Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-1936 State: PUBLISHED Published: 2025-03-04T13:31:26.282Z Last Updated: 2025-11-03T20:57:22.527Z Vendors: Mozilla Products: Firefox, Firefox ESR, Thunderbird Problem Types: Adding %00 and a fake extension to a jar: URL changed the interpretation of the contents Description: jar: URLs retrieve local file content packaged in a ZIP archive. The null and everything after it was ignored when retrieving the content from the archive, but the fake extension after the null was used to determine the type of content. This could have been used to hide code in a web extension disguised as something else like an image. This vulnerability affects Firefox < 136, Firefox ESR < 128.8, Thunder
ension disguised as something else like an image. This vulnerability affects Firefox < 136, Firefox ESR < 128.8, Thunderbird < 136, and Thunderbird < 128.8. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1940027 - https://www.mozilla.org/security/advisories/mfsa2025-14/ - https://www.mozilla.org/security/advisories/mfsa2025-16/ - https://www.mozilla.org/security/advisories/mfsa2025-17/ - https://www.mozilla.org/security/advisories/mfsa2025-18/
CVE ID: CVE-2025-1937 State: PUBLISHED Published: 2025-03-04T13:31:26.780Z Last Updated: 2025-11-03T20:57:23.954Z Vendors: Mozilla Products: Firefox, Firefox ESR, Thunderbird Problem Types: Memory safety bugs fixed in Firefox 136, Thunderbird 136, Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8 Description: Memory safety bugs present in Firefox 135, Thunderbird 135, Firefox ESR 115.20, Firefox ESR 128.7, and Thunderbird 128.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 136, Firefox ESR < 115.21, Firefox ESR < 128.8, Thunderbird <
o run arbitrary code. This vulnerability affects Firefox < 136, Firefox ESR < 115.21, Firefox ESR < 128.8, Thunderbird < 136, and Thunderbird < 128.8. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://bugzilla.mozilla.org/buglist.cgi?bug_id=1938471%2C1940716 - https://www.mozilla.org/security/advisories/mfsa2025-14/ - https://www.mozilla.org/security/advisories/mfsa2025-15/ - https://www.mozilla.org/security/advisories/mfsa2025-16/ - https://www.mozilla.org/security/advisories/mfsa2025-17/ - https://www.mozilla.org/security/advisories/mfsa2025-18/
CVE ID: CVE-2025-1938 State: PUBLISHED Published: 2025-03-04T13:31:27.167Z Last Updated: 2025-11-03T20:57:25.349Z Vendors: Mozilla Products: Firefox, Firefox ESR, Thunderbird Problem Types: Memory safety bugs fixed in Firefox 136, Thunderbird 136, Firefox ESR 128.8, and Thunderbird 128.8 Description: Memory safety bugs present in Firefox 135, Thunderbird 135, Firefox ESR 128.7, and Thunderbird 128.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 136, Firefox ESR < 128.8, Thunderbird < 136, and Thunderbird < 128.8. Additional Analyst Notes: - CIS
affects Firefox < 136, Firefox ESR < 128.8, Thunderbird < 136, and Thunderbird < 128.8. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://bugzilla.mozilla.org/buglist.cgi?bug_id=1922889%2C1935004%2C1943586%2C1943912%2C1948111 - https://www.mozilla.org/security/advisories/mfsa2025-14/ - https://www.mozilla.org/security/advisories/mfsa2025-16/ - https://www.mozilla.org/security/advisories/mfsa2025-17/ - https://www.mozilla.org/security/advisories/mfsa2025-18/
CVE ID: CVE-2025-1939 State: PUBLISHED Published: 2025-03-04T13:31:22.881Z Last Updated: 2025-09-07T23:09:55.634Z Vendors: Mozilla Products: Firefox Problem Types: Tapjacking in Android Custom Tabs using transition animations Description: Android apps can load web pages using the Custom Tabs feature. This feature supports a transition animation that could have been used to trick a user into granting sensitive permissions by hiding what the user was actually clicking. This vulnerability affects Firefox < 136. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1928334 - https://www.mozilla.org/security/advisori
ontainer: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1928334 - https://www.mozilla.org/security/advisories/mfsa2025-14/
CVE ID: CVE-2025-1940 State: PUBLISHED Published: 2025-03-04T13:31:24.265Z Last Updated: 2025-03-04T15:57:34.877Z Vendors: Mozilla Products: Firefox Problem Types: Android Intent confirmation prompt tapjacking using Select options Description: A select option could partially obscure the confirmation prompt shown before launching external apps. This could be used to trick a user in to launching an external app unexpectedly. *This issue only affects Android versions of Firefox.* This vulnerability affects Firefox < 136. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1908488 - https://www.mozilla.org/security/advisories/mfsa2025-14/
CVE ID: CVE-2025-1941 State: PUBLISHED Published: 2025-03-04T13:31:25.097Z Last Updated: 2025-03-04T15:49:09.046Z Vendors: Mozilla Products: Firefox Problem Types: Lock screen setting bypass in Firefox Focus for Android Description: Under certain circumstances, a user opt-in setting that Focus should require authentication before use could have been be bypassed (distinct from CVE-2025-0245). This vulnerability affects Firefox < 136. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1944665 - https://www.mozilla.org/security/advisories/mfsa2025-14/
CVE ID: CVE-2025-1942 State: PUBLISHED Published: 2025-03-04T13:31:25.504Z Last Updated: 2025-03-25T14:10:00.285Z Vendors: Mozilla Products: Firefox, Thunderbird Problem Types: Disclosure of uninitialized memory when .toUpperCase() causes string to get longer Description: When String.toUpperCase() caused a string to get longer it was possible for uninitialized memory to be incorporated into the result string This vulnerability affects Firefox < 136 and Thunderbird < 136. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1947139 - https://www.mozilla.org/security/advisories/mfsa2025-14/ - https://www.mozilla.org/security/advisories/m
gi?id=1947139 - https://www.mozilla.org/security/advisories/mfsa2025-14/ - https://www.mozilla.org/security/advisories/mfsa2025-17/
CVE ID: CVE-2025-1943 State: PUBLISHED Published: 2025-03-04T13:31:27.514Z Last Updated: 2025-03-06T04:55:08.354Z Vendors: Mozilla Products: Firefox, Thunderbird Problem Types: Memory safety bugs fixed in Firefox 136 and Thunderbird 136 Description: Memory safety bugs present in Firefox 135 and Thunderbird 135. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 136 and Thunderbird < 136. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bugzilla.mozilla.org/buglist.cgi?bug_id=1869650%2C1938451%2C1940326%2C1944052%2C1944063%2C19
ment: References: - https://bugzilla.mozilla.org/buglist.cgi?bug_id=1869650%2C1938451%2C1940326%2C1944052%2C1944063%2C1947281 - https://www.mozilla.org/security/advisories/mfsa2025-14/ - https://www.mozilla.org/security/advisories/mfsa2025-17/
CVE ID: CVE-2025-1944 State: PUBLISHED Published: 2025-03-10T11:30:32.896Z Last Updated: 2025-03-10T12:09:36.612Z Vendors: mmaitre314 Products: picklescan Problem Types: CWE-345 Description: picklescan before 0.0.23 is vulnerable to a ZIP archive manipulation attack that causes it to crash when attempting to extract and scan PyTorch model archives. By modifying the filename in the ZIP header while keeping the original filename in the directory listing, an attacker can make PickleScan raise a BadZipFile error. However, PyTorch's more forgiving ZIP implementation still allows the model to be loaded, enabling malicious payloads to bypass detection. Additional Analyst Notes: - CISA ADP Vulnrichm
the model to be loaded, enabling malicious payloads to bypass detection. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://sites.google.com/sonatype.com/vulnerabilities/cve-2025-1944 - https://github.com/mmaitre314/picklescan/security/advisories/GHSA-7q5r-7gvp-wc82 - https://github.com/mmaitre314/picklescan/commit/e58e45e0d9e091159c1554f9b04828bbb40b9781
CVE ID: CVE-2025-1945 State: PUBLISHED Published: 2025-03-10T11:43:02.158Z Last Updated: 2025-03-10T12:05:04.004Z Vendors: mmaitre314 Products: picklescan Problem Types: CWE-345 Description: picklescan before 0.0.23 fails to detect malicious pickle files inside PyTorch model archives when certain ZIP file flag bits are modified. By flipping specific bits in the ZIP file headers, an attacker can embed malicious pickle files that remain undetected by PickleScan while still being successfully loaded by PyTorch's torch.load(). This can lead to arbitrary code execution when loading a compromised model. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://sites.google.com/sonat
ing a compromised model. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://sites.google.com/sonatype.com/vulnerabilities/cve-2025-1945 - https://github.com/mmaitre314/picklescan/security/advisories/GHSA-w8jq-xcqf-f792 - https://github.com/mmaitre314/picklescan/commit/e58e45e0d9e091159c1554f9b04828bbb40b9781
CVE ID: CVE-2025-1946 State: PUBLISHED Published: 2025-03-04T18:31:04.478Z Last Updated: 2025-03-04T18:50:32.210Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: hzmanyun Products: Education and Training System Problem Types: CWE-77, CWE-74 Description: A vulnerability was found in hzmanyun Education and Training System 2.1. It has been rated as critical. Affected by this issue is the function exportPDF of the file /user/exportPDF. The manipulation of the argument id leads to command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.2
to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.298520 - https://vuldb.com/?ctiid.298520 - https://vuldb.com/?submit.506657 - https://github.com/heiheixz/report/blob/main/nxb_1.md
CVE ID: CVE-2025-1947 State: PUBLISHED Published: 2025-03-04T18:31:06.067Z Last Updated: 2025-03-04T18:47:26.009Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: hzmanyun Products: Education and Training System Problem Types: CWE-77, CWE-74 Description: A vulnerability classified as critical has been found in hzmanyun Education and Training System 2.1.3. This affects the function scorm of the file UploadImageController.java. The manipulation of the argument param leads to command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.co
sclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.298521 - https://vuldb.com/?ctiid.298521 - https://vuldb.com/?submit.506659 - https://github.com/heiheixz/report/blob/main/nxb_2.md
CVE ID: CVE-2025-1948 State: PUBLISHED Published: 2025-05-08T17:48:40.831Z Last Updated: 2025-05-08T18:31:44.196Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Eclipse Foundation Products: Jetty Problem Types: CWE-400 Description: In Eclipse Jetty versions 12.0.0 to 12.0.16 included, an HTTP/2 client can specify a very large value for the HTTP/2 settings parameter SETTINGS_MAX_HEADER_LIST_SIZE. The Jetty HTTP/2 server does not perform validation on this setting, and tries to allocate a ByteBuffer of the specified capacity to encode HTTP responses, likely resulting in OutOfMemoryError being thrown, or even the JVM process exiting. Additional Analyst Notes: -
ponses, likely resulting in OutOfMemoryError being thrown, or even the JVM process exiting. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitlab.eclipse.org/security/cve-assignement/-/issues/56 - https://github.com/jetty/jetty.project/security/advisories/GHSA-889j-63jv-qhr8
CVE ID: CVE-2025-1949 State: PUBLISHED Published: 2025-03-04T19:00:07.588Z Last Updated: 2025-03-04T19:37:04.767Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N) Vendors: n/a Products: ZZCMS Problem Types: CWE-79, CWE-94 Description: A vulnerability, which was classified as problematic, has been found in ZZCMS 2025. This issue affects some unknown processing of the file /3/ucenter_api/code/register_nodb.php of the component URL Handler. The manipulation of the argument $_SERVER['PHP_SELF'] leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https:/
s been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.298541 - https://vuldb.com/?ctiid.298541 - https://vuldb.com/?submit.508909 - https://github.com/Sinon2003/cve/blob/main/zzcms/xss-register_nodb.php.md
CVE ID: CVE-2025-1950 State: PUBLISHED Published: 2025-04-22T14:46:51.735Z Last Updated: 2025-09-01T00:40:10.640Z Severity: CRITICAL (CVSS 9.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: IBM Products: Hardware Management Console - Power Systems Problem Types: CWE-114 Description: IBM Hardware Management Console - Power Systems V10.2.1030.0 and V10.3.1050.0 could allow a local user to execute commands locally due to improper validation of libraries of an untrusted source. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7231507
CVE ID: CVE-2025-1951 State: PUBLISHED Published: 2025-04-22T14:48:08.892Z Last Updated: 2025-09-01T00:39:33.682Z Severity: HIGH (CVSS 8.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: IBM Products: Hardware Management Console - Power Systems Problem Types: CWE-250 Description: IBM Hardware Management Console - Power Systems V10.2.1030.0 and V10.3.1050.0 could allow a local user to execute commands as a privileged user due to execution of commands with unnecessary privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7231389
CVE ID: CVE-2025-1952 State: PUBLISHED Published: 2025-03-04T19:00:11.828Z Last Updated: 2025-03-04T19:35:02.602Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: PHPGurukul Products: Restaurant Table Booking System Problem Types: CWE-89, CWE-74 Description: A vulnerability, which was classified as critical, was found in PHPGurukul Restaurant Table Booking System 1.0. Affected is an unknown function of the file /admin/password-recovery.php. The manipulation of the argument username/mobileno leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: Reference
e exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.298542 - https://vuldb.com/?ctiid.298542 - https://vuldb.com/?submit.509955 - https://github.com/zrlianc/CVE/issues/1 - https://phpgurukul.com/
CVE ID: CVE-2025-1953 State: PUBLISHED Published: 2025-03-04T20:00:09.859Z Last Updated: 2025-03-04T20:36:16.264Z Severity: LOW (CVSS 2.6 CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: vLLM Products: AIBrix Problem Types: CWE-330, CWE-310 Description: A vulnerability has been found in vLLM AIBrix 0.2.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file pkg/plugins/gateway/prefixcacheindexer/hash.go of the component Prefix Caching. The manipulation leads to insufficiently random values. The complexity of an attack is rather high. The exploitation appears to be difficult. Upgrading to version 0.3.0 is able to address this issue. It is
rather high. The exploitation appears to be difficult. Upgrading to version 0.3.0 is able to address this issue. It is recommended to upgrade the affected component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.298543 - https://vuldb.com/?ctiid.298543 - https://vuldb.com/?submit.509958 - https://github.com/vllm-project/aibrix/issues/749 - https://github.com/vllm-project/aibrix/pull/752 - https://github.com/vllm-project/aibrix/pull/752/commits/3d25d95aebd66f24a549200edcebc5ea423b317a - https://github.com/vllm-project/aibrix/issues/749#event-16488517974
CVE ID: CVE-2025-1954 State: PUBLISHED Published: 2025-03-04T21:00:14.191Z Last Updated: 2025-03-04T21:41:43.377Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: PHPGurukul Products: Human Metapneumovirus Testing Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in PHPGurukul Human Metapneumovirus Testing Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /login.php. The manipulation of the argument username leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP V
launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.298555 - https://vuldb.com/?ctiid.298555 - https://vuldb.com/?submit.510360 - https://github.com/sorcha-l/cve/blob/main/Human%20Metapneumovirus%20(HMPV)%20%E2%80%93%20Testing%20Management%20System%20%20SQL%20Injection%20Vulnerability.md - https://phpgurukul.com/
CVE ID: CVE-2025-1955 State: PUBLISHED Published: 2025-03-04T21:00:16.408Z Last Updated: 2025-03-04T21:39:21.441Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: code-projects Products: Online Class and Exam Scheduling System Problem Types: CWE-79, CWE-94 Description: A vulnerability was found in code-projects Online Class and Exam Scheduling System 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /Scheduling/scheduling/pages/profile.php. The manipulation of the argument username leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst
. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.298556 - https://vuldb.com/?ctiid.298556 - https://vuldb.com/?submit.510689 - https://hexotion.notion.site/Online-Class-and-Exam-Scheduling-System-in-PHP-has-Stored-Cross-Site-Scripting-vulnerability-in-prof-1a7bb766cf32809b9f0be980e90d83f7?pvs=73 - https://code-projects.org/
CVE ID: CVE-2025-1956 State: PUBLISHED Published: 2025-03-04T21:31:05.612Z Last Updated: 2025-03-05T16:38:21.020Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: code-projects Products: Shopping Portal Problem Types: CWE-89, CWE-74 Description: A vulnerability classified as critical has been found in code-projects Shopping Portal 1.0. This affects an unknown part of the file /Shopping/Admin/index.php of the component Login. The manipulation of the argument password leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/
losed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.298557 - https://vuldb.com/?ctiid.298557 - https://vuldb.com/?submit.510696 - https://hexotion.notion.site/Shopping-Portal-in-PHP-has-Stored-SQL-injection-vulnerability-in-admin-index-php-1a7bb766cf3280e8bb81eaa59c4c2b74 - https://code-projects.org/
CVE ID: CVE-2025-1957 State: PUBLISHED Published: 2025-03-04T22:00:07.619Z Last Updated: 2025-03-05T16:36:39.958Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: code-projects Products: Blood Bank System Problem Types: CWE-79, CWE-94 Description: A vulnerability classified as problematic was found in code-projects Blood Bank System 1.0. This vulnerability affects unknown code of the file /BBfile/Blood/o+.php. The manipulation of the argument Bloodname leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.298558 - https:
and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.298558 - https://vuldb.com/?ctiid.298558 - https://vuldb.com/?submit.510705 - https://github.com/Corgile/cve/blob/main/cve.md - https://code-projects.org/
CVE ID: CVE-2025-1958 State: PUBLISHED Published: 2025-03-04T22:00:09.531Z Last Updated: 2025-03-05T16:18:42.780Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: aaluoxiang Products: oa_system Problem Types: CWE-89, CWE-74 Description: A vulnerability, which was classified as critical, has been found in aaluoxiang oa_system 1.0. This issue affects some unknown processing of the file src/main/resources/mappers/address-mapper.xml. The manipulation of the argument outtype leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.29
to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.298559 - https://vuldb.com/?ctiid.298559 - https://vuldb.com/?submit.510750 - https://github.com/qkdjksfkeg/cve_article/blob/main/oasys/SQL%20injection.md
CVE ID: CVE-2025-1959 State: PUBLISHED Published: 2025-03-04T22:31:04.431Z Last Updated: 2025-04-02T20:49:26.630Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: Codezips Products: Gym Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability, which was classified as critical, was found in Codezips Gym Management System 1.0. Affected is an unknown function of the file /change_s_pwd.php. The manipulation of the argument login_id/login_key leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.298560
e public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.298560 - https://vuldb.com/?ctiid.298560 - https://vuldb.com/?submit.510782 - https://github.com/CContinueee/CVE/blob/main/CVE_1.md
CVE ID: CVE-2025-1960 State: PUBLISHED Published: 2025-03-12T15:33:59.173Z Last Updated: 2025-03-13T18:32:42.467Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Schneider Electric Products: WebHMI – Deployed with EcoStruxure Power Automation System Problem Types: CWE-1188 Description: CWE-1188: Initialization of a Resource with an Insecure Default vulnerability exists that could cause an attacker to execute unauthorized commands when a system’s default password credentials have not been changed on first use. The default username is not displayed correctly in the WebHMI interface. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://dow
isplayed correctly in the WebHMI interface. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2025-070-03&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2025-070-03.pdf