Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
trac.wordpress.org/browser/zoloblocks/tags/2.3.3/build/blocks/google-map/frontend.js#L1 - https://plugins.trac.wordpress.org/browser/zoloblocks/tags/2.3.3/build/blocks/image-gallery/frontend.js#L1 - https://plugins.trac.wordpress.org/browser/zoloblocks/tags/2.3.3/build/blocks/progress-pie/frontend.js#L1 - https://plugins.trac.wordpress.org/browser/zoloblocks/tags/2.3.3/build/blocks/text-path/frontend.js#L1 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3351996%40zoloblocks&new=3351996%40zoloblocks&sfp_email=&sfph_mail= - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3369092%40zoloblocks&new=3369092%40zoloblocks&sfp_email=
rac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3369092%40zoloblocks&new=3369092%40zoloblocks&sfp_email=&sfph_mail=
CVE ID: CVE-2025-9076 State: PUBLISHED Published: 2025-09-15T10:06:15.094Z Last Updated: 2025-09-15T14:05:16.235Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N) Vendors: Mattermost Products: Mattermost Problem Types: CWE-862 Description: Mattermost versions 10.10.x <= 10.10.1 fail to properly sanitize user data during shared channel membership synchronization, which allows malicious or compromised remote clusters to access sensitive user information via unsanitized user objects. This vulnerability affects Mattermost Server instances with shared channels enabled. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://mattermost.com/security-updates
CVE ID: CVE-2025-9077 State: PUBLISHED Published: 2025-10-03T11:17:12.365Z Last Updated: 2025-10-03T18:10:14.651Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: ultrapressorg Products: Ultra Addons Lite for Elementor Problem Types: CWE-79 Description: The Ultra Addons Lite for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Animated Text' field of the Typeout Widget in version 1.1.9 and below due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user acce
with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/513f116b-84d3-4848-b608-f2a2ee57a9a2?source=cve - https://plugins.trac.wordpress.org/browser/ut-elementor-addons-lite/tags/1.1.9/elements/typeout.php#L276
CVE ID: CVE-2025-9078 State: PUBLISHED Published: 2025-09-15T10:10:06.886Z Last Updated: 2025-09-15T13:57:49.086Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Mattermost Products: Mattermost Problem Types: CWE-328 Description: Mattermost versions 10.8.x <= 10.8.3, 10.5.x <= 10.5.8, 9.11.x <= 9.11.17, 10.10.x <= 10.10.1, 10.9.x <= 10.9.3 fail to properly validate cache keys for link metadata which allows authenticated users to access unauthorized posts and poison link previews via hash collision attacks on FNV-1 hashing Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://mattermost.com/security-updates
CVE ID: CVE-2025-9079 State: PUBLISHED Published: 2025-09-19T19:22:00.288Z Last Updated: 2025-09-20T03:55:43.405Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Mattermost Products: Mattermost Problem Types: CWE-22 Description: Mattermost versions 10.8.x <= 10.8.3, 10.5.x <= 10.5.8, 9.11.x <= 9.11.17, 10.10.x <= 10.10.1, 10.9.x <= 10.9.3 fail to validate import directory path configuration which allows admin users to execute arbitrary code via malicious plugin upload to prepackaged plugins directory Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://mattermost.com/security-updates
CVE ID: CVE-2025-9080 State: PUBLISHED Published: 2025-10-03T11:17:14.730Z Last Updated: 2025-10-03T14:56:59.307Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: bdevs Products: Generic Elements Problem Types: CWE-79 Description: The Generic Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple widget fields in version 1.2.4 and earlier. This is due to insufficient input sanitization and output escaping on user-supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. A
ccess and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/7a341a7e-9ed2-436f-846a-59a5d51916fe?source=cve - https://plugins.trac.wordpress.org/browser/generic-elements-for-elementor/tags/1.2.4/widgets/FunFactor.php#L692 - https://plugins.trac.wordpress.org/browser/generic-elements-for-elementor/tags/1.2.4/widgets/Slider.php#L1025
CVE ID: CVE-2025-9081 State: PUBLISHED Published: 2025-09-19T19:36:14.702Z Last Updated: 2025-09-19T19:52:03.664Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Mattermost Products: Mattermost Problem Types: CWE-639 Description: Mattermost versions 10.5.x <= 10.5.8, 9.11.x <= 9.11.17 fail to properly validate access controls which allows any authenticated user to download sensitive files via board file download endpoint using UUID enumeration Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://mattermost.com/security-updates
CVE ID: CVE-2025-9083 State: PUBLISHED Published: 2025-09-18T06:00:06.472Z Last Updated: 2025-09-22T17:27:23.139Z Vendors: Unknown Products: Ninja Forms Problem Types: CWE-502 Deserialization of Untrusted Data Description: The Ninja Forms WordPress plugin before 3.11.1 unserializes user input via form field, which could allow Unauthenticated users to perform PHP Object Injection when a suitable gadget is present on the blog. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/60b4d7fc-5d23-4dcf-bd7f-e202cabc2625/
CVE ID: CVE-2025-9084 State: PUBLISHED Published: 2025-09-15T10:22:30.184Z Last Updated: 2025-09-15T12:24:41.138Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Mattermost Products: Mattermost Problem Types: CWE-601 Description: Mattermost versions 10.5.x <= 10.5.9 fail to properly validate redirect URLs which allows attackers to redirect users to malicious sites via crafted OAuth login URLs Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://mattermost.com/security-updates
CVE ID: CVE-2025-9085 State: PUBLISHED Published: 2025-09-06T02:24:17.930Z Last Updated: 2025-09-08T20:14:05.628Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: wpeverest Products: User Registration & Membership – Custom Registration Form Builder, Custom Login Form, User Profile, Content Restriction & Membership Plugin Problem Types: CWE-89 Description: The User Registration & Membership plugin for WordPress is vulnerable to SQL Injection via the 's' parameter in version 4.3.0. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers,
meter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ba326241-46a3-4891-a180-d7977f4e83ed?source=cve - https://plugins.trac.wordpress.org/browser/user-registration/tags/4.3.0/modules/membership/includes/Admin/Repositories/MembersRepository.php#L116 - https://plugins.trac.wordpress.org/browser/user-registration/tags/4.3.0/modules/memb
tories/MembersRepository.php#L116 - https://plugins.trac.wordpress.org/browser/user-registration/tags/4.3.0/modules/membership/includes/Admin/Members/MembersListTable.php#L45 - https://plugins.trac.wordpress.org/changeset/3351639/user-registration/tags/4.4.0/modules/membership/includes/Admin/Repositories/MembersRepository.php
CVE ID: CVE-2025-9086 State: PUBLISHED Published: 2025-09-12T05:10:03.815Z Last Updated: 2025-11-04T21:15:15.978Z Vendors: curl Products: curl Problem Types: CWE-125 Out-of-bounds Read Description: 1. A cookie is set using the `secure` keyword for `https://target` 2. curl is redirected to or otherwise made to speak with `http://target` (same hostname, but using clear text HTTP) using the same cookie set 3. The same cookie name is set - but with just a slash as path (`path='/'`). Since this site is not secure, the cookie *should* just be ignored. 4. A bug in the path comparison logic makes curl read outside a heap buffer boundary The bug either causes a crash or it potentially makes the compa
son logic makes curl read outside a heap buffer boundary The bug either causes a crash or it potentially makes the comparison come to the wrong conclusion and lets the clear-text site override the contents of the secure cookie, contrary to expectations and depending on the memory contents immediately following the single-byte allocation that holds the path. The presumed and correct behavior would be to plainly ignore the second set of the cookie since it was already set as secure on a secure host so overriding it on an insecure host should not be okay. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://curl.se/docs/CVE-2025-9086.json - https://c
tes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://curl.se/docs/CVE-2025-9086.json - https://curl.se/docs/CVE-2025-9086.html - https://hackerone.com/reports/3294999
CVE ID: CVE-2025-9087 State: PUBLISHED Published: 2025-08-16T22:32:07.366Z Last Updated: 2025-08-18T17:59:50.592Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR) Vendors: Tenda Products: AC20 Problem Types: CWE-121, CWE-119 Description: A vulnerability has been found in Tenda AC20 16.03.08.12. This affects the function set_qosMib_list of the file /goform/SetNetControlList of the component SetNetControlList Endpoint. The manipulation of the argument list leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://v
been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.320355 - https://vuldb.com/?ctiid.320355 - https://vuldb.com/?submit.632037 - https://github.com/ZZ2266/.github.io/tree/main/AC20/formSetQosBand - https://github.com/ZZ2266/.github.io/tree/main/AC20/formSetQosBand#poc-python-exploit-script - https://www.tenda.com.cn/
CVE ID: CVE-2025-9088 State: PUBLISHED Published: 2025-08-16T23:02:07.777Z Last Updated: 2025-08-18T17:59:09.706Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR) Vendors: Tenda Products: AC20 Problem Types: CWE-121, CWE-119 Description: A vulnerability was found in Tenda AC20 16.03.08.12. This vulnerability affects the function save_virtualser_data of the file /goform/formSetVirtualSer. The manipulation of the argument list leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.320356 - https://vuldb.com/
used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.320356 - https://vuldb.com/?ctiid.320356 - https://vuldb.com/?submit.632038 - https://github.com/ZZ2266/.github.io/tree/main/AC20/formSetVirtualSer - https://github.com/ZZ2266/.github.io/tree/main/AC20/formSetVirtualSer#poc-python-exploit-script - https://www.tenda.com.cn/
CVE ID: CVE-2025-9089 State: PUBLISHED Published: 2025-08-16T23:32:07.804Z Last Updated: 2025-08-18T17:58:40.337Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR) Vendors: Tenda Products: AC20 Problem Types: CWE-121, CWE-119 Description: A vulnerability was determined in Tenda AC20 16.03.08.12. This issue affects the function sub_48E628 of the file /goform/SetIpMacBind. The manipulation of the argument list leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.320357 - https://vuldb.com/?ctiid.320357 - ht
nalyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.320357 - https://vuldb.com/?ctiid.320357 - https://vuldb.com/?submit.632039 - https://github.com/ZZ2266/.github.io/blob/main/AC20/fromSetIpMacBind/readme.md - https://github.com/ZZ2266/.github.io/blob/main/AC20/fromSetIpMacBind/readme.md#poc-python-exploit-script - https://www.tenda.com.cn/
CVE ID: CVE-2025-9090 State: PUBLISHED Published: 2025-08-17T02:02:07.488Z Last Updated: 2025-08-18T17:46:22.525Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: Tenda Products: AC20 Problem Types: CWE-77, CWE-74 Description: A vulnerability was identified in Tenda AC20 16.03.08.12. Affected is the function websFormDefine of the file /goform/telnet of the component Telnet Service. The manipulation leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.320358 - https://vuldb.com/?ctiid.320358 - ht
nalyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.320358 - https://vuldb.com/?ctiid.320358 - https://vuldb.com/?submit.632232 - https://github.com/ZZ2266/.github.io/blob/main/AC20/telnet/readme.md - https://github.com/ZZ2266/.github.io/blob/main/AC20/telnet/readme.md#poc-exploit-steps - https://www.tenda.com.cn/
CVE ID: CVE-2025-9091 State: PUBLISHED Published: 2025-08-17T02:32:09.136Z Last Updated: 2025-08-18T13:15:19.094Z Severity: LOW (CVSS 2.5 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R) Vendors: Tenda Products: AC20 Problem Types: CWE-798, CWE-259 Description: A security flaw has been discovered in Tenda AC20 16.03.08.12. Affected by this vulnerability is an unknown functionality of the file /etc_ro/shadow. The manipulation leads to hard-coded credentials. It is possible to launch the attack on the local host. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. Additional Analyst Notes
oitation appears to be difficult. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.320359 - https://vuldb.com/?ctiid.320359 - https://vuldb.com/?submit.632268 - https://github.com/ZZ2266/.github.io/tree/main/AC20/hardcoded%20password/readme.md - https://github.com/ZZ2266/.github.io/blob/main/AC20/hardcoded%20password/readme.md#description - https://www.tenda.com.cn/
CVE ID: CVE-2025-9092 State: PUBLISHED Published: 2025-08-16T10:29:59.417Z Last Updated: 2025-08-18T18:08:35.298Z Vendors: Legion of the Bouncy Castle Inc. Products: Bouncy Castle for Java - BC-FJA 2.1.0 Problem Types: CWE-400 Description: Uncontrolled Resource Consumption vulnerability in Legion of the Bouncy Castle Inc. Bouncy Castle for Java - BC-FJA 2.1.0 bc-fips (API modules) allows Excessive Allocation. This vulnerability is associated with program files org.Bouncycastle.Crypto.Fips.NativeLoader. This issue affects Bouncy Castle for Java - BC-FJA 2.1.0: from BC-FJA 2.1.0 through 2.1.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/bcgit/bc-java/wik
1.0 through 2.1.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902025%E2%80%909092
CVE ID: CVE-2025-9093 State: PUBLISHED Published: 2025-08-17T22:02:06.368Z Last Updated: 2025-08-18T13:13:48.756Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R) Vendors: n/a Products: BuzzFeed App Problem Types: CWE-926 Description: A security vulnerability has been detected in BuzzFeed App 2024.9 on Android. This affects an unknown part of the file AndroidManifest.xml of the component com.buzzfeed.android. The manipulation leads to improper export of android application components. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - ht
it has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.320415 - https://vuldb.com/?ctiid.320415 - https://vuldb.com/?submit.623584 - https://github.com/KMov-g/androidapps/blob/main/com.buzzfeed.android.md - https://github.com/KMov-g/androidapps/blob/main/com.buzzfeed.android.md#steps-to-reproduce
CVE ID: CVE-2025-9094 State: PUBLISHED Published: 2025-08-17T22:32:05.887Z Last Updated: 2025-08-18T17:42:25.755Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C) Vendors: n/a Products: ThingsBoard Problem Types: CWE-1336, CWE-791 Description: A vulnerability was detected in ThingsBoard 4.1. This vulnerability affects unknown code of the component Add Gateway Handler. The manipulation leads to improper neutralization of special elements used in a template engine. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor replies, that "[t]he fix will come within upcoming release (v4.2) and will be inher
e public and may be used. The vendor replies, that "[t]he fix will come within upcoming release (v4.2) and will be inherited by maintenance releases of LTS versions (starting 4.0)." Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.320416 - https://vuldb.com/?ctiid.320416 - https://vuldb.com/?submit.626292 - https://drive.google.com/file/d/1cZy-rfQXsF58kJIVs4UXj7usXJuhjZjA/view
CVE ID: CVE-2025-9095 State: PUBLISHED Published: 2025-08-17T23:02:07.148Z Last Updated: 2025-08-18T17:33:04.638Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: ExpressGateway Products: express-gateway Problem Types: CWE-79, CWE-94 Description: A flaw has been found in ExpressGateway express-gateway up to 1.16.10. This issue affects some unknown processing in the library lib/rest/routes/users.js of the component REST Endpoint. The manipulation leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additi
the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.320417 - https://vuldb.com/?ctiid.320417 - https://vuldb.com/?submit.627709 - https://github.com/freshfish-hust/my-cves/issues/5 - https://github.com/freshfish-hust/my-cves/issues/5#issue-3286622393
CVE ID: CVE-2025-9096 State: PUBLISHED Published: 2025-08-17T23:32:05.435Z Last Updated: 2025-08-18T17:27:38.727Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: ExpressGateway Products: express-gateway Problem Types: CWE-79, CWE-94 Description: A vulnerability has been found in ExpressGateway express-gateway up to 1.16.10. Affected is an unknown function in the library lib/rest/routes/apps.js of the component REST Endpoint. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. A
ed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.320418 - https://vuldb.com/?ctiid.320418 - https://vuldb.com/?submit.627833 - https://github.com/freshfish-hust/my-cves/issues/6 - https://github.com/freshfish-hust/my-cves/issues/6#issue-3287078206
CVE ID: CVE-2025-9097 State: PUBLISHED Published: 2025-08-18T00:02:05.870Z Last Updated: 2025-08-18T17:13:45.340Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R) Vendors: Euro Information Products: CIC banque et compte en ligne App Problem Types: CWE-926 Description: A vulnerability was found in Euro Information CIC banque et compte en ligne App 12.56.0 on Android. Affected by this vulnerability is an unknown functionality of the file AndroidManifest.xml of the component com.cic_prod.bad. The manipulation leads to improper export of android application components. It is possible to launch the attack on the local host. The exploit has been disclosed to t
droid application components. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.320419 - https://vuldb.com/?ctiid.320419 - https://vuldb.com/?submit.627899 - https://github.com/KMov-g/androidapps/blob/main/com.cic_prod.bad.md - https://github.com/KMov-g/androidapps/blob/main/com.cic_prod.bad.md#steps-to-reproduce
CVE ID: CVE-2025-9098 State: PUBLISHED Published: 2025-08-18T00:32:05.703Z Last Updated: 2025-08-18T16:48:46.237Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R) Vendors: Elseplus Products: File Recovery App Problem Types: CWE-926 Description: A vulnerability was determined in Elseplus File Recovery App 4.4.21 on Android. Affected by this issue is some unknown functionality of the file AndroidManifest.xml. The manipulation leads to improper export of android application components. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not resp
has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.320420 - https://vuldb.com/?ctiid.320420 - https://vuldb.com/?submit.627902 - https://github.com/KMov-g/androidapps/blob/main/com.elseplus.filerecovery.md - https://github.com/KMov-g/androidapps/blob/main/com.elseplus.filerecovery.md#steps-to-reproduce
CVE ID: CVE-2025-9099 State: PUBLISHED Published: 2025-08-18T01:02:06.521Z Last Updated: 2025-08-18T15:46:02.133Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: Acrel Products: Environmental Monitoring Cloud Platform Problem Types: CWE-434, CWE-284 Description: A vulnerability was identified in Acrel Environmental Monitoring Cloud Platform up to 20250804. This affects an unknown part of the file /NewsManage/UploadNewsImg. The manipulation of the argument File leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not
ploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.320421 - https://vuldb.com/?ctiid.320421 - https://vuldb.com/?submit.628090 - https://www.notion.so/upload-23e9bb66b0a58088a9b4fcaea56a857f?source=copy_link