Description: A vulnerability was found in Tenda FH451 1.0.0.9. It has been rated as critical. This issue affects the function fromSetIpBind of the file /goform/SetIpBind. The manipulation of the argument page leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.316943 - https://vuld
ay be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.316943 - https://vuldb.com/?ctiid.316943 - https://vuldb.com/?submit.616359 - https://github.com/panda666-888/vuls/blob/main/tenda/fh451/fromSetIpBind.md - https://github.com/panda666-888/vuls/blob/main/tenda/fh451/fromSetIpBind.md#poc - https://www.tenda.com.cn/
CVE ID: CVE-2025-7854 State: PUBLISHED Published: 2025-07-19T20:32:06.936Z Last Updated: 2025-07-22T16:02:32.563Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR) Vendors: Tenda Products: FH451 Problem Types: CWE-121, CWE-119 Description: A vulnerability classified as critical has been found in Tenda FH451 1.0.0.9. Affected is the function fromVirtualSer of the file /goform/VirtualSer. The manipulation of the argument page leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.316944 - https://vuld
ay be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.316944 - https://vuldb.com/?ctiid.316944 - https://vuldb.com/?submit.616366 - https://github.com/panda666-888/vuls/blob/main/tenda/fh451/fromVirtualSer.md - https://github.com/panda666-888/vuls/blob/main/tenda/fh451/fromVirtualSer.md#poc - https://www.tenda.com.cn/
CVE ID: CVE-2025-7855 State: PUBLISHED Published: 2025-07-19T21:02:09.313Z Last Updated: 2025-07-22T16:02:04.087Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C/E:ND/RL:ND/RC:UR) Vendors: Tenda Products: FH451 Problem Types: CWE-121, CWE-119 Description: A vulnerability classified as critical was found in Tenda FH451 1.0.0.9. Affected by this vulnerability is the function fromqossetting of the file /goform/qossetting. The manipulation of the argument page leads to stack-based buffer overflow. The attack can be launched remotely. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.316945 - https://vuldb.com/?ctiid.316945 - https://vuldb.com/?submit.616367
chment: References: - https://vuldb.com/?id.316945 - https://vuldb.com/?ctiid.316945 - https://vuldb.com/?submit.616367 - https://github.com/panda666-888/vuls/blob/main/tenda/fh451/fromqossetting.md#poc - https://www.tenda.com.cn/
CVE ID: CVE-2025-7856 State: PUBLISHED Published: 2025-07-19T21:14:07.020Z Last Updated: 2025-07-22T16:01:39.337Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: PHPGurukul Products: Apartment Visitors Management System Problem Types: CWE-79, CWE-94 Description: A vulnerability was found in PHPGurukul Apartment Visitors Management System 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file pass-details.php of the component HTTP POST Request Handler. The manipulation of the argument visname leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and
ame leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.316969 - https://vuldb.com/?ctiid.316969 - https://vuldb.com/?submit.616843 - https://github.com/HieuGITLAB/my-cves/issues/8 - https://phpgurukul.com/
CVE ID: CVE-2025-7857 State: PUBLISHED Published: 2025-07-19T22:44:07.300Z Last Updated: 2025-07-22T16:01:13.265Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: PHPGurukul Products: Apartment Visitors Management System Problem Types: CWE-79, CWE-94 Description: A vulnerability was found in PHPGurukul Apartment Visitors Management System 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file bwdates-passreports-details.php of the component HTTP POST Request Handler. The manipulation of the argument visname leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the publ
t visname leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.316970 - https://vuldb.com/?ctiid.316970 - https://vuldb.com/?submit.616867 - https://github.com/HieuGITLAB/my-cves/issues/9 - https://phpgurukul.com/
CVE ID: CVE-2025-7858 State: PUBLISHED Published: 2025-07-19T23:44:07.035Z Last Updated: 2025-07-22T16:00:42.917Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: PHPGurukul Products: Apartment Visitors Management System Problem Types: CWE-79, CWE-94 Description: A vulnerability classified as problematic has been found in PHPGurukul Apartment Visitors Management System 1.0. This affects an unknown part of the file /admin-profile.php of the component HTTP POST Request Handler. The manipulation of the argument adminname leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additio
g. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.316971 - https://vuldb.com/?ctiid.316971 - https://vuldb.com/?submit.616879 - https://github.com/HieuGITLAB/my-cves/issues/10 - https://phpgurukul.com/
CVE ID: CVE-2025-7859 State: PUBLISHED Published: 2025-07-20T00:02:06.024Z Last Updated: 2025-07-22T14:19:16.163Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: Church Donation System Problem Types: CWE-89, CWE-74 Description: A vulnerability classified as critical was found in code-projects Church Donation System 1.0. This vulnerability affects unknown code of the file /members/update_password_admin.php. The manipulation of the argument new_password leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: -
loit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.316972 - https://vuldb.com/?ctiid.316972 - https://vuldb.com/?submit.616921 - https://github.com/n0name-yang/myCVE/issues/10 - https://code-projects.org/
CVE ID: CVE-2025-7860 State: PUBLISHED Published: 2025-07-20T00:32:05.710Z Last Updated: 2025-07-22T14:17:25.565Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: Church Donation System Problem Types: CWE-89, CWE-74 Description: A vulnerability, which was classified as critical, has been found in code-projects Church Donation System 1.0. This issue affects some unknown processing of the file /members/login_admin.php. The manipulation of the argument Username leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: Referenc
he exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.316973 - https://vuldb.com/?ctiid.316973 - https://vuldb.com/?submit.616923 - https://github.com/n0name-yang/myCVE/issues/11 - https://code-projects.org/
CVE ID: CVE-2025-7861 State: PUBLISHED Published: 2025-07-20T01:03:51.229Z Last Updated: 2025-07-22T14:16:40.837Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: Church Donation System Problem Types: CWE-89, CWE-74 Description: A vulnerability, which was classified as critical, was found in code-projects Church Donation System 1.0. Affected is an unknown function of the file /members/search.php. The manipulation of the argument Username leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https:/
s been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.316974 - https://vuldb.com/?ctiid.316974 - https://vuldb.com/?submit.616925 - https://github.com/n0name-yang/myCVE/issues/12 - https://code-projects.org/
CVE ID: CVE-2025-7862 State: PUBLISHED Published: 2025-07-20T02:02:08.415Z Last Updated: 2025-07-22T14:14:27.289Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:W/RC:UR) Vendors: TOTOLINK Products: T6 Problem Types: CWE-306, CWE-287 Description: A vulnerability has been found in TOTOLINK T6 4.1.5cu.748_B20211015 and classified as critical. Affected by this vulnerability is the function setTelnetCfg of the file /cgi-bin/cstecgi.cgi of the component Telnet Service. The manipulation of the argument telnet_enabled with the input 1 leads to missing authentication. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Not
he attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.316975 - https://vuldb.com/?ctiid.316975 - https://vuldb.com/?submit.617643 - https://github.com/AnduinBrian/Public/blob/main/Totolink%20T6/Vuln/5.md - https://github.com/AnduinBrian/Public/blob/main/Totolink%20T6/Vuln/5.md#poc-http - https://www.youtube.com/watch?v=XeKu3tfeSME - https://www.totolink.net/
CVE ID: CVE-2025-7863 State: PUBLISHED Published: 2025-07-20T02:14:06.422Z Last Updated: 2025-07-22T14:12:16.255Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N/E:ND/RL:OF/RC:C) Vendors: thinkgem Products: JeeSite Problem Types: CWE-601 Description: A vulnerability was found in thinkgem JeeSite up to 5.12.0 and classified as problematic. Affected by this issue is the function redirectUrl of the file src/main/java/com/jeesite/common/web/http/ServletUtils.java. The manipulation of the argument url leads to open redirect. The attack may be launched remotely. The name of the patch is 3d06b8d009d0267f0255acc87ea19d29d07cedc3. It is recommended to apply a patch to fix this issue. Additional Anal
patch is 3d06b8d009d0267f0255acc87ea19d29d07cedc3. It is recommended to apply a patch to fix this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.316976 - https://vuldb.com/?ctiid.316976 - https://vuldb.com/?submit.618188 - https://github.com/thinkgem/jeesite5/issues/30 - https://github.com/thinkgem/jeesite5/issues/30#issuecomment-3045861920 - https://github.com/thinkgem/jeesite5/commit/3d06b8d009d0267f0255acc87ea19d29d07cedc3
CVE ID: CVE-2025-7864 State: PUBLISHED Published: 2025-07-20T02:44:05.934Z Last Updated: 2025-07-21T18:38:44.498Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C) Vendors: thinkgem Products: JeeSite Problem Types: CWE-434, CWE-284 Description: A vulnerability was found in thinkgem JeeSite up to 5.12.0. It has been classified as critical. This affects the function Upload of the file src/main/java/com/jeesite/modules/file/web/FileUploadController.java. The manipulation leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of the patch is 3585737d21fe490ff6948d913fcbd8d99c41f
t has been disclosed to the public and may be used. The identifier of the patch is 3585737d21fe490ff6948d913fcbd8d99c41fc08. It is recommended to apply a patch to fix this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.316977 - https://vuldb.com/?ctiid.316977 - https://vuldb.com/?submit.618189 - https://github.com/thinkgem/jeesite5/issues/31 - https://github.com/thinkgem/jeesite5/issues/31#issuecomment-3051363397 - https://github.com/thinkgem/jeesite5/commit/3585737d21fe490ff6948d913fcbd8d99c41fc08
CVE ID: CVE-2025-7865 State: PUBLISHED Published: 2025-07-20T03:02:06.375Z Last Updated: 2025-07-21T18:38:38.930Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:OF/RC:C) Vendors: thinkgem Products: JeeSite Problem Types: CWE-79, CWE-94 Description: A vulnerability was found in thinkgem JeeSite up to 5.12.0. It has been declared as problematic. This vulnerability affects the function xssFilter of the file src/main/java/com/jeesite/common/codec/EncodeUtils.java of the component XSS Filter. The manipulation of the argument text leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The patch is identified as
ack can be initiated remotely. The exploit has been disclosed to the public and may be used. The patch is identified as 3585737d21fe490ff6948d913fcbd8d99c41fc08. It is recommended to apply a patch to fix this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.316978 - https://vuldb.com/?ctiid.316978 - https://vuldb.com/?submit.618190 - https://github.com/thinkgem/jeesite5/issues/32 - https://github.com/thinkgem/jeesite5/issues/32#issuecomment-3051177029 - https://github.com/thinkgem/jeesite5/commit/3585737d21fe490ff6948d913fcbd8d99c41fc08
CVE ID: CVE-2025-7866 State: PUBLISHED Published: 2025-07-20T03:32:05.497Z Last Updated: 2025-07-21T14:54:19.698Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: Portabilis Products: i-Educar Problem Types: CWE-79, CWE-94 Description: A vulnerability was found in Portabilis i-Educar 2.9.0. It has been rated as problematic. This issue affects some unknown processing of the file /intranet/educar_deficiencia_lst.php of the component Disabilities Module. The manipulation of the argument Deficiência ou Transtorno leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted e
tack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.316979 - https://vuldb.com/?ctiid.316979 - https://vuldb.com/?submit.605618 - https://github.com/RaulPazemecxas/PoCVulDb/blob/main/README16.md
CVE ID: CVE-2025-7867 State: PUBLISHED Published: 2025-07-20T04:02:05.977Z Last Updated: 2025-08-19T05:47:19.745Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: Portabilis Products: i-Educar Problem Types: CWE-79, CWE-94 Description: A vulnerability has been found in Portabilis i-Educar 2.9.0/2.10.0. This vulnerability affects unknown code of the file /intranet/agenda.php of the component Agenda Module. The manipulation of the argument novo_titulo/novo_descricao leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did n
exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.316980 - https://vuldb.com/?ctiid.316980 - https://vuldb.com/?submit.605633 - https://vuldb.com/?submit.618639 - https://vuldb.com/?submit.628435 - https://github.com/RaulPazemecxas/PoCVulDb/blob/main/README17.md
CVE ID: CVE-2025-7868 State: PUBLISHED Published: 2025-07-20T04:32:05.817Z Last Updated: 2025-09-16T20:16:06.829Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: Portabilis Products: i-Educar Problem Types: CWE-79, CWE-94 Description: A vulnerability was found in Portabilis i-Educar up to 2.10. This issue affects some unknown processing of the file /intranet/educar_calendario_dia_motivo_cad.php of the component Calendar Module. The manipulation of the argument Motivo/descricao results in cross site scripting. It is possible to launch the attack remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but d
remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.316981 - https://vuldb.com/?ctiid.316981 - https://vuldb.com/?submit.605655 - https://vuldb.com/?submit.644373 - https://github.com/RaulPazemecxas/PoCVulDb/blob/main/README18.md
CVE ID: CVE-2025-7869 State: PUBLISHED Published: 2025-07-20T05:02:05.567Z Last Updated: 2025-07-22T13:38:29.678Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: Portabilis Products: i-Educar Problem Types: CWE-79, CWE-94 Description: A vulnerability, which was classified as problematic, has been found in Portabilis i-Educar 2.9.0. Affected by this issue is some unknown functionality of the file intranet/educar_turma_tipo_det.php?cod_turma_tipo=ID of the component Turma Module. The manipulation of the argument nm_tipo leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was co
ng. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.316982 - https://vuldb.com/?ctiid.316982 - https://vuldb.com/?submit.605663 - https://github.com/RaulPazemecxas/PoCVulDb/blob/main/README19.md
CVE ID: CVE-2025-7870 State: PUBLISHED Published: 2025-07-20T05:32:06.300Z Last Updated: 2025-07-22T13:56:38.818Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: Portabilis Products: i-Diario Problem Types: CWE-79, CWE-94 Description: A vulnerability, which was classified as problematic, was found in Portabilis i-Diario 1.5.0. This affects an unknown part of the component justificativas-de-falta Endpoint. The manipulation of the argument Anexo leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any wa
closed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.316983 - https://vuldb.com/?ctiid.316983 - https://vuldb.com/?submit.607947 - https://github.com/CVE-Hunters/CVE/blob/main/i-diario/CVE-2025-7870.md
CVE ID: CVE-2025-7871 State: PUBLISHED Published: 2025-07-20T06:02:05.813Z Last Updated: 2025-07-22T13:52:08.028Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: Portabilis Products: i-Diario Problem Types: CWE-79, CWE-94 Description: A vulnerability has been found in Portabilis i-Diario 1.5.0 and classified as problematic. This vulnerability affects unknown code of the file /conteudos. The manipulation of the argument filter[by_description] leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additiona
e public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.316984 - https://vuldb.com/?ctiid.316984 - https://vuldb.com/?submit.607948 - https://github.com/CVE-Hunters/CVE/blob/main/i-diario/CVE-2025-7871.md
CVE ID: CVE-2025-7872 State: PUBLISHED Published: 2025-07-20T06:32:05.186Z Last Updated: 2025-07-22T13:50:20.372Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: Portabilis Products: i-Diario Problem Types: CWE-79, CWE-94 Description: A vulnerability was found in Portabilis i-Diario 1.5.0 and classified as problematic. This issue affects some unknown processing of the file /justificativas-de-falta. The manipulation of the argument Justificativa leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additi
the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.316985 - https://vuldb.com/?ctiid.316985 - https://vuldb.com/?submit.610138 - https://github.com/marcelomulder/CVE/blob/main/i-diario/CVE-2025-7872.md
CVE ID: CVE-2025-7873 State: PUBLISHED Published: 2025-07-20T06:44:04.946Z Last Updated: 2025-07-22T13:48:46.655Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: Metasoft 美特软件 Products: MetaCRM Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in Metasoft 美特软件 MetaCRM up to 6.4.2. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file mcc_login.jsp. The manipulation of the argument workerid leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way
losed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.316987 - https://vuldb.com/?ctiid.316987 - https://vuldb.com/?submit.611043 - https://github.com/FightingLzn9/vul/blob/main/MetaCRM6-SQLI-1.md