Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
demonstrated by the ability to fetch and exfiltrate the contents of the /admin/users endpoint. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://self.best - https://rohitchaudhary045.medium.com/cve-2025-63416-the-admin-panel-heist-stored-xss-to-privilege-escalation-b4c69d8487f1
CVE ID: CVE-2025-63417 State: PUBLISHED Published: 2025-11-05T00:00:00.000Z Last Updated: 2025-11-06T16:58:11.284Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Stored Cross-Site Scripting (XSS) vulnerability in the chat functionality of the SelfBest platform 2023.3 allows authenticated attackers to inject arbitrary web scripts or HTML via the chat message input field. This malicious content is stored and then executed in the context of other users' browsers when they view the malicious message, potentially leading to session hijacking, account takeover, or other client-side attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://rohitchaudhary045.med
ther client-side attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://rohitchaudhary045.medium.com/cve-2025-63417-the-chatroom-compromise-stored-xss-in-selfbest-platform-f34ddcd984ea
CVE ID: CVE-2025-63418 State: PUBLISHED Published: 2025-11-05T00:00:00.000Z Last Updated: 2025-11-06T16:56:12.356Z Vendors: n/a Products: n/a Problem Types: n/a Description: A DOM-based Cross-Site Scripting (XSS) vulnerability in the SelfBest platform 2023.3 allows attackers to execute arbitrary JavaScript in the context of a logged-in user's session by injecting payloads via the browser's developer console. The vulnerability arises from the application's client-side code being susceptible to direct DOM manipulation without adequate sanitization or a Content Security Policy (CSP), potentially leading to account takeover and data theft. Additional Analyst Notes: - CISA ADP Vulnrichment: Refer
(CSP), potentially leading to account takeover and data theft. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://rohitchaudhary045.medium.com/cve-2025-63418-weaponizing-the-browser-console-a-dom-based-xss-deep-dive-25ed3ac9cb53
CVE ID: CVE-2025-63419 State: PUBLISHED Published: 2025-11-12T00:00:00.000Z Last Updated: 2025-11-12T21:35:39.033Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) vulnerability in CrushFTP 11.3.6_48. The Web-Based Server has a feature where users can share files, the feature reflects the filename to an emailbody field with no sanitations leading to HTML Injection. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gist.github.com/MMAKINGDOM/39ded58b1e6d2d19366e76e0d5b1c851 - https://github.com/MMAKINGDOM/CVE-2025-63419/
CVE ID: CVE-2025-63420 State: PUBLISHED Published: 2025-11-07T00:00:00.000Z Last Updated: 2025-11-10T21:45:10.932Z Vendors: n/a Products: n/a Problem Types: n/a Description: CrushFTP11 before 11.3.7_57 is vulnerable to stored HTML injection in the CrushFTP Admin Panel (Reports / "Who Created Folder"), enabling persistent HTML execution in admin sessions. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gist.github.com/MMAKINGDOM/791d264c27656f0a4aa3c0ae35075e70 - https://github.com/MMAKINGDOM/CVE-2025-63420/
CVE ID: CVE-2025-63422 State: PUBLISHED Published: 2025-10-30T00:00:00.000Z Last Updated: 2025-10-30T20:58:32.148Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incorrect access control in the Web management interface in Each Italy Wireless Mini Router WIRELESS-N 300M v28K.MiniRouter.20190211 allows attackers to arbitrarily change the administrator username and password via sending a crafted GET request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://imgur.com/a/X9DNOBj - https://github.com/5ulfur/security-advisories/tree/main/CVE-2025-63422
CVE ID: CVE-2025-63423 State: PUBLISHED Published: 2025-10-30T00:00:00.000Z Last Updated: 2025-10-30T20:59:59.390Z Vendors: n/a Products: n/a Problem Types: n/a Description: Each Italy Wireless Mini Router WIRELESS-N 300M v28K.MiniRouter.20190211 was discovered to store the Administrator password. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://imgur.com/a/X9DNOBj - https://github.com/5ulfur/security-advisories/tree/main/CVE-2025-63423
CVE ID: CVE-2025-63432 State: PUBLISHED Published: 2025-11-24T00:00:00.000Z Last Updated: 2025-11-24T18:17:11.303Z Vendors: n/a Products: n/a Problem Types: n/a Description: Xtooltech Xtool AnyScan Android Application 4.40.40 and prior is Missing SSL Certificate Validation. The application fails to properly validate the TLS certificate from its update server. An attacker on the same network can exploit this vulnerability by performing a Man-in-the-Middle (MITM) attack to intercept, decrypt, and modify traffic between the application and the update server. This serves as the basis for further attacks, including Remote Code Execution. Additional Analyst Notes: - CISA ADP Vulnrichment: Referenc
basis for further attacks, including Remote Code Execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.nowsecure.com/blog/2025/07/16/remote-code-execution-discovered-in-xtool-anyscan-app-risks-to-phones-and-vehicles/ - https://github.com/ab3lson/cve-references/tree/master/CVE-2025-63432
CVE ID: CVE-2025-63433 State: PUBLISHED Published: 2025-11-24T00:00:00.000Z Last Updated: 2025-11-24T18:10:06.455Z Vendors: n/a Products: n/a Problem Types: n/a Description: Xtooltech Xtool AnyScan Android Application 4.40.40 and prior uses a hardcoded cryptographic key and IV to decrypt update metadata. The key is stored as a static value within the application's code. An attacker with the ability to intercept network traffic can use this hardcoded key to decrypt, modify, and re-encrypt the update manifest, allowing them to direct the application to download a malicious update package. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.nowsecure.com/blog/2025/07/16
date package. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.nowsecure.com/blog/2025/07/16/remote-code-execution-discovered-in-xtool-anyscan-app-risks-to-phones-and-vehicles/ - https://github.com/ab3lson/cve-references/tree/master/CVE-2025-63433
CVE ID: CVE-2025-63434 State: PUBLISHED Published: 2025-11-24T00:00:00.000Z Last Updated: 2025-11-24T18:08:57.659Z Vendors: n/a Products: n/a Problem Types: n/a Description: The update mechanism in Xtooltech Xtool AnyScan Android Application 4.40.40 and prior is insecure. The application downloads and extracts update packages containing executable code without performing a cryptographic integrity or authenticity check on their contents. An attacker who can control the update metadata can serve a malicious package, which the application will accept, extract, and later execute, leading to arbitrary code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.now
e, leading to arbitrary code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.nowsecure.com/blog/2025/07/16/remote-code-execution-discovered-in-xtool-anyscan-app-risks-to-phones-and-vehicles/ - https://github.com/ab3lson/cve-references/tree/master/CVE-2025-63434
CVE ID: CVE-2025-63435 State: PUBLISHED Published: 2025-11-24T00:00:00.000Z Last Updated: 2025-11-24T18:07:46.420Z Vendors: n/a Products: n/a Problem Types: n/a Description: Xtooltech Xtool AnyScan Android Application 4.40.40 is Missing Authentication for Critical Function. The server-side endpoint responsible for serving update packages for the application does not require any authentication. This allows an unauthenticated remote attacker to freely download official update packages.. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.nowsecure.com/blog/2025/07/16/remote-code-execution-discovered-in-xtool-anyscan-app-risks-to-phones-and-vehicles/ - https://github.co
/blog/2025/07/16/remote-code-execution-discovered-in-xtool-anyscan-app-risks-to-phones-and-vehicles/ - https://github.com/ab3lson/cve-references/tree/master/CVE-2025-63435
CVE ID: CVE-2025-63441 State: PUBLISHED Published: 2025-11-03T00:00:00.000Z Last Updated: 2025-11-03T18:14:49.817Z Vendors: n/a Products: n/a Problem Types: n/a Description: Open Source Social Network (OSSN) 8.6 is vulnerable to Cross Site Scripting (XSS) via the parameter param` at endpoint u/administrator/friends. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/opensource-socialnetwork/opensource-socialnetwork/releases/tag/8.6 - https://www.opensource-socialnetwork.org/discussion/view/7663/open-source-social-network-ossn-86-has-been-released - https://github.com/opensource-socialnetwork/opensource-socialnetwork/issues/2501
CVE ID: CVE-2025-63442 State: PUBLISHED Published: 2025-11-03T00:00:00.000Z Last Updated: 2025-11-03T15:34:39.978Z Vendors: n/a Products: n/a Problem Types: n/a Description: Simple User Management System with PHP-MySQL v1.0 is vulnerable to Cross-Site Scripting (XSS) via the Profile Section. The system fails to properly sanitize user input, allowing attackers to inject and execute arbitrary JavaScript when the input is displayed in the browser Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/sanin-s1r3n/CVE-Research/blob/main/CVE-5
CVE ID: CVE-2025-63443 State: PUBLISHED Published: 2025-11-03T00:00:00.000Z Last Updated: 2025-11-03T15:27:54.185Z Vendors: n/a Products: n/a Problem Types: n/a Description: School Management System PHP v1.0 is vulnerable to Cross Site Scripting (XSS) in /login.php via the password parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/sanin-s1r3n/CVE-Research/blob/main/CVE-6
CVE ID: CVE-2025-63446 State: PUBLISHED Published: 2025-11-03T00:00:00.000Z Last Updated: 2025-11-03T15:41:54.899Z Vendors: n/a Products: n/a Problem Types: n/a Description: Water Management System v1.0 is vulnerable to Cross Site Scripting (XSS) in /add_vendor.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/sanin-s1r3n/CVE-Research/blob/main/CVE-7
CVE ID: CVE-2025-63447 State: PUBLISHED Published: 2025-11-03T00:00:00.000Z Last Updated: 2025-11-03T15:40:14.731Z Vendors: n/a Products: n/a Problem Types: n/a Description: Water Management System v1.0 is vulnerable to Cross Site Scripting (XSS) in /add_customer.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/sanin-s1r3n/CVE-Research/blob/main/CVE-8
CVE ID: CVE-2025-63448 State: PUBLISHED Published: 2025-11-03T00:00:00.000Z Last Updated: 2025-11-03T15:36:31.559Z Vendors: n/a Products: n/a Problem Types: n/a Description: Water Management System v1.0 is vulnerable to Cross Site Scripting (XSS) in /edit_product.php?id=1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/sanin-s1r3n/CVE-Research/blob/main/CVE-9
CVE ID: CVE-2025-63449 State: PUBLISHED Published: 2025-11-03T00:00:00.000Z Last Updated: 2025-11-03T15:46:02.916Z Vendors: n/a Products: n/a Problem Types: n/a Description: Water Management System v1.0 is vulnerable to Cross Site Scripting (XSS) in /orders.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/sanin-s1r3n/CVE-Research/blob/main/CVE-9
CVE ID: CVE-2025-63450 State: PUBLISHED Published: 2025-11-03T00:00:00.000Z Last Updated: 2025-11-03T15:59:08.257Z Vendors: n/a Products: n/a Problem Types: n/a Description: Car-Booking-System-PHP v.1.0 is vulnerable to Cross Site Scripting (XSS) in /carlux/booking.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.linkedin.com/in/shuvo-ahmed-sanin/ - https://github.com/sanin-s1r3n/CVE-Research/blob/main/CVE-11
CVE ID: CVE-2025-63451 State: PUBLISHED Published: 2025-11-03T00:00:00.000Z Last Updated: 2025-11-03T16:21:56.583Z Vendors: n/a Products: n/a Problem Types: n/a Description: Car-Booking-System-PHP v.1.0 is vulnerable to SQL Injection in /carlux/sign-in.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/sanin-s1r3n/CVE-Research/blob/main/CVE-12
CVE ID: CVE-2025-63452 State: PUBLISHED Published: 2025-11-03T00:00:00.000Z Last Updated: 2025-11-03T18:22:36.129Z Vendors: n/a Products: n/a Problem Types: n/a Description: Car-Booking-System-PHP v.1.0 is vulnerable to SQL Injection in /carlux/forgot-pass.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/sanin-s1r3n/CVE-Research/blob/main/CVE-13
CVE ID: CVE-2025-63453 State: PUBLISHED Published: 2025-11-03T00:00:00.000Z Last Updated: 2025-11-04T15:17:10.366Z Vendors: n/a Products: n/a Problem Types: n/a Description: Car-Booking-System-PHP v.1.0 is vulnerable to SQL Injection in /carlux/contact.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/sanin-s1r3n/CVE-Research/blob/main/CVE-14
CVE ID: CVE-2025-63454 State: PUBLISHED Published: 2025-10-31T00:00:00.000Z Last Updated: 2025-11-03T14:53:20.710Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda AX-3 v16.03.12.10_CN was discovered to contain a stack overflow via the deviceId parameter in the get_parentControl_list_Info function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/0-fool/VulnbyCola/blob/main/Tenda/AX-3/2/1.md
CVE ID: CVE-2025-63455 State: PUBLISHED Published: 2025-11-10T00:00:00.000Z Last Updated: 2025-11-10T18:46:57.066Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda AX-3 v16.03.12.10_CN was discovered to contain a stack overflow via the shareSpeed parameter in the fromSetWifiGusetBasic function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/0-fool/VulnbyCola/blob/main/Tenda/AX-3/6/1.md
CVE ID: CVE-2025-63456 State: PUBLISHED Published: 2025-11-10T00:00:00.000Z Last Updated: 2025-11-18T16:27:47.818Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda AX-1803 v1.0.0.1 was discovered to contain a stack overflow via the time parameter in the SetSysTimeCfg function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/0-fool/VulnbyCola/blob/main/Tenda/AX-1803/3/1.md
CVE ID: CVE-2025-63457 State: PUBLISHED Published: 2025-11-10T00:00:00.000Z Last Updated: 2025-11-18T16:33:49.614Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda AX-1803 v1.0.0.1 was discovered to contain a stack overflow via the wanMTU parameter in the sub_4F55C function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/0-fool/VulnbyCola/blob/main/Tenda/AX-1803/1/1.md
CVE ID: CVE-2025-63458 State: PUBLISHED Published: 2025-10-31T00:00:00.000Z Last Updated: 2025-11-03T14:53:13.747Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda AX-1803 v1.0.0.1 was discovered to contain a stack overflow via the timeZone parameter in the form_fast_setting_wifi_set function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/0-fool/VulnbyCola/blob/main/Tenda/AX-1803/2/1.md
CVE ID: CVE-2025-63459 State: PUBLISHED Published: 2025-10-31T00:00:00.000Z Last Updated: 2025-11-03T14:53:27.364Z Vendors: n/a Products: n/a Problem Types: n/a Description: Totolink A7000R v9.1.0u.6115_B20201022 was discovered to contain a stack overflow via the ssid5g parameter in the sub_421CF0 function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/0-fool/VulnbyCola/blob/main/TOTOLINK/A7000/5/1.md
CVE ID: CVE-2025-63460 State: PUBLISHED Published: 2025-10-31T00:00:00.000Z Last Updated: 2025-11-03T14:53:32.996Z Vendors: n/a Products: n/a Problem Types: n/a Description: Totolink A7000R v9.1.0u.6115_B20201022 was discovered to contain a stack overflow via the ssid5g parameter in the sub_4222E0 function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/0-fool/VulnbyCola/blob/main/TOTOLINK/A7000/1/1.md
CVE ID: CVE-2025-63461 State: PUBLISHED Published: 2025-10-31T00:00:00.000Z Last Updated: 2025-11-03T14:53:50.951Z Vendors: n/a Products: n/a Problem Types: n/a Description: Totolink A7000R v9.1.0u.6115_B20201022 was discovered to contain a stack overflow via the ssid5g parameter in the urldecode function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/0-fool/VulnbyCola/blob/main/TOTOLINK/A7000/7/1.md
CVE ID: CVE-2025-63462 State: PUBLISHED Published: 2025-10-31T00:00:00.000Z Last Updated: 2025-11-03T14:53:45.168Z Vendors: n/a Products: n/a Problem Types: n/a Description: Totolink A7000R v9.1.0u.6115_B20201022 was discovered to contain a stack overflow via the wifiOff parameter in the sub_421A04 function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/0-fool/VulnbyCola/blob/main/TOTOLINK/A7000/3/1.md
CVE ID: CVE-2025-63463 State: PUBLISHED Published: 2025-10-31T00:00:00.000Z Last Updated: 2025-11-03T14:53:38.644Z Vendors: n/a Products: n/a Problem Types: n/a Description: Totolink LR350 v9.3.5u.6369_B20220309 was discovered to contain a stack overflow via the wifiOff parameter in the sub_4232EC function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/0-fool/VulnbyCola/blob/main/TOTOLINK/LR350/4/1.md
CVE ID: CVE-2025-63464 State: PUBLISHED Published: 2025-10-31T00:00:00.000Z Last Updated: 2025-10-31T19:29:37.021Z Vendors: n/a Products: n/a Problem Types: n/a Description: Totolink LR350 v9.3.5u.6369_B20220309 was discovered to contain a stack overflow via the ssid parameter in the sub_42396C function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/0-fool/VulnbyCola/blob/main/TOTOLINK/LR350/6/1.md
CVE ID: CVE-2025-63465 State: PUBLISHED Published: 2025-10-31T00:00:00.000Z Last Updated: 2025-10-31T19:28:37.649Z Vendors: n/a Products: n/a Problem Types: n/a Description: Totolink LR350 v9.3.5u.6369_B20220309 was discovered to contain a stack overflow via the ssid parameter in the sub_422880 function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/0-fool/VulnbyCola/blob/main/TOTOLINK/LR350/2/1.md
CVE ID: CVE-2025-63466 State: PUBLISHED Published: 2025-10-31T00:00:00.000Z Last Updated: 2025-11-03T14:53:56.358Z Vendors: n/a Products: n/a Problem Types: n/a Description: Totolink LR350 v9.3.5u.6369_B20220309 was discovered to contain a stack overflow via the password parameter in the sub_426EF8 function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/0-fool/VulnbyCola/blob/main/TOTOLINK/LR350/7/1.md
CVE ID: CVE-2025-63467 State: PUBLISHED Published: 2025-10-31T00:00:00.000Z Last Updated: 2025-11-03T14:54:03.833Z Vendors: n/a Products: n/a Problem Types: n/a Description: Totolink LR350 v9.3.5u.6369_B20220309 was discovered to contain a stack overflow via the ssid parameter in the sub_425400 function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/0-fool/VulnbyCola/blob/main/TOTOLINK/LR350/3/1.md
CVE ID: CVE-2025-63468 State: PUBLISHED Published: 2025-10-31T00:00:00.000Z Last Updated: 2025-10-31T19:31:45.312Z Vendors: n/a Products: n/a Problem Types: n/a Description: Totolink LR350 v9.3.5u.6369_B20220309 was discovered to contain a stack overflow via the http_host parameter in the sub_426EF8 function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/0-fool/VulnbyCola/blob/main/TOTOLINK/LR350/1/1.md
CVE ID: CVE-2025-63469 State: PUBLISHED Published: 2025-10-31T00:00:00.000Z Last Updated: 2025-10-31T19:30:24.977Z Vendors: n/a Products: n/a Problem Types: n/a Description: Totolink LR350 v9.3.5u.6369_B20220309 was discovered to contain a stack overflow via the ssid parameter in the sub_421BAC function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/0-fool/VulnbyCola/blob/main/TOTOLINK/LR350/5/1.md
CVE ID: CVE-2025-63497 State: PUBLISHED Published: 2025-11-10T00:00:00.000Z Last Updated: 2025-11-24T20:27:49.331Z Vendors: n/a Products: n/a Problem Types: n/a Description: The patient prescription viewing functionality in his_doc_view_single_patient.php of rickxy Hospital Management System version 1.0 contains an SQL injection vulnerability. The pat_number GET parameter is directly concatenated into SQL queries without proper sanitization, allowing authenticated attackers (doctor role) to execute arbitrary SQL queries. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/cristibtz/security-research/tree/main/rickxy-Hospital-Management-System - https://github.
ferences: - https://github.com/cristibtz/security-research/tree/main/rickxy-Hospital-Management-System - https://github.com/cristibtz/security-research/blob/main/CVE-2025-63497/report.md
CVE ID: CVE-2025-63498 State: PUBLISHED Published: 2025-11-24T00:00:00.000Z Last Updated: 2025-11-24T21:04:45.496Z Vendors: n/a Products: n/a Problem Types: n/a Description: alinto SOGo 5.12.3 is vulnerable to Cross Site Scripting (XSS) via the "userName" parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Alinto/sogo/commit/9e20190fad1a437f7e1307f0adcfe19a8d45184c - https://github.com/xryptoh/CVE-2025-63498
CVE ID: CVE-2025-63512 State: PUBLISHED Published: 2025-11-18T00:00:00.000Z Last Updated: 2025-11-18T17:11:03.228Z Vendors: n/a Products: n/a Problem Types: n/a Description: kishan0725 Hospital Management System/ v4 is vulnerable to SQL Injection in admin-panel1.php, specifically in the deleting doctor logic. The application fails to properly sanitize or parameterize user-supplied input from the demail parameter before incorporating it directly into a dynamic SQL query. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/NicatAliyevh/Zero-Days/blob/main/Hospital_Management_System_SQL2.md
CVE ID: CVE-2025-63513 State: PUBLISHED Published: 2025-11-18T00:00:00.000Z Last Updated: 2025-11-19T16:50:15.469Z Vendors: n/a Products: n/a Problem Types: n/a Description: kishan0725 Hospital Management System v4 has an Insecure Direct Object Reference (IDOR) vulnerability in the appointment cancellation functionality. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/kishan0725/Hospital-Management-System/issues/55 - https://github.com/NicatAliyevh/Zero-Days/blob/main/Hospital_Management_System_IDOR.md