Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-25962 State: PUBLISHED Published: 2025-04-29T00:00:00.000Z Last Updated: 2025-05-06T15:33:18.206Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Coresmartcontracts Uniswap v.3.0 and fixed in v.4.0 allows a remote attacker to escalate privileges via the _modifyPosition function Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/CVEProject/docs/blob/gh-pages/requester/reservation-guidelines.md - https://medium.com/@cnetsec/access-control-vulnerability-in-uniswap-v3-cve-2025-25962-f7cf21536978
CVE ID: CVE-2025-25967 State: PUBLISHED Published: 2025-03-03T00:00:00.000Z Last Updated: 2025-03-04T16:49:06.467Z Vendors: n/a Products: n/a Problem Types: n/a Description: Acora CMS version 10.1.1 is vulnerable to Cross-Site Request Forgery (CSRF). This flaw enables attackers to trick authenticated users into performing unauthorized actions, such as account deletion or user creation, by embedding malicious requests in external content. The lack of CSRF protections allows exploitation via crafted requests. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/padayali-JD/CVE-2025-25967
CVE ID: CVE-2025-25968 State: PUBLISHED Published: 2025-02-20T00:00:00.000Z Last Updated: 2025-02-20T19:43:14.160Z Vendors: n/a Products: n/a Problem Types: n/a Description: DDSN Interactive cm3 Acora CMS version 10.1.1 contains an improper access control vulnerability. An editor-privileged user can access sensitive information, such as system administrator credentials, by force browsing the endpoint and exploiting the 'file' parameter. By referencing specific files (e.g., cm3.xml), attackers can bypass access controls, leading to account takeover and potential privilege escalation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://ddsn.com - https://github.com/padayali
calation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://ddsn.com - https://github.com/padayali-JD/CVE-2025-25968
CVE ID: CVE-2025-25973 State: PUBLISHED Published: 2025-02-20T00:00:00.000Z Last Updated: 2025-02-20T19:44:42.373Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored Cross Site Scripting vulnerability in the "related recommendations" feature in Ppress v.0.0.9 allows a remote attacker to execute arbitrary code via a crafted script to the article.title, article.category, and article.tags parameters. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/yandaozi/PPress/issues/3 - https://gist.github.com/coleak2021/512acaa12ba0987499d560967acff1d1
CVE ID: CVE-2025-25975 State: PUBLISHED Published: 2025-03-12T00:00:00.000Z Last Updated: 2025-03-19T18:51:42.398Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in parse-git-config v.3.0.0 allows an attacker to obtain sensitive information via the expandKeys function Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/jonschlinkert/parse-git-config/issues/14
CVE ID: CVE-2025-25977 State: PUBLISHED Published: 2025-03-10T00:00:00.000Z Last Updated: 2025-03-12T18:20:57.363Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in canvg v.4.0.2 allows an attacker to execute arbitrary code via the Constructor of the class StyleElement. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/canvg/canvg/issues/1749
CVE ID: CVE-2025-25983 State: PUBLISHED Published: 2025-04-18T00:00:00.000Z Last Updated: 2025-04-18T20:37:54.776Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Macro-video Technologies Co.,Ltd V380 Pro android application 2.1.44 and V380 Pro android application 2.1.64 allows an attacker to obtain sensitive information via the QE code based sharing component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/vladko312/Research_v380_IP_camera - https://github.com/vladko312/Research_v380_IP_camera/blob/main/CVE-2025-25983.md
CVE ID: CVE-2025-25984 State: PUBLISHED Published: 2025-04-18T00:00:00.000Z Last Updated: 2025-04-18T20:31:36.279Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Macro-video Technologies Co.,Ltd V380E6_C1 IP camera (Hw_HsAKPIQp_WF_XHR) 1020302 allows a physically proximate attacker to execute arbitrary code via UART component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/vladko312/Research_v380_IP_camera - https://github.com/vladko312/Research_v380_IP_camera/blob/main/CVE-2025-25984.md
CVE ID: CVE-2025-25985 State: PUBLISHED Published: 2025-04-18T00:00:00.000Z Last Updated: 2025-04-18T20:26:40.767Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Macro-video Technologies Co.,Ltd V380E6_C1 IP camera (Hw_HsAKPIQp_WF_XHR) 1020302 allows a physically proximate attacker to execute arbitrary code via the /mnt/mtd/mvconf/wifi.ini and /mnt/mtd/mvconf/user_info.ini components. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/vladko312/Research_v380_IP_camera - https://github.com/vladko312/Research_v380_IP_camera/blob/main/CVE-2025-25985.md
CVE ID: CVE-2025-25988 State: PUBLISHED Published: 2025-02-14T00:00:00.000Z Last Updated: 2025-02-14T18:30:54.732Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting vulnerability in hooskcms v.1.8 allows a remote attacker to cause a denial of service via the custom Link title parameter and the Title parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/havok89/Hoosk/issues/67
CVE ID: CVE-2025-25990 State: PUBLISHED Published: 2025-02-14T00:00:00.000Z Last Updated: 2025-02-18T14:11:22.168Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting vulnerability in hooskcms v.1.7.1 allows a remote attacker to obtain sensitive information via the /install/index.php component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/havok89/Hoosk/issues/69
CVE ID: CVE-2025-25991 State: PUBLISHED Published: 2025-02-14T00:00:00.000Z Last Updated: 2025-02-14T19:16:22.307Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection vulnerability in hooskcms v.1.7.1 allows a remote attacker to obtain sensitive information via the /install/index.php component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/havok89/Hoosk/issues/68
CVE ID: CVE-2025-25992 State: PUBLISHED Published: 2025-02-14T00:00:00.000Z Last Updated: 2025-02-14T18:56:41.420Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection vulnerability in FeMiner wms 1.0 allows a remote attacker to obtain sensitive information via the inquire_inout_item.php component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/FeMiner/wms/issues/19
CVE ID: CVE-2025-25993 State: PUBLISHED Published: 2025-02-14T00:00:00.000Z Last Updated: 2025-02-14T18:51:56.806Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection vulnerability in FeMiner wms wms 1.0 allows a remote attacker to obtain sensitive information via the parameter "itemid." Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/FeMiner/wms/issues/21
CVE ID: CVE-2025-25994 State: PUBLISHED Published: 2025-02-14T00:00:00.000Z Last Updated: 2025-02-18T14:12:01.338Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection vulnerability in FeMiner wms wms 1.0 allows a remote attacker to obtain sensitive information via the parameters date1, date2, id. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/FeMiner/wms/issues/20
CVE ID: CVE-2025-25997 State: PUBLISHED Published: 2025-02-14T00:00:00.000Z Last Updated: 2025-02-18T14:15:43.301Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory Traversal vulnerability in FeMiner wms v.1.0 allows a remote attacker to obtain sensitive information via the databak.php component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/FeMiner/wms/issues/22
CVE ID: CVE-2025-26001 State: PUBLISHED Published: 2025-03-26T00:00:00.000Z Last Updated: 2025-03-27T14:06:52.277Z Vendors: n/a Products: n/a Problem Types: n/a Description: Telesquare TLR-2005KSH 1.1.4 is vulnerable to Information Disclosure via the parameter getUserNamePassword. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Fan-24/Digging/blob/main/1/1.md - https://github.com/Fan-24/Digging/tree/main/1
CVE ID: CVE-2025-26002 State: PUBLISHED Published: 2025-03-26T00:00:00.000Z Last Updated: 2025-03-27T14:04:53.559Z Vendors: n/a Products: n/a Problem Types: n/a Description: Telesquare TLR-2005KSH 1.1.4 is affected by an unauthorized stack overflow vulnerability when requesting the admin.cgi parameter with setSyncTimeHost. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Fan-24/Digging/blob/main/3/1.md - https://github.com/Fan-24/Digging/tree/main/2
CVE ID: CVE-2025-26003 State: PUBLISHED Published: 2025-03-26T00:00:00.000Z Last Updated: 2025-03-27T14:03:23.435Z Vendors: n/a Products: n/a Problem Types: n/a Description: Telesquare TLR-2005KSH 1.1.4 is affected by an unauthorized command execution vulnerability when requesting the admin.cgi parameter with setAutorest. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Fan-24/Digging/blob/main/5/1.md
CVE ID: CVE-2025-26004 State: PUBLISHED Published: 2025-03-26T00:00:00.000Z Last Updated: 2025-03-27T14:01:59.474Z Vendors: n/a Products: n/a Problem Types: n/a Description: Telesquare TLR-2005KSH 1.1.4 is vulnerable to unauthorized stack buffer overflow vulnerability when requesting admin.cgi parameter with setDdns. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Fan-24/Digging/blob/main/6/1.md
CVE ID: CVE-2025-26005 State: PUBLISHED Published: 2025-03-26T00:00:00.000Z Last Updated: 2025-03-27T13:59:06.728Z Vendors: n/a Products: n/a Problem Types: n/a Description: Telesquare TLR-2005KSH 1.1.4 is vulnerable to unauthorized stack overflow vulnerability when requesting admin.cgi parameter with setNtp. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Fan-24/Digging/blob/main/7/1.md
CVE ID: CVE-2025-26006 State: PUBLISHED Published: 2025-03-26T00:00:00.000Z Last Updated: 2025-03-27T13:50:20.621Z Vendors: n/a Products: n/a Problem Types: n/a Description: Telesquare TLR-2005KSH 1.1.4 has an unauthorized stack overflow vulnerability when requesting the admin.cgi parameter with setAutorest. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Fan-24/Digging/blob/main/4/1.md
CVE ID: CVE-2025-26007 State: PUBLISHED Published: 2025-03-26T00:00:00.000Z Last Updated: 2025-03-27T13:53:04.368Z Vendors: n/a Products: n/a Problem Types: n/a Description: Telesquare TLR-2005KSH 1.1.4 has an unauthorized stack overflow vulnerability in the login interface when requesting systemtil.cgi. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Fan-24/Digging/blob/main/10/1.md
CVE ID: CVE-2025-26008 State: PUBLISHED Published: 2025-03-26T00:00:00.000Z Last Updated: 2025-03-27T13:40:50.599Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Telesquare TLR-2005KSH 1.1.4, an unauthorized stack overflow vulnerability exists when requesting admin.cgi parameter with setSyncTimeHost. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Fan-24/Digging/blob/main/2/1.md
CVE ID: CVE-2025-26009 State: PUBLISHED Published: 2025-03-26T00:00:00.000Z Last Updated: 2025-03-27T13:46:45.664Z Vendors: n/a Products: n/a Problem Types: n/a Description: Telesquare TLR-2005KSH 1.1.4 has an Information Disclosure vulnerability when requesting systemutilit.cgi. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Fan-24/Digging/blob/main/11/1.md
CVE ID: CVE-2025-26010 State: PUBLISHED Published: 2025-03-26T00:00:00.000Z Last Updated: 2025-03-27T13:45:03.262Z Vendors: n/a Products: n/a Problem Types: n/a Description: Telesquare TLR-2005KSH 1.1.4 allows unauthorized password modification when requesting the admin.cgi parameter with setUserNamePassword. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Fan-24/Digging/blob/main/9/1.md
CVE ID: CVE-2025-26011 State: PUBLISHED Published: 2025-03-26T00:00:00.000Z Last Updated: 2025-03-27T13:42:39.858Z Vendors: n/a Products: n/a Problem Types: n/a Description: Telesquare TLR-2005KSH 1.1.4 has an unauthorized stack overflow vulnerability when requesting the admin.cgi parameter with setUsernamePassword. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Fan-24/Digging/blob/main/8/1.md
CVE ID: CVE-2025-26013 State: PUBLISHED Published: 2025-02-21T00:00:00.000Z Last Updated: 2025-02-21T20:43:21.623Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Loggrove v.1.0 allows a remote attacker to obtain sensitive information via the read.py component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitee.com/olajowon/loggrove/issues/IBJSXS
CVE ID: CVE-2025-26014 State: PUBLISHED Published: 2025-02-21T00:00:00.000Z Last Updated: 2025-04-17T15:19:48.773Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Remote Code Execution (RCE) vulnerability in Loggrove v.1.0 allows a remote attacker to execute arbitrary code via the path parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitee.com/olajowon/loggrove/issues/IBJT1K - https://github.com/olajowon/loggrove/ - https://gitee.com/olajowon/loggrove/
CVE ID: CVE-2025-26042 State: PUBLISHED Published: 2025-03-17T00:00:00.000Z Last Updated: 2025-03-19T18:29:27.796Z Vendors: n/a Products: n/a Problem Types: n/a Description: Uptime Kuma >== 1.23.0 has a ReDoS vulnerability, specifically when an administrator creates a notification through the web service. If a string is provided it triggers catastrophic backtracking in the regular expression, leading to a ReDoS attack. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/louislam/uptime-kuma/issues/5574 - https://github.com/louislam/uptime-kuma/pull/5573
CVE ID: CVE-2025-26047 State: PUBLISHED Published: 2025-02-28T00:00:00.000Z Last Updated: 2025-03-06T20:44:28.522Z Vendors: n/a Products: n/a Problem Types: n/a Description: Loggrove v1.0 is vulnerable to SQL Injection in the read.py file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitee.com/olajowon/loggrove/issues/IBJXG8
CVE ID: CVE-2025-26054 State: PUBLISHED Published: 2025-04-01T00:00:00.000Z Last Updated: 2025-04-02T14:12:53.432Z Vendors: n/a Products: n/a Problem Types: n/a Description: Infinxt iEdge 100 2.1.32 is vulnerable to Cross Site Scripting (XSS) via the "Description" field during LAN configuration. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/rohan-pt/CVE-2025-26054
CVE ID: CVE-2025-26055 State: PUBLISHED Published: 2025-04-01T00:00:00.000Z Last Updated: 2025-04-14T17:36:55.479Z Vendors: n/a Products: n/a Problem Types: n/a Description: An OS Command Injection vulnerability exists in the Infinxt iEdge 100 2.1.32 Troubleshoot module, specifically in the tracertVal parameter of the Tracert function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/rohan-pt/CVE-2025-26055
CVE ID: CVE-2025-26056 State: PUBLISHED Published: 2025-04-01T00:00:00.000Z Last Updated: 2025-04-14T17:41:23.657Z Vendors: n/a Products: n/a Problem Types: n/a Description: A command injection vulnerability exists in the Infinxt iEdge 100 2.1.32 in the Troubleshoot module "MTR" functionality. The vulnerability is due to improper validation of user-supplied input in the mtrIp parameter. An attacker can exploit this flaw to execute arbitrary operating system commands on the underlying system with the same privileges as the web application process. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/rohan-pt/CVE-2025-26056
CVE ID: CVE-2025-26058 State: PUBLISHED Published: 2025-02-18T00:00:00.000Z Last Updated: 2025-02-19T20:32:11.827Z Vendors: n/a Products: n/a Problem Types: n/a Description: Webkul QloApps v1.6.1 exposes authentication tokens in URLs during redirection. When users access the admin panel or other protected areas, the application appends sensitive authentication tokens directly to the URL. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/mano257200/QloApps-VUL
CVE ID: CVE-2025-26062 State: PUBLISHED Published: 2025-07-31T00:00:00.000Z Last Updated: 2025-11-03T19:45:12.355Z Vendors: n/a Products: n/a Problem Types: n/a Description: An access control issue in Intelbras RX1500 v2.2.9 and RX3000 v1.0.11 allows unauthenticated attackers to access the router's settings file and obtain potentially sensitive information from the current settings. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://manuais.intelbras.com.br/manual-linha-rx/ChangeLogRX1500.html - https://manuais.intelbras.com.br/manual-linha-rx/ChangeLogRX3000.html - https://seclists.org/fulldisclosure/2025/Jul/14
CVE ID: CVE-2025-26063 State: PUBLISHED Published: 2025-07-31T00:00:00.000Z Last Updated: 2025-11-03T19:45:15.195Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Intelbras RX1500 v2.2.9 and RX3000 v1.0.11 allows unauthenticated attackers to execute arbitrary code via injecting a crafted payload into the ESSID name when creating a network. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://manuais.intelbras.com.br/manual-linha-rx/ChangeLogRX1500.html - https://manuais.intelbras.com.br/manual-linha-rx/ChangeLogRX3000.html - https://seclists.org/fulldisclosure/2025/Jul/14
CVE ID: CVE-2025-26064 State: PUBLISHED Published: 2025-07-31T00:00:00.000Z Last Updated: 2025-11-03T19:45:18.531Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) vulnerability in Intelbras RX1500 v2.2.9 and RX3000 v1.0.11 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the name of a connnected device. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://manuais.intelbras.com.br/manual-linha-rx/ChangeLogRX1500.html - https://manuais.intelbras.com.br/manual-linha-rx/ChangeLogRX3000.html - https://seclists.org/fulldisclosure/2025/Jul/14
CVE ID: CVE-2025-26065 State: PUBLISHED Published: 2025-08-04T00:00:00.000Z Last Updated: 2025-11-03T19:45:20.059Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) vulnerability in Intelbras RX1500 v2.2.9 and RX3000 v1.0.11 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the name of a visiting Wi-Fi network. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://manuais.intelbras.com.br/manual-linha-rx/ChangeLogRX1500.html - https://manuais.intelbras.com.br/manual-linha-rx/ChangeLogRX3000.html - https://seclists.org/fulldisclosure/2025/Jul/26
CVE ID: CVE-2025-26074 State: PUBLISHED Published: 2025-06-30T00:00:00.000Z Last Updated: 2025-06-30T18:44:46.795Z Vendors: n/a Products: n/a Problem Types: n/a Description: Orkes Conductor v3.21.11 allows remote attackers to execute arbitrary OS commands through unrestricted access to Java classes. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/conductor-oss/conductor - https://github.com/conductor-oss/conductor/blob/main/core/src/main/java/com/netflix/conductor/core/events/ScriptEvaluator.java - https://medium.com/@mrcnry/cve-2025-26074-remote-code-execution-in-conductor-oss-via-inline-javascript-injection-5ce3cb651cfb
CVE ID: CVE-2025-26086 State: PUBLISHED Published: 2025-05-20T00:00:00.000Z Last Updated: 2025-05-20T15:32:56.530Z Vendors: n/a Products: n/a Problem Types: n/a Description: An unauthenticated blind SQL injection vulnerability exists in RSI Queue Management System v3.0 within the TaskID parameter of the get request handler. Attackers can remotely inject time-delayed SQL payloads to induce server response delays, enabling time-based inference and iterative extraction of sensitive database contents without authentication. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://seclists.org/fulldisclosure/2025/May/21
CVE ID: CVE-2025-26091 State: PUBLISHED Published: 2025-03-04T00:00:00.000Z Last Updated: 2025-04-09T18:27:25.046Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Cross Site Scripting (XSS) vulnerability exists in TeamPasswordManager v12.162.284 and before that could allow a remote attacker to execute arbitrary JavaScript in the web browser of a user, by including a malicious payload into the 'name' parameter when creating a new password in the "My Passwords" page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://brunocaseiro.github.io/CVE-2025-26091/
CVE ID: CVE-2025-26125 State: PUBLISHED Published: 2025-03-17T00:00:00.000Z Last Updated: 2025-03-24T13:01:22.560Z Vendors: n/a Products: n/a Problem Types: n/a Description: An exposed ioctl in the IMFForceDelete driver of IObit Malware Fighter v12.1.0 allows attackers to arbitrarily delete files and escalate privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ZeroMemoryEx/IObit-EoP - https://x.com/zeromemoryex/status/1876878269200449819 - https://github.com/ZeroMemoryEx/CVE-2025-26125
CVE ID: CVE-2025-26127 State: PUBLISHED Published: 2025-03-17T00:00:00.000Z Last Updated: 2025-03-17T18:05:31.819Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored cross-site scripting (XSS) vulnerability in the Send for Approval function of FileCloud v23.241.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.filecloud.com/supportdocs/fcdoc/latest/server/release-notes/filecloud-version-23-241-release-notes/minor-filecloud-release-23-241-3 - https://github.com/pentesttoolscom/vulnerability-research/tree/master/CVE-2025-26127
CVE ID: CVE-2025-26136 State: PUBLISHED Published: 2025-03-04T00:00:00.000Z Last Updated: 2025-03-05T16:56:15.776Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL injection vulnerability exists in mysiteforme versions prior to 2025.01.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gist.github.com/xiadmin6/6d664692d31a04eb59096a488b9f3712
CVE ID: CVE-2025-26137 State: PUBLISHED Published: 2025-03-18T00:00:00.000Z Last Updated: 2025-03-25T17:12:25.641Z Vendors: n/a Products: n/a Problem Types: n/a Description: Systemic Risk Value <=2.8.0 is vulnerable to Local File Inclusion via /GetFile.aspx?ReportUrl=. An unauthenticated attacker can exploit this issue to read arbitrary system files by supplying a crafted file path, potentially exposing sensitive information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Arakiba/CVEs/tree/main/CVE-2025-26137
CVE ID: CVE-2025-26138 State: PUBLISHED Published: 2025-03-18T00:00:00.000Z Last Updated: 2025-03-25T16:51:28.189Z Vendors: n/a Products: n/a Problem Types: n/a Description: Systemic Risk Value <=2.8.0 is vulnerable to improper access control in /RiskValue/GroupingEntities/Controls/GetFile.aspx?ID=. Uploaded files are accessible via a predictable numerical ID parameter, allowing unauthorized users to increment or decrement the ID to access and download files they do not have permission to view. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Arakiba/CVEs/tree/main/CVE-2025-26138