Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-63514 State: PUBLISHED Published: 2025-11-18T00:00:00.000Z Last Updated: 2025-11-18T20:58:54.814Z Vendors: n/a Products: n/a Problem Types: n/a Description: kishan0725 Hospital Management System has a Cross-Site Scripting (XSS) vulnerability in appsearch.php via the email parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/kishan0725/Hospital-Management-System/issues/54 - https://github.com/NicatAliyevh/Zero-Days/blob/main/Hospital_Management_System_Stored_XSS.md
CVE ID: CVE-2025-63543 State: PUBLISHED Published: 2025-11-07T00:00:00.000Z Last Updated: 2025-11-12T19:59:22.541Z Vendors: n/a Products: n/a Problem Types: n/a Description: TechStore 1.0 is vulnerable to Cross Site Scripting (XSS) in the /search_results endpoint via the q parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gist.github.com/LuigiGrimaldi/5e9e66b12973bddd35f933a6d0cd2730
CVE ID: CVE-2025-63544 State: PUBLISHED Published: 2025-11-07T00:00:00.000Z Last Updated: 2025-11-12T20:00:56.815Z Vendors: n/a Products: n/a Problem Types: n/a Description: TechStore 1.0 is vulnerable to Cross Site Scripting (XSS) in /order_notes via the id parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gist.github.com/LuigiGrimaldi/5e9e66b12973bddd35f933a6d0cd2730
CVE ID: CVE-2025-63551 State: PUBLISHED Published: 2025-11-06T00:00:00.000Z Last Updated: 2025-11-07T15:11:56.765Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Server-Side Request Forgery (SSRF) vulnerability, achievable through an XML External Entity (XXE) injection, exists in MetInfo Content Management System (CMS) thru 8.1. This flaw stems from a defect in the XML parsing logic, which allows an attacker to construct a malicious XML entity that forces the server to initiate an HTTP request to an arbitrary internal or external network address. Successful exploitation could lead to internal network reconnaissance, port scanning, or the retrieval of sensitive information. The
ploitation could lead to internal network reconnaissance, port scanning, or the retrieval of sensitive information. The vulnerability may be present in the backend API called by or associated with the path `/admin/#/webset/?head_tab_active=0`, where user-provided XML data is processed. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/sh4ll0t/SSRF-Vulnerability-in-MetInfo-via-XXE-Injection/blob/main/README.md - https://github.com/sh4ll0t/SSRF-Vulnerability-in-MetInfo-via-XXE-Injection
CVE ID: CVE-2025-63560 State: PUBLISHED Published: 2025-11-06T00:00:00.000Z Last Updated: 2025-11-10T17:04:00.611Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in KiloView Dual Channel 4k HDMI & 3G-SDI HEVC Video Encoder Firmware v.1.20.0006 allows a remote attacker to cause a denial of service via the systemctrl API System/reFactory component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://kiloview.com - https://darrinj99.github.io/writeups/kiloview_e3.html - https://github.com/Darrinj99/Vuln-Writeups-/blob/main/CVE-2025-63560/README.md
CVE ID: CVE-2025-63561 State: PUBLISHED Published: 2025-10-31T00:00:00.000Z Last Updated: 2025-10-31T20:08:45.140Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AC:L/AV:N/A:H/C:N/I:N/PR:N/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: Summer Pearl Group Vacation Rental Management Platform prior to 1.0.2 is susceptible to a Slowloris-style Denial-of-Service (DoS) condition in the HTTP connection handling layer, where an attacker that opens and maintains many slow or partially-completed HTTP connections can exhaust the server’s connection pool and worker capacity, preventing legitimate users and APIs from accessing the service. Additional Analyst Notes: - CISA ADP Vulnrichment: Refer
reventing legitimate users and APIs from accessing the service. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Stolichnayer/Summer-Pearl-Group-Slowloris-DoS
CVE ID: CVE-2025-63562 State: PUBLISHED Published: 2025-10-31T00:00:00.000Z Last Updated: 2025-10-31T19:59:16.652Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AC:L/AV:N/A:L/C:L/I:L/PR:L/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: Summer Pearl Group Vacation Rental Management Platform prior to v1.0.2 suffers from insufficient server-side authorization. Authenticated attackers can call several endpoints and perform create/update/delete actions on resources owned by arbitrary users by manipulating request parameters (e.g., owner or resource id). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Stolichnayer/Summer-Pearl-Group-Broken-Access-Cont
lyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Stolichnayer/Summer-Pearl-Group-Broken-Access-Control
CVE ID: CVE-2025-63563 State: PUBLISHED Published: 2025-10-31T00:00:00.000Z Last Updated: 2025-11-03T20:44:50.827Z Vendors: n/a Products: n/a Problem Types: n/a Description: Summer Pearl Group Vacation Rental Management Platform prior to v1.0.2 does not properly invalidate active user sessions after a password change. This allows an attacker with a valid session token to maintain access to the account even after the legitimate user changes their password. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Stolichnayer/Summer-Pearl-Group-Insufficient-Session-Expiration
CVE ID: CVE-2025-63585 State: PUBLISHED Published: 2025-11-05T00:00:00.000Z Last Updated: 2025-11-06T21:21:50.790Z Vendors: n/a Products: n/a Problem Types: n/a Description: OSSN (Open Source Social Network) 8.6 is vulnerable to SQL Injection in /action/rtcomments/status via the timestamp parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/opensource-socialnetwork/opensource-socialnetwork - https://github.com/opensource-socialnetwork/opensource-socialnetwork/issues/2503
CVE ID: CVE-2025-63588 State: PUBLISHED Published: 2025-11-06T00:00:00.000Z Last Updated: 2025-11-06T19:10:56.777Z Vendors: n/a Products: n/a Problem Types: n/a Description: An unauthenticated reflected cross-site scripting vulnerability in the query handling of CMSimpleXH allows remote attackers to inject and execute arbitrary JavaScript in a victim's browser via a crafted request (e.g., a maliciously crafted POST login). Successful exploitation may lead to theft of session cookies, credential disclosure, or other client-side impacts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helloandrewpaul.medium.com/reflected-xss-in-login-form-email-password-fields-vvveb-cm
ulnrichment: References: - https://helloandrewpaul.medium.com/reflected-xss-in-login-form-email-password-fields-vvveb-cms-v1-0-7-2-18800186804d - https://github.com/cybercrewinc/CVE-2025-63588
CVE ID: CVE-2025-63589 State: PUBLISHED Published: 2025-11-06T00:00:00.000Z Last Updated: 2025-11-06T19:12:48.998Z Vendors: n/a Products: n/a Problem Types: n/a Description: A reflected XSS vulnerability exists in CMSimple_XH 1.8's index.php router when attacker-controlled path segments are not sanitized or encoded before being inserted into the generated HTML (navigation links, breadcrumbs, search form action, footer links). An attacker-controlled string placed in the URL path is reflected into multiple HTML elements, allowing execution of arbitrary JavaScript in victims' browsers visiting a crafted URL. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/cms
browsers visiting a crafted URL. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/cmsimple-xh/cmsimple-xh/blob/master/index.php - https://github.com/cybercrewinc/CVE-2025-63589
CVE ID: CVE-2025-63593 State: PUBLISHED Published: 2025-11-03T00:00:00.000Z Last Updated: 2025-11-06T21:23:51.993Z Vendors: n/a Products: n/a Problem Types: n/a Description: Grav CMS1.7.49.5 is vulnerable to Cross Site Scripting (XSS). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/getgrav/grav/releases/tag/1.7.49.5 - https://github.com/PureStream108/CVE/blob/main/CVE-2025-63593/CVE-2025-63593.md
CVE ID: CVE-2025-63601 State: PUBLISHED Published: 2025-11-05T00:00:00.000Z Last Updated: 2025-11-10T16:40:21.341Z Vendors: n/a Products: n/a Problem Types: n/a Description: Snipe-IT before version 8.3.3 contains a remote code execution vulnerability that allows an authenticated attacker to upload a malicious backup file containing arbitrary files and execute system commands. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/grokability/snipe-it/pull/17966 - https://github.com/grokability/snipe-it/releases/tag/v8.3.3 - https://dappsec.substack.com/p/snipe-it-post-authenticated-remote
CVE ID: CVE-2025-63602 State: PUBLISHED Published: 2025-11-18T00:00:00.000Z Last Updated: 2025-11-18T17:04:06.527Z Vendors: n/a Products: n/a Problem Types: n/a Description: A vulnerability was discovered in Awesome Miner thru 11.2.4 that allows arbitrary read and write to kernel memory and MSRs (such as LSTAR) as an unprivileged user. This is due to the implementation of an insecure version of WinRing0 (1.2.0.5, renamed to IntelliBreeze.Maintenance.Service.sys) that lacks a properly secured DACL, allowing unprivileged users to interact with the driver and, as a result, the kernel. This can result in local privilege escalation, information disclosure, denial of service, and other unspecified
kernel. This can result in local privilege escalation, information disclosure, denial of service, and other unspecified impacts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.awesomeminer.com/download - https://dreadsec.co/p/cve-2025-63602-hijacking-system-calls-with-a-popular-crypto-miner.html
CVE ID: CVE-2025-63603 State: PUBLISHED Published: 2025-11-18T00:00:00.000Z Last Updated: 2025-11-18T17:05:02.151Z Vendors: n/a Products: n/a Problem Types: n/a Description: A command injection vulnerability exists in the MCP Data Science Server's (reading-plus-ai/mcp-server-data-exploration) 0.1.6 in the safe_eval() function (src/mcp_server_ds/server.py:108). The function uses Python's exec() to execute user-supplied scripts but fails to restrict the __builtins__ dictionary in the globals parameter. When __builtins__ is not explicitly defined, Python automatically provides access to all built-in functions including __import__, exec, eval, and open. This allows an attacker to execute arbitra
access to all built-in functions including __import__, exec, eval, and open. This allows an attacker to execute arbitrary Python code with full system privileges, leading to complete system compromise. The vulnerability can be exploited by submitting a malicious script to the run_script tool, requiring no authentication or special privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/reading-plus-ai/mcp-server-data-exploration/issues/12
CVE ID: CVE-2025-63604 State: PUBLISHED Published: 2025-11-18T00:00:00.000Z Last Updated: 2025-11-18T17:06:05.260Z Vendors: n/a Products: n/a Problem Types: n/a Description: A code injection vulnerability exists in baryhuang/mcp-server-aws-resources-python 0.1.0 that allows remote code execution through insufficient input validation in the execute_query method. The vulnerability stems from the exposure of dangerous Python built-in functions (__import__, getattr, hasattr) in the execution namespace and the direct use of exec() to execute user-supplied code. An attacker can craft malicious queries to execute arbitrary Python code, leading to AWS credential theft (AWS_ACCESS_KEY_ID, AWS_SECRET_
raft malicious queries to execute arbitrary Python code, leading to AWS credential theft (AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY), file system access, environment variable disclosure, and potential system compromise. The vulnerability allows attackers to bypass intended security controls and gain unauthorized access to sensitive AWS resources and credentials stored in the server's environment. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/baryhuang/mcp-server-aws-resources-python/issues/8
CVE ID: CVE-2025-63608 State: PUBLISHED Published: 2025-10-30T00:00:00.000Z Last Updated: 2025-11-24T20:29:13.478Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL injection vulnerability exists in CSZ-CMS <=1.3.0 in the Form Builder view functionality. The vulnerability is located in the field parameter of the form viewing feature, allowing authenticated administrators to execute arbitrary SQL queries. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Huu1j/CSZ_CMS-exploit/blob/main/csz-cms-vulnerability-analysis.md
CVE ID: CVE-2025-63617 State: PUBLISHED Published: 2025-11-10T00:00:00.000Z Last Updated: 2025-11-12T20:31:58.917Z Vendors: n/a Products: n/a Problem Types: n/a Description: ktg-mes before commit a484f96 (2025-07-03) has a fastjson deserialization vulnerability. This is because it uses a vulnerable version of fastjson and deserializes unsafe input data. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ChangeYourWay/post/blob/main/ktg-mes.md - https://gist.github.com/ChangeYourWay/8651679a2155269bccf520fcb34fc661
CVE ID: CVE-2025-63622 State: PUBLISHED Published: 2025-10-29T00:00:00.000Z Last Updated: 2025-10-30T14:31:13.651Z Vendors: n/a Products: n/a Problem Types: n/a Description: A vulnerability was found in code-projects Online Complaint Site 1.0. This issue affects some unknown processing of the file /cms/admin/subcategory.php. This manipulation of the argument category causes SQL injection. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/xmqaq/cve/issues/2
CVE ID: CVE-2025-63638 State: PUBLISHED Published: 2025-11-07T00:00:00.000Z Last Updated: 2025-11-12T19:53:48.931Z Vendors: n/a Products: n/a Problem Types: n/a Description: Sourcecodester AI-Powered To-Do List App v1.0 is vulnerable to Cross-Site Scripting (XSS) in the "Task Title" and "Description (Optional)" fields when creating a Task, allowing an attacker to inject arbitrary potentially malicious HTML/JavaScript code that executes in the victim's browser upon clicking the "Add Task" button. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.sourcecodester.com/javascript/18421/ai-powered-do-list-app-using-html-css-and-javascript-source-code.html - https://github
urcecodester.com/javascript/18421/ai-powered-do-list-app-using-html-css-and-javascript-source-code.html - https://github.com/ChuckBartowski7/Vulnerability-Research/tree/main/CVE-2025-63638
CVE ID: CVE-2025-63639 State: PUBLISHED Published: 2025-11-07T00:00:00.000Z Last Updated: 2025-11-12T19:54:49.563Z Vendors: n/a Products: n/a Problem Types: n/a Description: The chat feature in the application Sourcecodester FAQ Bot with AI Assistant v1.0 is vulnerable to Cross-Site Scripting (XSS) due to improper handling of user-supplied input. An attacker can inject malicious HTML or JavaScript into chat messages, which executes in the browser of any user viewing the conversation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.sourcecodester.com/javascript/18413/faq-bot-ai-assistant-using-html-css-and-javascript-source-code.html - https://github.com/ChuckBart
.com/javascript/18413/faq-bot-ai-assistant-using-html-css-and-javascript-source-code.html - https://github.com/ChuckBartowski7/Vulnerability-Research/blob/main/CVE-2025-63639/README.md
CVE ID: CVE-2025-63640 State: PUBLISHED Published: 2025-11-07T00:00:00.000Z Last Updated: 2025-11-12T19:57:27.995Z Vendors: n/a Products: n/a Problem Types: n/a Description: Sourcecodester Medicine Reminder App v1.0 is vulnerable to Cross-Site Scripting (XSS) in the "Medicine Name" and "Notes (Optional)" fields when creating an "Upcoming Reminder", allowing an attacker to inject arbitrary potentially malicious HTML/JavaScript code that executes in the victim's browser upon clicking the "Save Reminder" button. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.sourcecodester.com/javascript/18402/medicine-reminder-app-using-html-css-and-javascript-source-code.html - h
https://www.sourcecodester.com/javascript/18402/medicine-reminder-app-using-html-css-and-javascript-source-code.html - https://github.com/ChuckBartowski7/Vulnerability-Research/blob/main/CVE-2025-63640/README.md
CVE ID: CVE-2025-63645 State: PUBLISHED Published: 2025-11-12T00:00:00.000Z Last Updated: 2025-11-13T15:48:25.326Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored cross-site scripting (XSS) vulnerability exists in pH7Software pH7-Social-Dating-CMS 17.9.1 in the application's message system. Unsanitized message content submitted by one user is persisted by the server and later rendered in another user's Inbox view without appropriate context-aware encoding. As a result, attacker-controlled content executes in the recipient's browser context when the Inbox message is viewed. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://drive.google.com/drive/fold
message is viewed. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://drive.google.com/drive/folders/1u2o2NWHzClSjsNzhtkk1QvaDGisAXs2v - https://medium.com/@rudranshsinghrajpurohit/cve-2025-63645-stored-cross-site-scripting-xss-vulnerability-in-ph7-social-dating-cms-8073ac4be5be
CVE ID: CVE-2025-63666 State: PUBLISHED Published: 2025-11-12T00:00:00.000Z Last Updated: 2025-11-18T14:33:15.572Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda AC15 v15.03.05.18_multi) issues an authentication cookie that exposes the account password hash to the client and uses a short, low-entropy suffix as the session identifier. An attacker with network access or the ability to run JS in a victim browser can steal the cookie and replay it to access protected resources. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Remenis/CVE-2025-63666
CVE ID: CVE-2025-63667 State: PUBLISHED Published: 2025-11-12T00:00:00.000Z Last Updated: 2025-11-12T20:22:06.549Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incorrect access control in SIMICAM v1.16.41-20250725, KEVIEW v1.14.92-20241120, ASECAM v1.14.10-20240725 allows attackers to access sensitive API endpoints without authentication. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Remenis/Vatilon_evidence/releases/download/Evidence/Vatilon_vulnerability_evidence_2025.zip - https://github.com/Remenis/CVE-2025-63667
CVE ID: CVE-2025-63674 State: PUBLISHED Published: 2025-11-24T00:00:00.000Z Last Updated: 2025-11-24T21:39:34.687Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Blurams Lumi Security Camera (A31C) v23.1227.472.2926 allows local physical attackers to execute arbitrary code via overriding the bootloader on the SD card. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://blurams.com - http://a31c.com - https://vindivlabs.com/research/lumi_part_2/
CVE ID: CVE-2025-63675 State: PUBLISHED Published: 2025-10-31T00:00:00.000Z Last Updated: 2025-10-31T16:44:37.610Z Severity: MEDIUM (CVSS 6.9 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L) Vendors: cryptidy Products: cryptidy Problem Types: CWE-502 Description: cryptidy through 1.2.4 allows code execution via untrusted data because pickle.loads is used. This occurs in aes_decrypt_message in symmetric_encryption.py. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/javiermorales36/cryptidy-analysis - https://github.com/netinvent/cryptidy/blob/cebc9ffd54cc20679d15a1a43ca9a5da645b0c58/cryptidy/symmetric_encryption.py#L220-L238
CVE ID: CVE-2025-63678 State: PUBLISHED Published: 2025-11-10T00:00:00.000Z Last Updated: 2025-11-12T20:25:12.631Z Vendors: n/a Products: n/a Problem Types: n/a Description: An authenticated arbitrary file upload vulnerability in the /uploads/ endpoint of CMS Made Simple Foundation File Manager v2.2.22 allows attackers with Administrator privileges to execute arbitrary code via uploading a crafted PHP file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/kasiasok/raports/blob/main/CMSMS%202.2.22%20_%20Raport%20092025.pdf
CVE ID: CVE-2025-63679 State: PUBLISHED Published: 2025-11-12T00:00:00.000Z Last Updated: 2025-11-13T16:14:02.637Z Vendors: n/a Products: n/a Problem Types: n/a Description: free5gc v4.1.0 and before is vulnerable to Buffer Overflow. When AMF receives an UplinkRANConfigurationTransfer NGAP message from a gNB, the AMF process crashes. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/free5gc/free5gc/issues/725 - https://gist.github.com/DDGod2025/5483d94b028d7a0c111ca23844e8a94d
CVE ID: CVE-2025-63680 State: PUBLISHED Published: 2025-11-14T00:00:00.000Z Last Updated: 2025-11-14T19:21:27.874Z Vendors: n/a Products: n/a Problem Types: n/a Description: Nero BackItUp in the Nero Productline is vulnerable to a path parsing/UI rendering flaw (CWE-22) that, in combination with Windows ShellExecuteW fallback extension resolution, leads to arbitrary code execution when a user clicks a crafted entry. By creating a trailing-dot folder and placing a same-basename script, Nero BackItUp renders the file as a folder icon and then invokes ShellExecuteW, which executes the script via PATHEXT fallback (.COM/.EXE/.BAT/.CMD). The issue affects recent Nero BackItUp product lines (2019-2
utes the script via PATHEXT fallback (.COM/.EXE/.BAT/.CMD). The issue affects recent Nero BackItUp product lines (2019-2025 and earlier) and has been acknowledged by the vendor. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/PotatoHamm/Nero-Productline-Vulnerability
CVE ID: CVE-2025-63685 State: PUBLISHED Published: 2025-11-20T00:00:00.000Z Last Updated: 2025-11-21T14:32:54.749Z Vendors: n/a Products: n/a Problem Types: n/a Description: Quark Cloud Drive v3.23.2 has a DLL Hijacking vulnerability. This vulnerability stems from the insecure loading of system libraries. Specifically, the application does not validate the path or signature of [regsvr32.exe] it loads. An attacker can place a crafted malicious DLL in the application's startup directory, which will be loaded and executed when the user launches the program. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/QIU-DIE/CVE/issues/5
CVE ID: CVE-2025-63686 State: PUBLISHED Published: 2025-11-07T00:00:00.000Z Last Updated: 2025-11-12T17:02:24.609Z Vendors: n/a Products: n/a Problem Types: n/a Description: There is an arbitrary file download vulnerability in GuoMinJim PersonManage thru commit 5a02b1ab208feacf3a34fc123c9381162afbaa95 (2020-11-23) in the document query function under the Download Center menu in the PersonManage system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/GuoMinJim/PersonManage/issues/10 - https://gist.github.com/LockeTom/95b2a47f2dcb27e62690754993a4c7cd
CVE ID: CVE-2025-63687 State: PUBLISHED Published: 2025-11-07T00:00:00.000Z Last Updated: 2025-11-12T17:02:09.707Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in rymcu forest thru commit f782e85 (2025-09-04) in function doBefore in file src/main/java/com/rymcu/forest/core/service/security/AuthorshipAspect.java, allowing authorized attackers to delete arbitrary users posts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/rymcu/forest/issues/193 - https://gist.github.com/LockeTom/564d5be6b75bb64d120daed96d74ec9c