Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-60311 State: PUBLISHED Published: 2025-10-08T00:00:00.000Z Last Updated: 2025-10-08T19:46:38.483Z Vendors: n/a Products: n/a Problem Types: n/a Description: ProjectWorlds Gym Management System1.0 is vulnerable to SQL Injection via the "id" parameter in the profile/edit.php page Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/projectworldsofficial/Gym-Management-System-Project-in-PHP - https://youtu.be/J_7G_AahgSw - https://github.com/ChuckBartowski7/Vulnerability-Research/blob/main/CVE-2025-60311/README.md
CVE ID: CVE-2025-60312 State: PUBLISHED Published: 2025-10-07T00:00:00.000Z Last Updated: 2025-10-08T20:43:21.533Z Vendors: n/a Products: n/a Problem Types: n/a Description: Sourcecodester Markdown to HTML Converter v1.0 is vulnerable to a Cross-Site Scripting (XSS) in the "Markdown Input" field, allowing a remote attacker to inject arbitrary HTML/JavaScript code that executes in the victim's browser upon clicking the "Convert to HTML" button. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.sourcecodester.com/php/18295/markdown-html-converter-using-php-and-javascript-source-code.html - https://github.com/ChuckBartowski7/Vulnerability-Research/blob/main/CVE-2025-6
ing-php-and-javascript-source-code.html - https://github.com/ChuckBartowski7/Vulnerability-Research/blob/main/CVE-2025-60312/README.md
CVE ID: CVE-2025-60313 State: PUBLISHED Published: 2025-10-08T00:00:00.000Z Last Updated: 2025-10-08T15:35:10.841Z Vendors: n/a Products: n/a Problem Types: n/a Description: Sourcecodester Link Status Checker 1.0 is vulnerable to a Cross-Site Scripting (XSS) in the Enter URLs to check input field. This allows a remote attacker to execute arbitrary code. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.sourcecodester.com/php/18275/link-status-checker-using-php-and-javascript-source-code.html - https://github.com/ChuckBartowski7/Vulnerability-Research/blob/main/CVE-2025-60313/README.md
CVE ID: CVE-2025-60314 State: PUBLISHED Published: 2025-10-08T00:00:00.000Z Last Updated: 2025-10-08T13:50:08.433Z Vendors: n/a Products: n/a Problem Types: n/a Description: Configuroweb Sistema Web de Inventario 1.0 is vulnerable to a Stored Cross-Site Scripting (XSS) due to the lack of input sanitization on the product name parameter (Nombre:Producto) allowing an authenticated attacker to inject malicious payloads and execute arbitrary JavaScript. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/configuroweb/inventariobasico - https://configuroweb.com/sistema-web-de-inventario-simple-en-php-mysql/ - https://github.com/ChuckBartowski7/Vulnerability-Researc
nfiguroweb.com/sistema-web-de-inventario-simple-en-php-mysql/ - https://github.com/ChuckBartowski7/Vulnerability-Research/blob/main/CVE-2025-60314/README.md
CVE ID: CVE-2025-60316 State: PUBLISHED Published: 2025-10-09T00:00:00.000Z Last Updated: 2025-10-10T13:56:07.242Z Vendors: n/a Products: n/a Problem Types: n/a Description: SourceCodester Pet Grooming Management Software 1.0 is vulnerable to SQL Injection in admin/view_customer.php via the ID parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.youtube.com/watch?v=KopMozY6X5w&t=191s&ab_channel=MayuriK - https://github.com/ChuckBartowski7/Vulnerability-Research/blob/main/CVE-2025-60316/README.md
CVE ID: CVE-2025-60318 State: PUBLISHED Published: 2025-10-08T00:00:00.000Z Last Updated: 2025-10-08T15:54:04.656Z Vendors: n/a Products: n/a Problem Types: n/a Description: SourceCodester Pet Grooming Management Software 1.0 is vulnerable to Cross Site Scripting (XSS) in /admin/profile.php via the fname (First Name) and lname (Last Name) fields. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.youtube.com/watch?v=KopMozY6X5w&t=191s&ab_channel=MayuriK - https://github.com/ChuckBartowski7/Vulnerability-Research/blob/main/CVE-2025-60318/README.md
CVE ID: CVE-2025-60319 State: PUBLISHED Published: 2025-10-30T00:00:00.000Z Last Updated: 2025-10-30T20:51:08.362Z Vendors: n/a Products: n/a Problem Types: n/a Description: PerfreeBlog v4.0.11 is vulnerable to Server-Side Request Forgery due to a missing authorization check in the uploadAttachByUrl API endpoint (AttachController.java). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/PerfreeBlog/PerfreeBlog/issues/20 - https://github.com/PerfreeBlog/PerfreeBlog/commit/103c79165e3a41a1729188fdc8a1e90c97c0a06d
CVE ID: CVE-2025-60320 State: PUBLISHED Published: 2025-10-29T00:00:00.000Z Last Updated: 2025-10-30T14:40:19.867Z Vendors: n/a Products: n/a Problem Types: n/a Description: memoQ 10.1.13.ef1b2b52aae and earlier contains an unquoted service path vulnerability in the memoQ Auto Update Service (memoQauhlp101). The affected service is installed with a path containing spaces and without surrounding quotes. This misconfiguration allows local users to escalate privileges to SYSTEM by placing a malicious executable at C:\Program.exe. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.memoq.com/helpcenter/ - https://github.com/joseraeiro/security-advisories/blob/e0b1095de8
nt: References: - https://docs.memoq.com/helpcenter/ - https://github.com/joseraeiro/security-advisories/blob/e0b1095de8b3162fb0d9de9a688317a12fdd9be8/CVE-2025-60320.md
CVE ID: CVE-2025-60331 State: PUBLISHED Published: 2025-10-22T00:00:00.000Z Last Updated: 2025-10-23T14:35:57.194Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-Link DIR-823G A1 v1.0.2B05 was discovered to contain a buffer overflow in the FillMacCloneMac parameter in the /EXCU_SHELL endpoint. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dlink.com/en/security-bulletin/ - https://github.com/z472421519/BinaryAudit/blob/main/PoC/BOF/DIR823G/FillMacCloneMac/FillMacCloneMac.md
CVE ID: CVE-2025-60332 State: PUBLISHED Published: 2025-10-22T00:00:00.000Z Last Updated: 2025-10-23T14:36:04.330Z Vendors: n/a Products: n/a Problem Types: n/a Description: A NULL pointer dereference in the SetWLanRadioSettings function of D-Link DIR-823G A1 v1.0.2B05 allows attackers to cause a Denial of Service (DoS) via a crafted HTTP request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dlink.com/en/security-bulletin/ - https://github.com/z472421519/BinaryAudit/blob/main/PoC/NPD/DIR823G/SetWLanRadioSetting.md
CVE ID: CVE-2025-60333 State: PUBLISHED Published: 2025-10-22T00:00:00.000Z Last Updated: 2025-10-23T14:35:51.424Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOLINK N600R v4.3.0cu.7866_B20220506 was discovered to contain a stack overflow in the wepkey2 parameter in the setWiFiMultipleConfig function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/z472421519/BinaryAudit/blob/main/PoC/BOF/TOTOLINK/wepkey2/wepkey2.md
CVE ID: CVE-2025-60334 State: PUBLISHED Published: 2025-10-22T00:00:00.000Z Last Updated: 2025-10-23T14:35:44.237Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOLINK N600R v4.3.0cu.7866_B20220506 was discovered to contain a stack overflow in the ssid parameter in the setWiFiBasicConfig function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/z472421519/BinaryAudit/tree/main/PoC/BOF/TOTOLINK/sub_41E0C0 - https://github.com/z472421519/BinaryAudit/blob/main/PoC/BOF/TOTOLINK/sub_41E0C0/ssid.md
CVE ID: CVE-2025-60335 State: PUBLISHED Published: 2025-10-22T00:00:00.000Z Last Updated: 2025-10-23T14:35:36.611Z Vendors: n/a Products: n/a Problem Types: n/a Description: A NULL pointer dereference in the main function of TOTOLINK N600R v4.3.0cu.7866_B20220506 allows attackers to cause a Denial of Service (DoS) via a crafted HTTP request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/z472421519/BinaryAudit/blob/main/PoC/NPD/TOTOLink/main/CONTENT_LENGTH_MAX.md
CVE ID: CVE-2025-60336 State: PUBLISHED Published: 2025-10-22T00:00:00.000Z Last Updated: 2025-10-23T16:26:39.193Z Vendors: n/a Products: n/a Problem Types: n/a Description: A NULL pointer dereference in the sub_41773C function of TOTOLINK N600R v4.3.0cu.7866_B20220506 allows attackers to cause a Denial of Service (DoS) via a crafted HTTP request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/z472421519/BinaryAudit/blob/main/PoC/NPD/TOTOLink/sub_41773C/sub_41773C.md
CVE ID: CVE-2025-60337 State: PUBLISHED Published: 2025-10-22T00:00:00.000Z Last Updated: 2025-10-27T16:05:45.523Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda AC6 V2.0 15.03.06.50 was discovered to contain a buffer overflow in the speed_dir parameter in the SetSpeedWan function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/z472421519/BinaryAudit/blob/main/PoC/BOF/Tenda/SetSpeedWan.md
CVE ID: CVE-2025-60338 State: PUBLISHED Published: 2025-10-22T00:00:00.000Z Last Updated: 2025-10-23T16:25:29.891Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda AC6 V2.0 15.03.06.50 was discovered to contain a stack overflow in the page parameter in the DhcpListClient function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/z472421519/BinaryAudit/blob/main/PoC/BOF/Tenda/fromDhcpListClient/fromDhcpListClient.md
CVE ID: CVE-2025-60339 State: PUBLISHED Published: 2025-10-22T00:00:00.000Z Last Updated: 2025-10-27T16:06:19.130Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple buffer overflow vulnerabilities in the openSchedWifi function of Tenda AC6 v.15.03.06.50 allows attackers to cause a Denial of Service (DoS) via injecting a crafted payload into the schedStartTime and schedEndTime parameters. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/z472421519/BinaryAudit/blob/main/PoC/BOF/Tenda/setSchedWifi/setSchedWifi.md
CVE ID: CVE-2025-60340 State: PUBLISHED Published: 2025-10-22T00:00:00.000Z Last Updated: 2025-10-28T15:07:31.877Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple buffer overflows in the SetClientState function of Tenda AC6 v.15.03.06.50 allows attackers to cause a Denial of Service (DoS) via injecting a crafted payload into the limitSpeed, deviceId, and limitSpeedUp parameters. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/z472421519/BinaryAudit/blob/main/PoC/BOF/Tenda/SetClientState/SetClientState.md
CVE ID: CVE-2025-60341 State: PUBLISHED Published: 2025-10-22T00:00:00.000Z Last Updated: 2025-10-28T15:07:11.918Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda AC6 V2.0 15.03.06.50 was discovered to contain a stack overflow in the ssid parameter in the fast_setting_wifi_set function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/z472421519/BinaryAudit/blob/main/PoC/BOF/Tenda/fast_setting_wifi_set/fast_setting_wifi_set.md
CVE ID: CVE-2025-60342 State: PUBLISHED Published: 2025-10-22T00:00:00.000Z Last Updated: 2025-10-23T14:45:35.470Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda AC6 V2.0 15.03.06.50 was discovered to contain a stack overflow in the page parameter in the addressNat function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/z472421519/BinaryAudit/blob/main/PoC/BOF/Tenda/addressNat/addressNat.md
CVE ID: CVE-2025-60343 State: PUBLISHED Published: 2025-10-22T00:00:00.000Z Last Updated: 2025-10-23T13:58:28.931Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple buffer overflows in the AdvSetMacMtuWan function of Tenda AC6 v.15.03.06.50 allows attackers to cause a Denial of Service (DoS) via injecting a crafted payload into the wanMTU, wanSpeed, cloneType, mac, serviceName, serverName, wanMTU2, wanSpeed2, cloneType2, mac2, serviceName2, and serverName2 parameters. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/z472421519/BinaryAudit/blob/main/PoC/BOF/Tenda/AdvSetMacMtuWan/AdvSetMacMtuWan.md
CVE ID: CVE-2025-60344 State: PUBLISHED Published: 2025-10-21T00:00:00.000Z Last Updated: 2025-10-21T20:22:10.625Z Vendors: n/a Products: n/a Problem Types: n/a Description: An unauthenticated Local File Inclusion (LFI) vulnerability in D-Link DSR series routers allows remote attackers to retrieve sensitive configuration files in clear text. The exposed files contain administrative credentials, VPN settings, and other sensitive information, enabling full administrative access to the router. Affected Products include: DSR-150, DSR-150N, and DSR-250N v1.09B32_WW. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/fyoozr/D-Link-DSR-N250-LFI-Vulnerability/ - http
nalyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/fyoozr/D-Link-DSR-N250-LFI-Vulnerability/ - https://github.com/fyoozr/vulnerability-research/tree/main/CVE-2025-60344
CVE ID: CVE-2025-60349 State: PUBLISHED Published: 2025-10-28T00:00:00.000Z Last Updated: 2025-10-29T14:20:06.640Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Prevx v3.0.5.220 allowing attackers to cause a denial of service via sending IOCTL code 0x22E044 to the pxscan.sys driver. Any processes listed under registry key HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\pxscan\Files will be terminated. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://prevx.com - https://github.com/djackreuter/CVE-2025-60349
CVE ID: CVE-2025-60354 State: PUBLISHED Published: 2025-10-28T00:00:00.000Z Last Updated: 2025-10-29T14:56:23.126Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unauthorized modification of arbitrary articles vulnerability exists in blog-vue-springboot. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/line2222/vuln/issues/3
CVE ID: CVE-2025-60355 State: PUBLISHED Published: 2025-10-28T00:00:00.000Z Last Updated: 2025-10-29T13:59:43.618Z Vendors: n/a Products: n/a Problem Types: n/a Description: zhangyd-c OneBlog before 2.3.9 was vulnerable to SSTI (Server-Side Template Injection) via FreeMarker templates. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/line2222/vuln/issues/4
CVE ID: CVE-2025-60358 State: PUBLISHED Published: 2025-10-16T00:00:00.000Z Last Updated: 2025-10-20T20:39:11.449Z Vendors: n/a Products: n/a Problem Types: n/a Description: radare2 v.5.9.8 and before contains a memory leak in the function _load_relocations. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/radareorg/radare2/pull/24224
CVE ID: CVE-2025-60359 State: PUBLISHED Published: 2025-10-17T00:00:00.000Z Last Updated: 2025-10-20T20:38:53.905Z Vendors: n/a Products: n/a Problem Types: n/a Description: radare2 v5.9.8 and before contains a memory leak in the function r_bin_object_new. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/radareorg/radare2/pull/24215
CVE ID: CVE-2025-60360 State: PUBLISHED Published: 2025-10-17T00:00:00.000Z Last Updated: 2025-10-20T20:38:37.641Z Vendors: n/a Products: n/a Problem Types: n/a Description: radare2 v5.9.8 and before contains a memory leak in the function r2r_subprocess_init. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/radareorg/radare2/pull/24245
CVE ID: CVE-2025-60361 State: PUBLISHED Published: 2025-10-17T00:00:00.000Z Last Updated: 2025-10-20T20:39:54.763Z Vendors: n/a Products: n/a Problem Types: n/a Description: radare2 v5.9.8 and before contains a memory leak in the function bochs_open. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/radareorg/radare2/pull/24312
CVE ID: CVE-2025-60374 State: PUBLISHED Published: 2025-10-14T00:00:00.000Z Last Updated: 2025-10-15T19:26:30.990Z Vendors: n/a Products: n/a Problem Types: n/a Description: Stored Cross-Site Scripting (XSS) in Perfex CRM chatbot before 3.3.1 allows attackers to inject arbitrary HTML/JavaScript. The payload is executed in the browsers of users viewing the chat, resulting in client-side code execution, potential session token theft, and other malicious actions. A different vulnerability than CVE-2024-8867. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ajansha/CVE-2025-60374
CVE ID: CVE-2025-60375 State: PUBLISHED Published: 2025-10-09T00:00:00.000Z Last Updated: 2025-10-10T14:16:07.565Z Vendors: n/a Products: n/a Problem Types: n/a Description: The authentication mechanism in Perfex CRM before 3.3.1 allows attackers to bypass login credentials due to insufficient server-side validation. By sending empty username and password parameters in the login request, an attacker can gain unauthorized access to user accounts, including administrative accounts, without providing valid credentials. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/AhamedYaseen03/CVE-2025-60375
CVE ID: CVE-2025-60378 State: PUBLISHED Published: 2025-10-10T00:00:00.000Z Last Updated: 2025-10-10T21:17:22.909Z Vendors: n/a Products: n/a Problem Types: n/a Description: Stored HTML injection in RISE Ultimate Project Manager & CRM allows authenticated users to inject arbitrary HTML into invoices and messages. Injected content renders in emails, PDFs, and messaging/chat modules sent to clients or team members, enabling phishing, credential theft, and business email compromise. Automated recurring invoices and messaging amplify the risk by distributing malicious content to multiple recipients. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://rise.com - https://github
o multiple recipients. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://rise.com - https://github.com/ajansha/CVE-2025-60378
CVE ID: CVE-2025-60419 State: PUBLISHED Published: 2025-10-24T00:00:00.000Z Last Updated: 2025-10-24T20:12:22.416Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the NDIS Usermode IO driver (RtkIOAC60.sys, version 6.0.5600.16348) allowing local authenticated attackers to send a crafted IOCTL request to the driver to cause a denial of service. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://realtek.com - http://ndis.com - https://splineuser.github.io/posts/RTKVuln/
CVE ID: CVE-2025-60424 State: PUBLISHED Published: 2025-10-27T00:00:00.000Z Last Updated: 2025-10-27T15:48:28.679Z Vendors: n/a Products: n/a Problem Types: n/a Description: A lack of rate limiting in the OTP verification component of Nagios Fusion v2024R1.2 and v2024R2 allows attackers to bypass authentication via a bruteforce attack. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/aakashtyal/2FA-Bypass-using-a-Brute-Force-Attack - https://www.nagios.com/changelog/#fusion - https://github.com/aakashtyal/2FA-Bypass-using-a-Brute-Force-Attack-CVE-2025-60424
CVE ID: CVE-2025-60425 State: PUBLISHED Published: 2025-10-27T00:00:00.000Z Last Updated: 2025-10-27T19:52:37.137Z Vendors: n/a Products: n/a Problem Types: n/a Description: Nagios Fusion v2024R1.2 and v2024R2 does not invalidate already existing session tokens when the two-factor authentication mechanism is enabled, allowing attackers to perform a session hijacking attack. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.nagios.com/changelog/#fusion - https://github.com/aakashtyal/Session-Persistence-After-Enabling-2FA - https://github.com/aakashtyal/Session-Persistence-After-Enabling-2FA-CVE-2025-60425
CVE ID: CVE-2025-60427 State: PUBLISHED Published: 2025-10-21T00:00:00.000Z Last Updated: 2025-10-22T14:52:12.820Z Vendors: n/a Products: n/a Problem Types: n/a Description: LibreTime 3.0.0-alpha.10 and possibly earlier is vulnerable to Broken Access Control, where a user with the DJ role can access analytics data via the Web UI and direct API calls. The backend does not verify role-based permissions for analytics endpoints, allowing unauthorized retrieval of station-wide metrics. This results in information disclosure to less privileged users. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/libretime/libretime - https://github.com/libretime/libretime/issu
ISA ADP Vulnrichment: References: - https://github.com/libretime/libretime - https://github.com/libretime/libretime/issues/1251 - https://beafn28.gitbook.io/beafn28/cve/broken-access-control-in-libretime-analytics-endpoints-cve-2025-60427
CVE ID: CVE-2025-60445 State: PUBLISHED Published: 2025-10-03T00:00:00.000Z Last Updated: 2025-10-03T15:47:25.960Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored Cross-Site Scripting (XSS) vulnerability has been discovered in XunRuiCMS version 4.7.1. The vulnerability exists due to insufficient validation of SVG file uploads in the dayrui/Fcms/Library/Upload.php component, allowing attackers to inject malicious JavaScript code that executes when the uploaded file is viewed. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://snowhy77.github.io/2025/08/18/File-Upload-to-Achieve-Stored-XSS-Attack/
CVE ID: CVE-2025-60447 State: PUBLISHED Published: 2025-10-03T00:00:00.000Z Last Updated: 2025-10-15T13:42:24.484Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored Cross-Site Scripting (XSS) vulnerability has been discovered in Emlog Pro 2.5.19. The vulnerability exists in the email template configuration component located at /admin/setting.php?action=mail, which allows administrators to input HTML code that is not properly sanitized, leading to persistent JavaScript execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://snowhy77.github.io/2025/08/21/Stored-XSS-Vulnerability-in-Emlog-Pro-HTML-Injection/
CVE ID: CVE-2025-60448 State: PUBLISHED Published: 2025-10-03T00:00:00.000Z Last Updated: 2025-10-03T15:48:57.375Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored Cross-Site Scripting (XSS) vulnerability has been discovered in Emlog Pro 2.5.19. The vulnerability exists due to insufficient validation of SVG file uploads in the /admin/media.php component, allowing attackers to upload malicious SVG files containing JavaScript code that executes when the uploaded file is viewed. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://snowhy77.github.io/2025/08/21/SVG-File-Upload-XSS-Vulnerability-in-Emlog-Pro/
CVE ID: CVE-2025-60449 State: PUBLISHED Published: 2025-10-03T00:00:00.000Z Last Updated: 2025-10-03T14:39:22.652Z Vendors: n/a Products: n/a Problem Types: n/a Description: An information disclosure vulnerability has been discovered in SeaCMS 13.1. The vulnerability exists in the admin_safe.php component located in the /btcoan/ directory. This security flaw allows authenticated administrators to scan and download not only the application’s source code but also potentially any file accessible on the server’s root directory. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://snowhy77.github.io/2025/08/21/Information-Disclosure-Vulnerability-in-SeaCMS/