Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
n disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.303501 - https://vuldb.com/?ctiid.303501 - https://vuldb.com/?submit.549645 - https://github.com/hyx123123/cve/blob/main/cve2.md - https://code-projects.org/
CVE ID: CVE-2025-3305 State: PUBLISHED Published: 2025-04-05T22:31:05.177Z Last Updated: 2025-04-07T15:59:14.322Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: 1902756969, code-projects Products: IKUN_Library Problem Types: CWE-284, CWE-266 Description: A vulnerability has been found in 1902756969/code-projects IKUN_Library 1.0 and classified as problematic. This vulnerability affects the function addInterceptors of the file MvcConfig.java of the component Borrow Handler. The manipulation leads to improper access controls. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA AD
be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.303502 - https://vuldb.com/?ctiid.303502 - https://vuldb.com/?submit.550186 - https://github.com/buluorifu/Vulnerability-recurrence/blob/main/Refer/IKUN_Library-authority.md
CVE ID: CVE-2025-3306 State: PUBLISHED Published: 2025-04-06T01:00:11.215Z Last Updated: 2025-04-07T15:58:35.176Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: code-projects Products: Blood Bank Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in code-projects Blood Bank Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /don.php. The manipulation of the argument fullname leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well. Additional Analyst Notes: - CISA ADP Vulnrichment:
e public and may be used. Other parameters might be affected as well. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.303503 - https://vuldb.com/?ctiid.303503 - https://vuldb.com/?submit.550190 - https://github.com/p1026/CVE/issues/22 - https://code-projects.org/
CVE ID: CVE-2025-3307 State: PUBLISHED Published: 2025-04-06T03:00:09.624Z Last Updated: 2025-04-07T15:58:03.724Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: code-projects Products: Blood Bank Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in code-projects Blood Bank Management System 1.0. It has been classified as critical. Affected is an unknown function of the file /reset.php. The manipulation of the argument useremail leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?i
sed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.303504 - https://vuldb.com/?ctiid.303504 - https://vuldb.com/?submit.550192 - https://github.com/p1026/CVE/issues/24 - https://code-projects.org/
CVE ID: CVE-2025-3308 State: PUBLISHED Published: 2025-04-06T04:00:09.609Z Last Updated: 2025-04-07T14:54:16.694Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: code-projects Products: Blood Bank Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in code-projects Blood Bank Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /viewrequest.php. The manipulation of the argument ID leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https
has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.303505 - https://vuldb.com/?ctiid.303505 - https://vuldb.com/?submit.550193 - https://github.com/p1026/CVE/issues/25 - https://code-projects.org/
CVE ID: CVE-2025-3309 State: PUBLISHED Published: 2025-04-06T05:31:04.555Z Last Updated: 2025-04-07T14:40:40.612Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: code-projects Products: Blood Bank Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in code-projects Blood Bank Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin/campsdetails.php. The manipulation of the argument hospital leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - h
oit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.303506 - https://vuldb.com/?ctiid.303506 - https://vuldb.com/?submit.550194 - https://github.com/p1026/CVE/issues/26 - https://code-projects.org/
CVE ID: CVE-2025-3310 State: PUBLISHED Published: 2025-04-06T06:00:14.255Z Last Updated: 2025-04-07T14:38:23.636Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: code-projects Products: Blood Bank Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability classified as critical has been found in code-projects Blood Bank Management System 1.0. This affects an unknown part of the file /admin/delete.php. The manipulation of the argument Search leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.303
o the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.303507 - https://vuldb.com/?ctiid.303507 - https://vuldb.com/?submit.550195 - https://github.com/p1026/CVE/issues/27 - https://code-projects.org/
CVE ID: CVE-2025-3311 State: PUBLISHED Published: 2025-04-06T06:31:05.755Z Last Updated: 2025-04-07T14:36:53.597Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: PHPGurukul Products: Men Salon Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability classified as critical was found in PHPGurukul Men Salon Management System 1.0. This vulnerability affects unknown code of the file /admin/about-us.php. The manipulation of the argument pagetitle leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.303508 - h
ublic and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.303508 - https://vuldb.com/?ctiid.303508 - https://vuldb.com/?submit.550196 - https://github.com/FIGHTINGTMQ/CVE/issues/1 - https://phpgurukul.com/
CVE ID: CVE-2025-3312 State: PUBLISHED Published: 2025-04-06T07:00:10.914Z Last Updated: 2025-04-07T14:35:28.212Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: PHPGurukul Products: Men Salon Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability, which was classified as critical, has been found in PHPGurukul Men Salon Management System 1.0. This issue affects some unknown processing of the file /admin/add-customer-services.php. The manipulation of the argument sids[] leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - ht
it has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.303509 - https://vuldb.com/?ctiid.303509 - https://vuldb.com/?submit.550199 - https://github.com/FIGHTINGTMQ/CVE/issues/2 - https://phpgurukul.com/
CVE ID: CVE-2025-3313 State: PUBLISHED Published: 2025-04-06T08:00:12.026Z Last Updated: 2025-04-07T14:33:28.743Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: PHPGurukul Products: Men Salon Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability, which was classified as critical, was found in PHPGurukul Men Salon Management System 1.0. Affected is an unknown function of the file /admin/add-customer.php. The manipulation of the argument Name leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id
ed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.303510 - https://vuldb.com/?ctiid.303510 - https://vuldb.com/?submit.550884 - https://github.com/ltranquility/CVE/issues/2 - https://phpgurukul.com/
CVE ID: CVE-2025-3314 State: PUBLISHED Published: 2025-04-06T08:31:05.002Z Last Updated: 2025-04-07T14:29:31.521Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: SourceCodester Products: Apartment Visitor Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability has been found in SourceCodester Apartment Visitor Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /forgotpw.php. The manipulation of the argument secode leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: Refe
y. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.303511 - https://vuldb.com/?ctiid.303511 - https://vuldb.com/?submit.551257 - https://github.com/tongjt123/CVE/issues/1 - https://www.sourcecodester.com/
CVE ID: CVE-2025-3315 State: PUBLISHED Published: 2025-04-06T10:00:15.830Z Last Updated: 2025-04-07T14:27:25.964Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: SourceCodester Products: Apartment Visitor Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in SourceCodester Apartment Visitor Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /view-report.php. The manipulation of the argument fromdate/todate leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: Ref
ly. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.303512 - https://vuldb.com/?ctiid.303512 - https://vuldb.com/?submit.551262 - https://github.com/alc9700jmo/CVE/issues/11 - https://www.sourcecodester.com/
CVE ID: CVE-2025-3316 State: PUBLISHED Published: 2025-04-06T11:00:15.754Z Last Updated: 2025-04-07T14:26:06.715Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: PHPGurukul Products: Men Salon Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in PHPGurukul Men Salon Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /admin/search-invoices.php. The manipulation of the argument searchdata leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb
disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.303515 - https://vuldb.com/?ctiid.303515 - https://vuldb.com/?submit.551749 - https://github.com/zhaolu33/CVE/issues/3 - https://phpgurukul.com/
CVE ID: CVE-2025-3317 State: PUBLISHED Published: 2025-04-06T11:31:10.145Z Last Updated: 2025-04-07T14:23:59.991Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: fumiao Products: opencms Problem Types: CWE-22 Description: A vulnerability classified as problematic has been found in fumiao opencms up to a0fafa5cff58719e9b27c2a2eec204cc165ce14f. Affected is an unknown function of the file opencms-dev/src/main/webapp/view/admin/document/dataPage.jsp. The manipulation of the argument path leads to path traversal. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. This product is using a rolling release to p
ack remotely. The exploit has been disclosed to the public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.303516 - https://vuldb.com/?ctiid.303516 - https://gitee.com/fumiao/opencms/issues/IBLJLM
CVE ID: CVE-2025-3318 State: PUBLISHED Published: 2025-04-06T14:00:16.804Z Last Updated: 2025-04-07T14:41:39.704Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Kenj_Frog 肯尼基蛙 Products: company-financial-management 公司财务管理系统 Problem Types: CWE-89, CWE-74 Description: A vulnerability classified as critical was found in Kenj_Frog 肯尼基蛙 company-financial-management 公司财务管理系统 1.0. Affected by this vulnerability is the function page of the file src/main/java/com/controller/ShangpinleixingController.java. The manipulation of the argument sort leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This product takes the
e attack can be launched remotely. The exploit has been disclosed to the public and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.303517 - https://vuldb.com/?ctiid.303517 - https://gitee.com/Kenj_Frog/company-financial-management/issues/IBM6D9
CVE ID: CVE-2025-3319 State: PUBLISHED Published: 2025-06-20T14:50:45.991Z Last Updated: 2025-08-24T11:45:17.815Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: IBM Products: Spectrum Protect Server Problem Types: CWE-306 Description: IBM Spectrum Protect Server 8.1 through 8.1.26 could allow attacker to bypass authentication due to improper session authentication which can result in access to unauthorized resources. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7236999
CVE ID: CVE-2025-3320 State: PUBLISHED Published: 2025-08-06T13:49:35.970Z Last Updated: 2025-08-07T03:55:20.363Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: IBM Products: Tivoli Monitoring Problem Types: CWE-122 Description: IBM Tivoli Monitoring 6.3.0.7 through 6.3.0.7 Service Pack 20 is vulnerable to a heap-based buffer overflow, caused by improper bounds checking. A remote attacker could overflow a buffer and execute arbitrary code on the system or cause the server to crash. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7241472
CVE ID: CVE-2025-3321 State: PUBLISHED Published: 2025-06-06T08:12:46.971Z Last Updated: 2025-06-06T18:25:54.094Z Vendors: B. Braun Melsungen AG Products: OnlineSuite Problem Types: CWE-798 Description: A predefined administrative account is not documented and cannot be deactivated. This account cannot be misused from the network, only by local users on the server. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.bbraun.com/productsecurity
CVE ID: CVE-2025-3322 State: PUBLISHED Published: 2025-06-06T08:13:12.028Z Last Updated: 2025-06-06T17:29:30.972Z Vendors: B. Braun Melsungen AG Products: OnlineSuite Problem Types: CWE-917 Description: An improper neutralization of inputs used in expression language allows remote code execution with the highest privileges on the server. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.bbraun.com/productsecurity
CVE ID: CVE-2025-3323 State: PUBLISHED Published: 2025-04-06T22:00:13.229Z Last Updated: 2025-07-17T17:34:18.834Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: godcheese, code-projects Products: Nimrod Problem Types: CWE-89, CWE-74 Description: A vulnerability classified as critical was found in godcheese/code-projects Nimrod 0.8. Affected by this vulnerability is the function searchAllByName of the file ViewMenuCategoryRestController.java. The manipulation of the argument Name leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References
exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.303535 - https://vuldb.com/?ctiid.303535 - https://vuldb.com/?submit.551863 - https://github.com/buluorifu/Vulnerability-recurrence/blob/main/Refer/Nimrod-SQL.md
CVE ID: CVE-2025-3324 State: PUBLISHED Published: 2025-04-06T22:31:04.648Z Last Updated: 2025-04-07T14:06:59.194Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: godcheese, code-projects Products: Nimrod Problem Types: CWE-434, CWE-284 Description: A vulnerability, which was classified as critical, has been found in godcheese/code-projects Nimrod 0.8. Affected by this issue is some unknown functionality of the file FileRestController.java. The manipulation of the argument File leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vul
en disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.303536 - https://vuldb.com/?ctiid.303536 - https://vuldb.com/?submit.551864 - https://github.com/buluorifu/Vulnerability-recurrence/blob/main/Refer/Nimrod-fileUpload.md
CVE ID: CVE-2025-3325 State: PUBLISHED Published: 2025-04-06T23:00:09.284Z Last Updated: 2025-04-07T14:06:13.430Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: iteaj Products: iboot 物联网网关 Problem Types: CWE-284, CWE-266 Description: A vulnerability, which was classified as problematic, was found in iteaj iboot 物联网网关 1.1.3. This affects an unknown part of the file /core/admin/pwd of the component Admin Password Handler. The manipulation of the argument ID leads to improper access controls. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: Reference
e exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.303537 - https://vuldb.com/?ctiid.303537 - https://vuldb.com/?submit.551869 - https://github.com/uglory-gll/javasec/blob/main/iboot.md#1logical-loopholes
CVE ID: CVE-2025-3326 State: PUBLISHED Published: 2025-04-06T23:31:04.426Z Last Updated: 2025-04-07T14:03:24.818Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: iteaj Products: iboot 物联网网关 Problem Types: CWE-79, CWE-94 Description: A vulnerability has been found in iteaj iboot 物联网网关 1.1.3 and classified as problematic. This vulnerability affects unknown code of the file /common/upload of the component File Upload. The manipulation of the argument File leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.303538 - https
c and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.303538 - https://vuldb.com/?ctiid.303538 - https://vuldb.com/?submit.551870 - https://github.com/uglory-gll/javasec/blob/main/iboot.md#2file-upload
CVE ID: CVE-2025-3327 State: PUBLISHED Published: 2025-04-07T00:00:10.080Z Last Updated: 2025-04-07T14:02:36.463Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: iteaj Products: iboot 物联网网关 Problem Types: CWE-79, CWE-94 Description: A vulnerability was found in iteaj iboot 物联网网关 1.1.3 and classified as problematic. This issue affects some unknown processing of the file /common/upload/batch of the component File Upload. The manipulation of the argument File leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.303539 - h
ublic and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.303539 - https://vuldb.com/?ctiid.303539 - https://vuldb.com/?submit.551871 - https://github.com/uglory-gll/javasec/blob/main/iboot.md#22commonuploadbatch-arbitrary-file-upload
CVE ID: CVE-2025-3328 State: PUBLISHED Published: 2025-04-07T00:31:07.509Z Last Updated: 2025-04-07T14:01:25.436Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C) Vendors: Tenda Products: AC1206 Problem Types: CWE-120, CWE-119 Description: A vulnerability was found in Tenda AC1206 15.03.06.23. It has been classified as critical. Affected is the function form_fast_setting_wifi_set of the file /goform/fast_setting_wifi_set. The manipulation of the argument ssid/timeZone leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well. Additional Analyst Notes: - CISA ADP Vulnrichmen
the public and may be used. Other parameters might be affected as well. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.303540 - https://vuldb.com/?ctiid.303540 - https://vuldb.com/?submit.551893 - https://github.com/CH13hh/tmp_store_cc/blob/main/AC1206/AC1206form_fast_setting_wifi_set_time/time.md - https://github.com/CH13hh/tmp_store_cc/blob/main/AC1206/AC1206form_fast_setting_wifi_set/form_fast_setting_wifi_set.md - https://www.tenda.com.cn/
CVE ID: CVE-2025-3329 State: PUBLISHED Published: 2025-04-07T01:00:14.297Z Last Updated: 2025-04-07T13:53:20.715Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Consumer Products: Comanda Mobile Problem Types: CWE-319, CWE-310 Description: A vulnerability classified as problematic has been found in Consumer Comanda Mobile up to 14.9.3.2/15.0.0.8. This affects an unknown part of the component Restaurant Order Handler. The manipulation of the argument Login/Password leads to cleartext transmission of sensitive information. The attack can only be initiated within the local network. The complexity of an attack is rather high. The exploitability is told to be diffi
e initiated within the local network. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.303543 - https://vuldb.com/?ctiid.303543 - https://vuldb.com/?submit.551790 - https://medium.com/@davimouar/from-order-to-exploit-a-deep-dive-into-restaurant-network-security-64aeaf3a6f64