Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-62266 State: PUBLISHED Published: 2025-10-30T17:37:21.375Z Last Updated: 2025-10-30T19:06:43.671Z Vendors: Liferay Products: Portal, DXP Problem Types: CWE-601 Description: By default, Liferay Portal 7.4.0 through 7.4.3.119, and older unsupported versions, and Liferay DXP 2024.Q1.1 through 2024.Q1.5, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and older unsupported versions is vulnerable to DNS rebinding attacks, which allows remote attackers to redirect users to arbitrary external URLs. This vulnerability can be mitigated by changing the redirect URL security from IP to domain. Additional Analyst Notes: - CISA ADP Vulnrichment: Refe
tigated by changing the redirect URL security from IP to domain. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-62256
CVE ID: CVE-2025-62267 State: PUBLISHED Published: 2025-10-31T18:12:50.703Z Last Updated: 2025-11-03T15:48:52.733Z Vendors: Liferay Products: Portal, DXP Problem Types: CWE-79 Description: Multiple cross-site scripting (XSS) vulnerabilities in web content template’s select structure page in Liferay Portal 7.4.3.35 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 update 35 through update 92 allow remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a user’s (1) First Name, (2) Middle Name, or (3) Last Name text field. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://liferay.dev/por
e, or (3) Last Name text field. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-62267
CVE ID: CVE-2025-62275 State: PUBLISHED Published: 2025-11-01T02:42:50.698Z Last Updated: 2025-11-03T15:47:50.284Z Vendors: Liferay Products: Portal, DXP Problem Types: CWE-863 Description: Blogs in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and older unsupported versions does not check permission of images in a blog entry, which allows remote attackers to view the images in a blog entry via crafted URL. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-202
richment: References: - https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-62275
CVE ID: CVE-2025-62276 State: PUBLISHED Published: 2025-10-31T23:34:20.166Z Last Updated: 2025-11-03T13:31:38.847Z Vendors: Liferay Products: Portal, DXP Problem Types: CWE-525 Description: The Document Library and the Adaptive Media modules in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and older unsupported versions uses an incorrect cache-control header, which allows local users to obtain access to downloaded files via the browser's cache. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://liferay.dev/portal/security/known-vulnerabilities/
itional Analyst Notes: - CISA ADP Vulnrichment: References: - https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-62276
CVE ID: CVE-2025-62287 State: PUBLISHED Published: 2025-10-21T20:03:15.160Z Last Updated: 2025-10-21T20:47:51.838Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Oracle Corporation Products: Oracle Life Sciences InForm Problem Types: Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Life Sciences InForm. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Life Sciences InForm, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, ins
pact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Life Sciences InForm accessible data as well as unauthorized read access to a subset of Oracle Life Sciences InForm accessible data. Description: Vulnerability in the Oracle Life Sciences InForm product of Oracle Health Sciences Applications (component: Web Server). The supported version that is affected is 7.0.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Life Sciences InForm. Successful attacks require human interaction from a person other than the attacker and
mise Oracle Life Sciences InForm. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Life Sciences InForm, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Life Sciences InForm accessible data as well as unauthorized read access to a subset of Oracle Life Sciences InForm accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://w
VSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.oracle.com/security-alerts/cpuoct2025.html
CVE ID: CVE-2025-62288 State: PUBLISHED Published: 2025-10-21T20:03:15.580Z Last Updated: 2025-10-21T20:46:26.380Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: Oracle Corporation Products: Oracle Health Sciences Data Management Workbench Problem Types: Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Health Sciences Data Management Workbench. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Health Sciences Data Management Workbench accessible data. Description: Vulnerability in the Oracle Health Sciences Data Manage
Sciences Data Management Workbench accessible data. Description: Vulnerability in the Oracle Health Sciences Data Management Workbench product of Oracle Health Sciences Applications (component: Logger). Supported versions that are affected are 3.4.0.1.3 and 3.4.1.0.10. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Health Sciences Data Management Workbench. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Health Sciences Data Management Workbench accessible data. CVSS 3.1 Base Score 4.9 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H
ment Workbench accessible data. CVSS 3.1 Base Score 4.9 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.oracle.com/security-alerts/cpuoct2025.html
CVE ID: CVE-2025-62289 State: PUBLISHED Published: 2025-10-21T20:03:16.035Z Last Updated: 2025-10-21T20:45:26.231Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H) Vendors: Oracle Corporation Products: Oracle ZFS Storage Appliance Kit Problem Types: Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle ZFS Storage Appliance Kit. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle ZFS Storage Appliance Kit. Description: Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: File
iance Kit. Description: Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Filesystems). The supported version that is affected is 8.8. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle ZFS Storage Appliance Kit. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle ZFS Storage Appliance Kit. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.oracle.com/security-
UI:N/S:U/C:N/I:N/A:H). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.oracle.com/security-alerts/cpuoct2025.html
CVE ID: CVE-2025-62290 State: PUBLISHED Published: 2025-10-21T20:03:16.439Z Last Updated: 2025-10-23T03:55:27.137Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Oracle Corporation Products: Oracle ZFS Storage Appliance Kit Problem Types: Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle ZFS Storage Appliance Kit. Successful attacks of this vulnerability can result in takeover of Oracle ZFS Storage Appliance Kit. Description: Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Block Storage). The supported version that is affected is 8.8. Easily exploitabl
t product of Oracle Systems (component: Block Storage). The supported version that is affected is 8.8. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle ZFS Storage Appliance Kit. Successful attacks of this vulnerability can result in takeover of Oracle ZFS Storage Appliance Kit. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.oracle.com/security-alerts/cpuoct2025.html
CVE ID: CVE-2025-62292 State: PUBLISHED Published: 2025-10-10T00:00:00.000Z Last Updated: 2025-10-10T14:21:31.171Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: SonarSource Products: SonarQube Problem Types: CWE-669 Description: In SonarQube before 25.6, 2025.3 Commercial, and 2025.1.3 LTA, authenticated low-privileged users can query the /api/v2/users-management/users endpoint and obtain user fields intended for administrators only, including the email addresses of other accounts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://sonarsource.atlassian.net/browse/SONAR-24830
CVE ID: CVE-2025-62293 State: PUBLISHED Published: 2025-11-20T15:43:30.849Z Last Updated: 2025-11-20T19:17:39.653Z Vendors: SOPlanning Products: SOPlanning Problem Types: CWE-862 Description: SOPlanning is vulnerable to Broken Access Control in /status endpoint. Due to lack of permission checks in Project Status functionality an authenticated attacker is able to add, edit and delete any status. This issue was fixed in version 1.55. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert.pl/en/posts/2025/11/CVE-2025-62293 - https://www.soplanning.org/en/
CVE ID: CVE-2025-62294 State: PUBLISHED Published: 2025-11-20T15:43:40.993Z Last Updated: 2025-11-20T18:59:36.982Z Vendors: SOPlanning Products: SOPlanning Problem Types: CWE-340 Description: SOPlanning is vulnerable to Predictable Generation of Password Recovery Token. Due to weak mechanism of generating recovery tokens, a malicious attacker is able to brute-force all possible values and takeover any account in reasonable amount of time. This issue was fixed in version 1.55. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert.pl/en/posts/2025/11/CVE-2025-62293 - https://www.soplanning.org/en/
CVE ID: CVE-2025-62295 State: PUBLISHED Published: 2025-11-20T15:43:45.349Z Last Updated: 2025-11-20T21:11:57.203Z Vendors: SOPlanning Products: SOPlanning Problem Types: CWE-79 Description: SOPlanning is vulnerable to Stored XSS in /groupe_form endpoint. Malicious attacker with medium privileges can inject arbitrary HTML and JS into website, which will be rendered/executed when opening editor. This issue was fixed in version 1.55. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert.pl/en/posts/2025/11/CVE-2025-62293 - https://www.soplanning.org/en/
CVE ID: CVE-2025-62296 State: PUBLISHED Published: 2025-11-20T15:43:51.166Z Last Updated: 2025-11-20T21:21:16.375Z Vendors: SOPlanning Products: SOPlanning Problem Types: CWE-79 Description: SOPlanning is vulnerable to Stored XSS in /taches endpoint. Malicious attacker with medium privileges can inject arbitrary HTML and JS into website, which will be rendered/executed when opening editor. This issue was fixed in version 1.55. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert.pl/en/posts/2025/11/CVE-2025-62293 - https://www.soplanning.org/en/
CVE ID: CVE-2025-62297 State: PUBLISHED Published: 2025-11-20T15:43:56.423Z Last Updated: 2025-11-20T21:24:11.180Z Vendors: SOPlanning Products: SOPlanning Problem Types: CWE-79 Description: SOPlanning is vulnerable to Stored XSS in /projets endpoint. Malicious attacker with medium privileges can inject arbitrary HTML and JS into website, which will be rendered/executed when opening edited page. This issue was fixed in version 1.55. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert.pl/en/posts/2025/11/CVE-2025-62293 - https://www.soplanning.org/en/
CVE ID: CVE-2025-62346 State: PUBLISHED Published: 2025-11-20T08:08:06.667Z Last Updated: 2025-11-20T15:28:53.148Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:A/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: HCL Software Products: Glovius Cloud Problem Types: CWE-352 Description: A Cross-Site Request Forgery (CSRF) vulnerability was identified in HCL Glovius Cloud. An attacker can force a user's web browser to execute an unwanted, malicious action on a trusted site where the user is authenticated, specifically on one endpoint. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0126459
CVE ID: CVE-2025-62353 State: PUBLISHED Published: 2025-10-17T15:27:59.005Z Last Updated: 2025-10-17T15:51:17.309Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Windsurf Products: Windsurf Problem Types: CWE-22 Description: A path traversal vulnerability in all versions of the Windsurf IDE enables a threat actor to read and write arbitrary local files in and outside of current projects on an end user’s system. The vulnerability can be reached directly and through indirect prompt injection. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://hiddenlayer.com/sai_security_advisor/2025-10-windsurf/
CVE ID: CVE-2025-62356 State: PUBLISHED Published: 2025-10-17T15:36:12.710Z Last Updated: 2025-10-17T15:48:52.236Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Qodo Products: Qodo Gen Problem Types: CWE-22 Description: A path traversal vulnerability in all versions of the Qodo Qodo Gen IDE enables a threat actor to read arbitrary local files in and outside of current projects on an end user’s system. The vulnerability can be reached directly and through indirect prompt injection. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://hiddenlayer.com/sai_security_advisor/2025-10-qodogen/
CVE ID: CVE-2025-62358 State: PUBLISHED Published: 2025-10-13T21:16:40.803Z Last Updated: 2025-10-14T15:13:10.172Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) Vendors: LabRedesCefetRJ Products: WeGIA Problem Types: CWE-79 Description: WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. Prior to 3.5.1, the log parameter in configuracao_geral.php is vulnerable to Reflected Cross-Site Scripting (XSS). An attacker can inject arbitrary JavaScript, which executes in the victim’s browser. This vulnerability is fixed in 3.5.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/LabRedesCefetRJ/We
s fixed in 3.5.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-g6hr-2rhx-f8q4 - https://github.com/LabRedesCefetRJ/WeGIA/commit/eddb9b134883cac5d0de770bfcca6e05bfcbd684
CVE ID: CVE-2025-62359 State: PUBLISHED Published: 2025-10-13T21:21:48.242Z Last Updated: 2025-10-14T15:13:37.134Z Vendors: LabRedesCefetRJ Products: WeGIA Problem Types: CWE-79 Description: WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. Prior to 3.5.0, a Reflected Cross-Site Scripting (XSS) vulnerability was identified in the /pet/profile_pet.php?id_pet= endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts in the id_pet parameter. This vulnerability is fixed in 3.5.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-
Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-68mw-h9q4-j34f - https://github.com/LabRedesCefetRJ/WeGIA/issues/257 - https://github.com/LabRedesCefetRJ/WeGIA/commit/176733543c9b6762bef5ddec7c9c555f76fafa1d
CVE ID: CVE-2025-62360 State: PUBLISHED Published: 2025-10-13T21:24:48.969Z Last Updated: 2025-10-14T15:14:43.100Z Vendors: LabRedesCefetRJ Products: WeGIA Problem Types: CWE-89 Description: WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users.Prior to 3.5.1, a SQL Injection vulnerability was identified in the /html/funcionario/dependente_documento.php endpoint, specifically in the id_dependente parameter. This vulnerability allows attackers to execute arbitrary SQL commands, compromising the confidentiality, integrity, and availability of the database. This vulnerability is fixed in 3.5.1. Additional Analyst Notes: - CISA ADP Vulnrichment: Reference
lity of the database. This vulnerability is fixed in 3.5.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-mwvv-q9gh-gwxm - https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-m4j6-q5m4-x24g - https://github.com/LabRedesCefetRJ/WeGIA/issues/310 - https://github.com/LabRedesCefetRJ/WeGIA/commit/7abbffd3915a64b97dde01954222fc0fbd804f70
CVE ID: CVE-2025-62361 State: PUBLISHED Published: 2025-10-13T21:27:38.572Z Last Updated: 2025-10-14T15:15:13.687Z Vendors: LabRedesCefetRJ Products: WeGIA Problem Types: CWE-601 Description: WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. Prior to 3.5.0, an Open Redirect vulnerability was identified in the control.php endpoint of the WeGIA application, specifically in the nextPage parameter (metodo=listarTodos nomeClasse=AlmoxarifeControle). This vulnerability allows attackers to redirect users to arbitrary external domains, enabling phishing campaigns, malicious payload distribution, or user credential theft. This vulnerability is fixed in 3.
enabling phishing campaigns, malicious payload distribution, or user credential theft. This vulnerability is fixed in 3.5.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-m99c-77f2-gpjx - https://github.com/LabRedesCefetRJ/WeGIA/commit/2b53003b5956dbbf0ce554b680245f55ad869821
CVE ID: CVE-2025-62362 State: PUBLISHED Published: 2025-10-13T21:33:35.199Z Last Updated: 2025-10-14T15:15:41.171Z Vendors: GPP-Woo Products: GPP-burgerportaal Problem Types: CWE-359 Description: gpp-burgerportaal is a Dutch government citizen portal application. In versions before 2.0.3, 3.0.2, and 4.0.1, the name and email address of employees who publish content are exposed in network responses and can be discovered by viewing the browser's developer tools network tab. This information disclosure may violate employee privacy expectations and could be used for targeted attacks or unwanted contact. This issue has been patched in versions 2.0.3, 3.0.2, and 4.0.1. No known workarounds exist.
tacks or unwanted contact. This issue has been patched in versions 2.0.3, 3.0.2, and 4.0.1. No known workarounds exist. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/GPP-Woo/GPP-burgerportaal/security/advisories/GHSA-pgg6-2865-2788
CVE ID: CVE-2025-62363 State: PUBLISHED Published: 2025-10-13T21:37:48.474Z Last Updated: 2025-10-14T15:16:16.648Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: zheny-creator Products: YtGrabber-TUI Problem Types: CWE-59 Description: yt-grabber-tui is a terminal user interface application for downloading videos. In versions before 1.0-rc, the application allows users to configure the path to the yt-dlp executable via the path_to_yt_dlp configuration setting. An attacker with write access to the configuration file or the filesystem location of the configured executable can replace the executable with malicious code or create a symlink to an arbitrary executab
of the configured executable can replace the executable with malicious code or create a symlink to an arbitrary executable. When the application invokes yt-dlp, the malicious code is executed with the privileges of the user running yt-grabber-tui. This vulnerability has been patched in version 1.0-rc. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/zheny-creator/YtGrabber-TUI/security/advisories/GHSA-94c4-wh57-8p9c - https://github.com/zheny-creator/YtGrabber-TUI/commit/7adfdb68e8bf24559d1e9d8d4668de3d82c45591
CVE ID: CVE-2025-62364 State: PUBLISHED Published: 2025-10-13T20:30:56.391Z Last Updated: 2025-10-14T15:09:00.909Z Severity: MEDIUM (CVSS 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: oobabooga Products: text-generation-webui Problem Types: CWE-59 Description: text-generation-webui is an open-source web interface for running Large Language Models. In versions through 3.13, a Local File Inclusion vulnerability exists in the character picture upload feature. An attacker can upload a text file containing a symbolic link to an arbitrary file path. When the application processes the upload, it follows the symbolic link and serves the contents of the targeted file through the web inte
ion processes the upload, it follows the symbolic link and serves the contents of the targeted file through the web interface. This allows an unauthenticated attacker to read sensitive files on the server, potentially exposing system configurations, credentials, and other confidential information. This vulnerability is fixed in 3.14. No known workarounds exist. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/oobabooga/text-generation-webui/security/advisories/GHSA-66rw-q8w5-c2hg - https://github.com/oobabooga/text-generation-webui/commit/282aa1918907fceec7f903d3dc2bc8492ce8e885
CVE ID: CVE-2025-62365 State: PUBLISHED Published: 2025-10-13T21:43:49.802Z Last Updated: 2025-10-14T15:16:41.306Z Vendors: librenms Products: librenms Problem Types: CWE-79 Description: LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. Prior to 25.7.0, there is a reflected-XSS in `report_this` function in `librenms/includes/functions.php`. The `report_this` function had improper filtering (`htmlentities` function was incorrectly use in a href environment), which caused the `project_issues` parameter to trigger an XSS vulnerability. This vulnerability is fixed in 25.7.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/librenms/lib