Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
k is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 12.0.3 is able to address this issue. It is recommended to upgrade the affected component. The vendor explains, that "this vulnerability can be exploited only on not securely installed instances, as it is adviced during product install: attachment directory should be out of web reach, so that even if executable file can be uploaded, it cannot be executed through the web." Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.303128 - https://vuldb.com/?ctiid.303128 - https://vuldb.com/?submit.543250 - https://github.c
: - https://vuldb.com/?id.303128 - https://vuldb.com/?ctiid.303128 - https://vuldb.com/?submit.543250 - https://github.com/deadmilkman/cve-reports/blob/main/01-projeqtor-rce/readme.md - https://github.com/deadmilkman/cve-reports/blob/main/01-projeqtor-rce/readme.md#proof-of-concept-poc
CVE ID: CVE-2025-3170 State: PUBLISHED Published: 2025-04-03T17:31:05.674Z Last Updated: 2025-04-03T19:30:31.786Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: Project Worlds Products: Online Lawyer Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability classified as critical has been found in Project Worlds Online Lawyer Management System 1.0. This affects an unknown part of the file /admin_user.php. The manipulation of the argument block_id/unblock_id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https:
as been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.303129 - https://vuldb.com/?ctiid.303129 - https://vuldb.com/?submit.543271 - https://github.com/p1026/CVE/issues/3 - https://github.com/p1026/CVE/issues/4
CVE ID: CVE-2025-3171 State: PUBLISHED Published: 2025-04-03T18:00:15.060Z Last Updated: 2025-04-03T18:53:39.990Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: Project Worlds Products: Online Lawyer Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability classified as critical was found in Project Worlds Online Lawyer Management System 1.0. This vulnerability affects unknown code of the file /approve_lawyer.php. The manipulation of the argument unblock_id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.c
isclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.303130 - https://vuldb.com/?ctiid.303130 - https://vuldb.com/?submit.543273 - https://github.com/p1026/CVE/issues/5
CVE ID: CVE-2025-3172 State: PUBLISHED Published: 2025-04-03T18:00:16.848Z Last Updated: 2025-04-03T18:13:30.885Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: Project Worlds Products: Online Lawyer Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability, which was classified as critical, has been found in Project Worlds Online Lawyer Management System 1.0. This issue affects some unknown processing of the file /lawyer_booking.php. The manipulation of the argument unblock_id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: Reference
e exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.303131 - https://vuldb.com/?ctiid.303131 - https://vuldb.com/?submit.543274 - https://github.com/p1026/CVE/issues/6
CVE ID: CVE-2025-3173 State: PUBLISHED Published: 2025-04-03T18:31:04.496Z Last Updated: 2025-05-18T06:36:48.344Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: Project Worlds Products: Online Lawyer Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability, which was classified as critical, was found in Project Worlds Online Lawyer Management System 1.0. Affected is an unknown function of the file /save_booking.php. The manipulation of the argument lawyer_id/description leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: Referenc
he exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.303132 - https://vuldb.com/?ctiid.303132 - https://vuldb.com/?submit.543275 - https://github.com/p1026/CVE/issues/7
CVE ID: CVE-2025-3174 State: PUBLISHED Published: 2025-04-03T19:00:15.209Z Last Updated: 2025-04-03T20:36:57.535Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: Project Worlds Products: Online Lawyer Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability has been found in Project Worlds Online Lawyer Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /searchLawyer.php. The manipulation of the argument experience leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: Refe
y. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.303133 - https://vuldb.com/?ctiid.303133 - https://vuldb.com/?submit.543276 - https://github.com/p1026/CVE/issues/8
CVE ID: CVE-2025-3175 State: PUBLISHED Published: 2025-04-03T19:00:17.094Z Last Updated: 2025-04-03T20:03:03.133Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: Project Worlds Products: Online Lawyer Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in Project Worlds Online Lawyer Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /save_user_edit_profile.php. The manipulation of the argument first_Name leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: Refer
. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.303134 - https://vuldb.com/?ctiid.303134 - https://vuldb.com/?submit.543277 - https://github.com/p1026/CVE/issues/9
CVE ID: CVE-2025-3176 State: PUBLISHED Published: 2025-04-03T19:31:04.866Z Last Updated: 2025-04-03T19:56:16.380Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: Project Worlds Products: Online Lawyer Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in Project Worlds Online Lawyer Management System 1.0. It has been classified as critical. This affects an unknown part of the file /single_lawyer.php. The manipulation of the argument u_id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vu
een disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.303135 - https://vuldb.com/?ctiid.303135 - https://vuldb.com/?submit.543278 - https://github.com/p1026/CVE/issues/10
CVE ID: CVE-2025-3177 State: PUBLISHED Published: 2025-04-03T20:00:12.170Z Last Updated: 2025-04-03T20:35:32.064Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: n/a Products: FastCMS Problem Types: CWE-321, CWE-320 Description: A vulnerability was found in FastCMS 0.1.5. It has been declared as critical. This vulnerability affects unknown code of the component JWT Handler. The manipulation leads to use of hard-coded cryptographic key . The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vuln
to be difficult. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.303136 - https://vuldb.com/?ctiid.303136 - https://vuldb.com/?submit.543673 - https://github.com/chujianxin0101/vuln/issues/2
CVE ID: CVE-2025-3178 State: PUBLISHED Published: 2025-04-03T20:31:04.313Z Last Updated: 2025-04-07T18:22:30.842Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: projectworlds Products: Online Doctor Appointment Booking System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in projectworlds Online Doctor Appointment Booking System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /doctor/deleteappointment.php. The manipulation of the argument ID leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment:
otely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.303137 - https://vuldb.com/?ctiid.303137 - https://vuldb.com/?submit.543838 - https://github.com/p1026/CVE/issues/12
CVE ID: CVE-2025-3179 State: PUBLISHED Published: 2025-04-03T21:00:09.677Z Last Updated: 2025-04-07T18:21:04.261Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: projectworlds Products: Online Doctor Appointment Booking System Problem Types: CWE-89, CWE-74 Description: A vulnerability classified as critical has been found in projectworlds Online Doctor Appointment Booking System 1.0. Affected is an unknown function of the file /doctor/deletepatient.php. The manipulation of the argument ic leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References
exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.303138 - https://vuldb.com/?ctiid.303138 - https://vuldb.com/?submit.543839 - https://github.com/p1026/CVE/issues/13
CVE ID: CVE-2025-3180 State: PUBLISHED Published: 2025-04-03T21:00:12.066Z Last Updated: 2025-04-07T18:20:06.077Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: projectworlds Products: Online Doctor Appointment Booking System Problem Types: CWE-89, CWE-74 Description: A vulnerability classified as critical was found in projectworlds Online Doctor Appointment Booking System 1.0. Affected by this vulnerability is an unknown functionality of the file /doctor/deleteschedule.php. The manipulation of the argument ID leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichme
remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.303139 - https://vuldb.com/?ctiid.303139 - https://vuldb.com/?submit.543840 - https://github.com/p1026/CVE/issues/14
CVE ID: CVE-2025-3181 State: PUBLISHED Published: 2025-04-03T21:31:04.936Z Last Updated: 2025-04-07T16:42:56.655Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: projectworlds Products: Online Doctor Appointment Booking System Problem Types: CWE-89, CWE-74 Description: A vulnerability, which was classified as critical, has been found in projectworlds Online Doctor Appointment Booking System 1.0. Affected by this issue is some unknown functionality of the file /patient/appointment.php?scheduleDate=1&appid=1. The manipulation of the argument scheduleDate leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Addit
sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.303140 - https://vuldb.com/?ctiid.303140 - https://vuldb.com/?submit.543841 - https://github.com/p1026/CVE/issues/15
CVE ID: CVE-2025-3182 State: PUBLISHED Published: 2025-04-03T21:31:07.079Z Last Updated: 2025-04-07T16:40:59.348Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: projectworlds Products: Online Doctor Appointment Booking System Problem Types: CWE-89, CWE-74 Description: A vulnerability, which was classified as critical, was found in projectworlds Online Doctor Appointment Booking System 1.0. This affects an unknown part of the file /patient/getschedule.php. The manipulation of the argument q leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: Refere
The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.303141 - https://vuldb.com/?ctiid.303141 - https://vuldb.com/?submit.543842 - https://github.com/p1026/CVE/issues/16
CVE ID: CVE-2025-3183 State: PUBLISHED Published: 2025-04-03T22:00:16.394Z Last Updated: 2025-04-07T16:31:10.866Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: projectworlds Products: Online Doctor Appointment Booking System Problem Types: CWE-89, CWE-74 Description: A vulnerability has been found in projectworlds Online Doctor Appointment Booking System 1.0 and classified as critical. This vulnerability affects unknown code of the file /patient/patientupdateprofile.php. The manipulation of the argument patientFirstName leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected
be initiated remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.303142 - https://vuldb.com/?ctiid.303142 - https://vuldb.com/?submit.543843 - https://github.com/p1026/CVE/issues/17
CVE ID: CVE-2025-3184 State: PUBLISHED Published: 2025-04-03T22:31:04.605Z Last Updated: 2025-04-04T17:36:48.138Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: projectworlds Products: Online Doctor Appointment Booking System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in projectworlds Online Doctor Appointment Booking System 1.0 and classified as critical. This issue affects some unknown processing of the file /patient/profile.php?patientId=1. The manipulation of the argument patientFirstName leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as
initiated remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.303143 - https://vuldb.com/?ctiid.303143 - https://vuldb.com/?submit.543844 - https://github.com/p1026/CVE/issues/18
CVE ID: CVE-2025-3185 State: PUBLISHED Published: 2025-04-03T23:00:12.701Z Last Updated: 2025-04-04T17:33:42.513Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: projectworlds Products: Online Doctor Appointment Booking System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in projectworlds Online Doctor Appointment Booking System 1.0. It has been classified as critical. Affected is an unknown function of the file /patient/patientupdateprofile.php. The manipulation of the argument patientFirstName leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affec
aunch the attack remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.303144 - https://vuldb.com/?ctiid.303144 - https://vuldb.com/?submit.543845 - https://github.com/p1026/CVE/issues/19
CVE ID: CVE-2025-3186 State: PUBLISHED Published: 2025-04-03T23:31:05.402Z Last Updated: 2025-04-04T17:26:17.929Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: projectworlds Products: Online Doctor Appointment Booking System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in projectworlds Online Doctor Appointment Booking System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /patient/invoice.php. The manipulation of the argument appid leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vu
launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.303145 - https://vuldb.com/?ctiid.303145 - https://vuldb.com/?submit.543846 - https://github.com/p1026/CVE/issues/20
CVE ID: CVE-2025-3187 State: PUBLISHED Published: 2025-04-04T00:00:18.428Z Last Updated: 2025-04-04T20:21:35.835Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: PHPGurukul Products: e-Diary Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in PHPGurukul e-Diary Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /login.php. The manipulation of the argument logindetail leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.3
to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.303146 - https://vuldb.com/?ctiid.303146 - https://vuldb.com/?submit.544098 - https://github.com/TiggerT/MyCVE/issues/1 - https://phpgurukul.com/
CVE ID: CVE-2025-3188 State: PUBLISHED Published: 2025-04-04T00:31:05.692Z Last Updated: 2025-04-04T20:21:28.983Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: PHPGurukul Products: e-Diary Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability classified as critical has been found in PHPGurukul e-Diary Management System 1.0. This affects an unknown part of the file /add-notes.php. The manipulation of the argument Category leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.303147 - https:/
and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.303147 - https://vuldb.com/?ctiid.303147 - https://vuldb.com/?submit.544110 - https://github.com/TiggerT/MyCVE/issues/2 - https://phpgurukul.com/
CVE ID: CVE-2025-3189 State: PUBLISHED Published: 2025-04-04T12:44:06.369Z Last Updated: 2025-04-04T14:45:58.908Z Vendors: DoWISP Products: DoWISP Problem Types: CWE-78 Description: Stored Cross-Site Scripting (XSS) in DoWISP in versions prior to 1.16.2.50, which consists of an stored XSS through the upload of a profile picture in SVG format with malicious Javascript code in it. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/stored-cross-site-scripting-xss-dowisp
CVE ID: CVE-2025-3190 State: REJECTED Published: N/A Last Updated: 2025-04-03T14:42:16.739Z Description: No description available.
CVE ID: CVE-2025-3191 State: PUBLISHED Published: 2025-04-04T05:00:11.024Z Last Updated: 2025-04-04T14:09:12.840Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:P) Vendors: n/a Products: react-draft-wysiwyg Problem Types: CWE-79 Description: All versions of the package react-draft-wysiwyg are vulnerable to Cross-site Scripting (XSS) via the Embedded button which will then result in saving the payload in the <iframe> tag. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.snyk.io/vuln/SNYK-JS-REACTDRAFTWYSIWYG-8515884 - https://gist.github.com/th4s1s/175ae4b2632096059b42377dd6c49d47
CVE ID: CVE-2025-3192 State: PUBLISHED Published: 2025-04-04T05:00:11.940Z Last Updated: 2025-06-08T22:07:30.269Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N/E:P) Vendors: n/a Products: spatie/browsershot Problem Types: CWE-918 Description: Versions of the package spatie/browsershot from 0.0.0 are vulnerable to Server-side Request Forgery (SSRF) in the setUrl() function due to a missing restriction on user input, enabling attackers to access localhost and list all of its directories. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.snyk.io/vuln/SNYK-PHP-SPATIEBROWSERSHOT-8548015 - https://gist.github.com/JunMing27/651998a34d57fbf71ff
https://security.snyk.io/vuln/SNYK-PHP-SPATIEBROWSERSHOT-8548015 - https://gist.github.com/JunMing27/651998a34d57fbf71ff9d25386f1da0f
CVE ID: CVE-2025-3193 State: PUBLISHED Published: 2025-09-27T05:00:07.140Z Last Updated: 2025-10-04T23:33:59.390Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: n/a Products: algoliasearch-helper Problem Types: CWE-1321 Description: Versions of the package algoliasearch-helper from 2.0.0-rc1 and before 3.11.2 are vulnerable to Prototype Pollution in the _merge() function in merge.js, which allows constructor.prototype to be written even though doing so throws an error. In the "extreme edge-case" that the resulting error is caught, code injected into the user-supplied search parameter may be exeucted. This is related to but distinct from the issue reported in
ted into the user-supplied search parameter may be exeucted. This is related to but distinct from the issue reported in [CVE-2021-23433](https://security.snyk.io/vuln/SNYK-JS-ALGOLIASEARCHHELPER-1570421). **NOTE:** This vulnerability is not exploitable in the default configuration of InstantSearch since searchParameters are not modifiable by users. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.snyk.io/vuln/SNYK-JS-ALGOLIASEARCHHELPER-3318396 - https://github.com/algolia/algoliasearch-helper-js/issues/922 - https://github.com/algolia/algoliasearch-helper-js/commit/776dff23c87b0902e554e02a8c2567d2580fe12a
CVE ID: CVE-2025-3194 State: PUBLISHED Published: 2025-04-04T05:00:05.529Z Last Updated: 2025-04-04T14:18:10.563Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P) Vendors: n/a Products: bigint-buffer Problem Types: CWE-120 Description: Versions of the package bigint-buffer from 0.0.0 are vulnerable to Buffer Overflow in the toBigIntLE() function. Attackers can exploit this to crash the application. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.snyk.io/vuln/SNYK-JS-BIGINTBUFFER-3364597 - https://github.com/no2chem/bigint-buffer/blob/master/src/index.ts%23L25 - https://www.usenix.org/system/files/sec23fall-prepub-262_staicu.pdf