Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-25827 State: PUBLISHED Published: 2025-02-26T00:00:00.000Z Last Updated: 2025-03-06T20:33:30.292Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Server-Side Request Forgery (SSRF) in the component sort.php of Emlog Pro v2.5.4 allows attackers to scan local and internal ports via supplying a crafted URL. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.emlog.net/ - http://emlogpro.com - https://github.com/Ka7arotto/emlog/blob/main/ssrf.md
CVE ID: CVE-2025-25871 State: PUBLISHED Published: 2025-03-14T00:00:00.000Z Last Updated: 2025-03-19T18:38:07.552Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Open Panel v.0.3.4 allows a remote attacker to escalate privileges via the Fix Permissions function Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://openpanel.com/docs/changelog/0.3.5/#%EF%B8%8F-security-fixes - https://packetstorm.news/files/id/189621
CVE ID: CVE-2025-25872 State: PUBLISHED Published: 2025-03-14T00:00:00.000Z Last Updated: 2025-03-19T18:39:05.247Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Open Panel v.0.3.4 allows a remote attacker to escalate privileges via the Fix Permissions function Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://openpanel.com/docs/changelog/0.3.5/#%EF%B8%8F-security-fixes - https://packetstorm.news/files/id/189583
CVE ID: CVE-2025-25873 State: PUBLISHED Published: 2025-03-14T00:00:00.000Z Last Updated: 2025-03-19T18:38:41.758Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Request Forgery vulnerability in Open Panel OpenAdmin v.0.3.4 allows a remote attacker to escalate privileges via the Change Root Password function Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://openpanel.com/docs/ - https://packetstorm.news/files/id/189597
CVE ID: CVE-2025-25875 State: PUBLISHED Published: 2025-02-21T00:00:00.000Z Last Updated: 2025-03-17T18:39:45.555Z Vendors: n/a Products: n/a Problem Types: n/a Description: A vulnerability was found in ITSourcecode Simple ChatBox up to 1.0. This vulnerability affects unknown code of the file /message.php. The attack can use SQL injection to obtain sensitive data. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/SticKManII/cve-poc/blob/main/chat-box/4/poc.md
CVE ID: CVE-2025-25876 State: PUBLISHED Published: 2025-02-21T00:00:00.000Z Last Updated: 2025-02-24T16:56:28.158Z Vendors: n/a Products: n/a Problem Types: n/a Description: A vulnerability was found in ITSourcecode Simple ChatBox up to 1.0. This vulnerability affects unknown code of the file /delete.php. The attack can use SQL injection to obtain sensitive data. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/SticKManII/cve-poc/blob/main/chat-box/2/poc.md
CVE ID: CVE-2025-25877 State: PUBLISHED Published: 2025-02-21T00:00:00.000Z Last Updated: 2025-02-21T21:12:34.247Z Vendors: n/a Products: n/a Problem Types: n/a Description: A vulnerability was found in ITSourcecode Simple ChatBox up to 1.0. This vulnerability affects unknown code of the file /admin.php. The attack can use SQL injection to obtain sensitive data. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/SticKManII/cve-poc/blob/main/chat-box/1/poc.md
CVE ID: CVE-2025-25878 State: PUBLISHED Published: 2025-02-21T00:00:00.000Z Last Updated: 2025-02-21T21:11:22.224Z Vendors: n/a Products: n/a Problem Types: n/a Description: A vulnerability was found in ITSourcecode Simple ChatBox up to 1.0. This vulnerability affects unknown code of the file /del.php. The attack can use SQL injection to obtain sensitive data. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/SticKManII/cve-poc/blob/main/chat-box/3/poc.md
CVE ID: CVE-2025-25891 State: PUBLISHED Published: 2025-02-18T00:00:00.000Z Last Updated: 2025-02-19T16:01:29.548Z Vendors: n/a Products: n/a Problem Types: n/a Description: A buffer overflow vulnerability was discovered in D-Link DSL-3782 v1.01, triggered by the destination, netmask and gateway parameters. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted packet. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/2664521593/mycve/blob/main/BOF_in_D-Link_DSL-3782_4.pdf
CVE ID: CVE-2025-25892 State: PUBLISHED Published: 2025-02-18T00:00:00.000Z Last Updated: 2025-02-19T15:59:20.825Z Vendors: n/a Products: n/a Problem Types: n/a Description: A buffer overflow vulnerability was discovered in D-Link DSL-3782 v1.01 via the sstartip, sendip, dstartip, and dendip parameters. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted packet. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/2664521593/mycve/blob/main/BOF_in_D-Link%20DSL-3782_3.pdf
CVE ID: CVE-2025-25893 State: PUBLISHED Published: 2025-02-18T00:00:00.000Z Last Updated: 2025-02-19T15:58:17.832Z Vendors: n/a Products: n/a Problem Types: n/a Description: An OS command injection vulnerability was discovered in D-Link DSL-3782 v1.01 via the inIP, insPort, inePort, exsPort, exePort, and protocol parameters. This vulnerability allows attackers to execute arbitrary operating system (OS) commands via a crafted packet. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/2664521593/mycve/blob/main/CJ_in_D-Link_DSL-3782_2_en.pdf
CVE ID: CVE-2025-25894 State: PUBLISHED Published: 2025-02-18T00:00:00.000Z Last Updated: 2025-02-19T15:40:02.210Z Vendors: n/a Products: n/a Problem Types: n/a Description: An OS command injection vulnerability was discovered in D-Link DSL-3782 v1.01 via the samba_wg and samba_nbn parameters. This vulnerability allows attackers to execute arbitrary operating system (OS) commands via a crafted packet. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/2664521593/mycve/blob/main/CJ_in_D-Link_DSL-3782_1_en.pdf
CVE ID: CVE-2025-25895 State: PUBLISHED Published: 2025-02-18T00:00:00.000Z Last Updated: 2025-02-19T15:24:59.129Z Vendors: n/a Products: n/a Problem Types: n/a Description: An OS command injection vulnerability was discovered in D-Link DSL-3782 v1.01 via the public_type parameter. This vulnerability allows attackers to execute arbitrary operating system (OS) commands via a crafted packet. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/2664521593/mycve/blob/main/CJ_in_D-Link_DSL-3782_3_en.pdf
CVE ID: CVE-2025-25896 State: PUBLISHED Published: 2025-02-18T00:00:00.000Z Last Updated: 2025-02-19T15:21:53.608Z Vendors: n/a Products: n/a Problem Types: n/a Description: A buffer overflow vulnerability was discovered in D-Link DSL-3782 v1.01 via the destination, netmask, and gateway parameters. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted packet. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/2664521593/mycve/blob/main/BOF_in_D-Link_DSL-3782_5.pdf
CVE ID: CVE-2025-25897 State: PUBLISHED Published: 2025-02-13T00:00:00.000Z Last Updated: 2025-03-18T16:05:12.397Z Vendors: n/a Products: n/a Problem Types: n/a Description: A buffer overflow vulnerability was discovered in TP-Link TL-WR841ND V11 via the 'ip' parameter at /userRpm/WanStaticIpV6CfgRpm.htm. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted packet. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/2664521593/mycve/blob/main/TP-Link/BOF_in_TP-Link_TL-WR841ND-V11_3.pdf
CVE ID: CVE-2025-25898 State: PUBLISHED Published: 2025-02-13T00:00:00.000Z Last Updated: 2025-03-18T13:58:54.111Z Vendors: n/a Products: n/a Problem Types: n/a Description: A buffer overflow vulnerability was discovered in TP-Link TL-WR841ND V11 via the pskSecret parameter at /userRpm/WlanSecurityRpm.htm. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted packet. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/2664521593/mycve/blob/main/TP-Link/BOF_in_TP-Link_TL-WR841ND-V11_1.pdf
CVE ID: CVE-2025-25899 State: PUBLISHED Published: 2025-02-13T00:00:00.000Z Last Updated: 2025-02-13T20:02:32.823Z Vendors: n/a Products: n/a Problem Types: n/a Description: A buffer overflow vulnerability was discovered in TP-Link TL-WR841ND V11 via the 'gw' parameter at /userRpm/WanDynamicIpV6CfgRpm.htm. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted packet. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/2664521593/mycve/blob/main/TP-Link/BOF_in_TP-Link_TL-WR841ND-V11_2.pdf
CVE ID: CVE-2025-25900 State: PUBLISHED Published: 2025-02-13T00:00:00.000Z Last Updated: 2025-03-13T13:42:36.021Z Vendors: n/a Products: n/a Problem Types: n/a Description: A buffer overflow vulnerability was discovered in TP-Link TL-WR841ND V11 via the username and password parameters at /userRpm/PPPoEv6CfgRpm.htm. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted packet. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/2664521593/mycve/blob/main/TP-Link/BOF_in_TP-Link_TL-WR841ND-V11_4.pdf
CVE ID: CVE-2025-25901 State: PUBLISHED Published: 2025-02-13T00:00:00.000Z Last Updated: 2025-02-20T14:44:22.610Z Vendors: n/a Products: n/a Problem Types: n/a Description: A buffer overflow vulnerability was discovered in TP-Link TL-WR841ND V11, triggered by the dnsserver1 and dnsserver2 parameters at /userRpm/WanSlaacCfgRpm.htm. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted packet. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/2664521593/mycve/blob/main/TP-Link/BOF_in_TP-Link_TL-WR841ND-V11_5.pdf
CVE ID: CVE-2025-25905 State: PUBLISHED Published: 2025-06-25T00:00:00.000Z Last Updated: 2025-06-25T15:41:26.312Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-Site Scripting (XSS) vulnerability in CADClick v1.13.0 and before allows remote attackers to inject arbitrary web script or HTML via the "tree" parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.cadclick.com - https://4pace.com/en/products/cadclick - https://medium.com/@mdjab3r/cve-2025-25905-ffff82c635f2
CVE ID: CVE-2025-25907 State: PUBLISHED Published: 2025-03-10T00:00:00.000Z Last Updated: 2025-03-11T02:50:39.490Z Vendors: n/a Products: n/a Problem Types: n/a Description: tianti v2.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /user/ajax/save. This vulnerability allows attackers to execute arbitrary operations via a crafted GET or POST request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/xujeff/tianti/issues/39
CVE ID: CVE-2025-25908 State: PUBLISHED Published: 2025-03-10T00:00:00.000Z Last Updated: 2025-03-11T02:48:57.131Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored cross-site scripting (XSS) vulnerability in tianti v2.3 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the coverImageURL parameter at /article/ajax/save. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/xujeff/tianti/issues/40
CVE ID: CVE-2025-25914 State: PUBLISHED Published: 2025-03-17T00:00:00.000Z Last Updated: 2025-03-18T15:39:21.710Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in Online Exam Mastering System v.1.0 allows a remote attacker to execute arbitrary code via the fid parameter Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/872323857/CVE/blob/main/online-exam-mastering-system_sqlinject.md
CVE ID: CVE-2025-25916 State: PUBLISHED Published: 2025-02-28T00:00:00.000Z Last Updated: 2025-02-28T15:59:39.952Z Vendors: n/a Products: n/a Problem Types: n/a Description: wuzhicms v4.1.0 has a Cross Site Scripting (XSS) vulnerability in del function in \coreframe\app\member\admin\group.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/wuzhicms/wuzhicms/issues/213 - https://gist.github.com/A7cc/e28b5790d8b40df8d418d1bd15c25d12
CVE ID: CVE-2025-25925 State: PUBLISHED Published: 2025-03-11T00:00:00.000Z Last Updated: 2025-03-12T15:23:46.471Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored cross-scripting (XSS) vulnerability in Openmrs v2.4.3 Build 0ff0ed allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the personName.middleName parameter at /openmrs/admin/patients/shortPatientForm.form. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://openmrs.com - https://github.com/johnchd/CVEs/blob/main/OpenMRS/CVE-2025-25925%20-%20P-XSS.md
CVE ID: CVE-2025-25927 State: PUBLISHED Published: 2025-03-11T00:00:00.000Z Last Updated: 2025-03-12T15:22:45.214Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Cross-Site Request Forgery (CSRF) in Openmrs 2.4.3 Build 0ff0ed allows attackers to execute arbitrary operations via a crafted GET request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/johnchd/CVEs/blob/main/OpenMRS/CVE-2025-25927%20-%20CSRF%20via%20GET.md
CVE ID: CVE-2025-25928 State: PUBLISHED Published: 2025-03-11T00:00:00.000Z Last Updated: 2025-03-17T18:55:54.103Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Cross-Site Request Forgery (CSRF) in the component /admin/users/user.form of Openmrs 2.4.3 Build 0ff0ed allows attackers to execute arbitrary operations via a crafted request. In this case, an attacker could elevate a low-privileged account to an administrative role by leveraging the CSRF vulnerability at the /admin/users/user.form endpoint. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/johnchd/CVEs/blob/main/OpenMRS/CVE-2025-25928%20-%20CSRF%20PrivEsc.md
CVE ID: CVE-2025-25929 State: PUBLISHED Published: 2025-03-11T00:00:00.000Z Last Updated: 2025-03-12T15:18:09.020Z Vendors: n/a Products: n/a Problem Types: n/a Description: A reflected cross-site scripting (XSS) vulnerability in the component /legacyui/quickReportServlet of Openmrs 2.4.3 Build 0ff0ed allows attackers to execute arbitrary JavaScript in the context of a user's browser via a crafted payload injected into the reportType parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/johnchd/CVEs/blob/main/OpenMRS/CVE-2025-25929%20-%20R-XSS.md
CVE ID: CVE-2025-25939 State: PUBLISHED Published: 2025-03-03T00:00:00.000Z Last Updated: 2025-03-04T16:47:47.966Z Vendors: n/a Products: n/a Problem Types: n/a Description: Reprise License Manager 14.2 is vulnerable to reflected cross-site scripting in /goform/activate_process via the akey parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/SamR2406/CVE-IDs/blob/main/Reprise%20License%20Manager%2014.2%20-%20Reflected%20Cross-Site%20Scripting%20%28CVE-2025-25939%29
CVE ID: CVE-2025-25940 State: PUBLISHED Published: 2025-03-10T00:00:00.000Z Last Updated: 2025-03-12T18:23:09.300Z Vendors: n/a Products: n/a Problem Types: n/a Description: VisiCut 2.1 allows code execution via Insecure XML Deserialization in the loadPlfFile method of VisicutModel.java. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/t-oster/VisiCut - https://royblume.github.io/CVE-2025-25940/
CVE ID: CVE-2025-25942 State: PUBLISHED Published: 2025-02-19T00:00:00.000Z Last Updated: 2025-02-20T14:39:29.278Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Bento4 v1.6.0-641 allows an attacker to obtain sensitive information via the the mp4fragment tool when processing invalid files. Specifically, memory allocated in SampleArray::SampleArray in Mp4Fragment.cpp is not properly released. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/axiomatic-systems/Bento4/issues/993
CVE ID: CVE-2025-25943 State: PUBLISHED Published: 2025-02-19T00:00:00.000Z Last Updated: 2025-02-20T14:44:53.856Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer Overflow vulnerability in Bento4 v.1.6.0-641 allows a local attacker to execute arbitrary code via the AP4_Stz2Atom::AP4_Stz2Atom component located in Ap4Stz2Atom.cpp. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/axiomatic-systems/Bento4/issues/993
CVE ID: CVE-2025-25944 State: PUBLISHED Published: 2025-02-19T00:00:00.000Z Last Updated: 2025-02-20T14:41:31.493Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer Overflow vulnerability in Bento4 v.1.6.0-641 allows a local attacker to execute arbitrary code via the Ap4RtpAtom.cpp, specifically in AP4_RtpAtom::AP4_RtpAtom, during the execution of mp4fragment with a crafted MP4 input file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/axiomatic-systems/Bento4/issues/993
CVE ID: CVE-2025-25945 State: PUBLISHED Published: 2025-02-19T00:00:00.000Z Last Updated: 2025-02-20T14:37:48.144Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Bento4 v1.6.0-641 allows an attacker to obtain sensitive information via the the Mp4Fragment.cpp and in AP4_DescriptorFactory::CreateDescriptorFromStream at Ap4DescriptorFactory.cpp. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/axiomatic-systems/Bento4/issues/993
CVE ID: CVE-2025-25946 State: PUBLISHED Published: 2025-02-19T00:00:00.000Z Last Updated: 2025-02-20T14:34:38.105Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Bento4 v1.6.0-641 allows an attacker to cause a memory leak via Ap4Marlin.cpp and Ap4Processor.cpp, specifically in AP4_MarlinIpmpEncryptingProcessor::Initialize and AP4_Processor::Process, during the execution of mp4encrypt with a specially crafted MP4 input file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/axiomatic-systems/Bento4/issues/994
CVE ID: CVE-2025-25947 State: PUBLISHED Published: 2025-02-19T00:00:00.000Z Last Updated: 2025-02-20T14:32:36.729Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Bento4 v1.6.0-641 allows an attacker to trigger a segmentation fault via Ap4Atom.cpp, specifically in AP4_AtomParent::RemoveChild, during the execution of mp4encrypt with a specially crafted MP4 input file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/axiomatic-systems/Bento4/issues/994
CVE ID: CVE-2025-25948 State: PUBLISHED Published: 2025-03-03T00:00:00.000Z Last Updated: 2025-04-18T13:52:45.571Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incorrect access control in the component /rest/staffResource/create of Serosoft Solutions Pvt Ltd Academia Student Information System (SIS) EagleR v1.0.118 allows create and modify user accounts, including an Administrator account. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/VvV1per/Vulnerability-Research-CVEs/tree/main/CVE-2024-53637 - https://github.com/VvV1per/Vulnerability-Research-CVEs/tree/main/CVE-2025-25948
CVE ID: CVE-2025-25949 State: PUBLISHED Published: 2025-03-03T00:00:00.000Z Last Updated: 2025-04-18T13:55:18.974Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored cross-site scripting (XSS) vulnerability in Serosoft Solutions Pvt Ltd Academia Student Information System (SIS) EagleR v1.0.118 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the User ID parameter at /rest/staffResource/update. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/VvV1per/Vulnerability-Research-CVEs/tree/main/CVE-2024-89636 - https://github.com/VvV1per/Vulnerability-Research-CVEs/tree/main/CVE-2025-25949
CVE ID: CVE-2025-25950 State: PUBLISHED Published: 2025-03-03T00:00:00.000Z Last Updated: 2025-04-18T13:57:57.281Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incorrect access control in the component /rest/staffResource/update of Serosoft Solutions Pvt Ltd Academia Student Information System (SIS) EagleR v1.0.118 allows create and modify user accounts, including an Administrator account. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/VvV1per/Vulnerability-Research-CVEs/tree/main/CVE-2024-89637 - https://github.com/VvV1per/Vulnerability-Research-CVEs/tree/main/CVE-2025-25950
CVE ID: CVE-2025-25951 State: PUBLISHED Published: 2025-03-03T00:00:00.000Z Last Updated: 2025-04-18T13:59:38.870Z Vendors: n/a Products: n/a Problem Types: n/a Description: An information disclosure vulnerability in the component /rest/cb/executeBasicSearch of Serosoft Solutions Pvt Ltd Academia Student Information System (SIS) EagleR v1.0.118 allows attackers to access sensitive user information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/VvV1per/Vulnerability-Research-CVEs/tree/main/CVE-2024-89638 - https://github.com/VvV1per/Vulnerability-Research-CVEs/tree/main/CVE-2025-25951
CVE ID: CVE-2025-25952 State: PUBLISHED Published: 2025-03-03T00:00:00.000Z Last Updated: 2025-04-18T14:00:51.492Z Vendors: n/a Products: n/a Problem Types: n/a Description: An Insecure Direct Object References (IDOR) in the component /getStudemtAllDetailsById?studentId=XX of Serosoft Solutions Pvt Ltd Academia Student Information System (SIS) EagleR v1.0.118 allows attackers to access sensitive user information via a crafted API request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/VvV1per/Vulnerability-Research-CVEs/tree/main/CVE-2024-89639 - https://github.com/VvV1per/Vulnerability-Research-CVEs/tree/main/CVE-2025-25952
CVE ID: CVE-2025-25953 State: PUBLISHED Published: 2025-03-03T00:00:00.000Z Last Updated: 2025-04-23T15:54:32.495Z Vendors: n/a Products: n/a Problem Types: n/a Description: Serosoft Solutions Pvt Ltd Academia Student Information System (SIS) EagleR v1.0.118 was discovered to contain an Azure JWT access token exposure. This vulnerability allows authenticated attackers to escalate privileges and access sensitive information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/VvV1per/Vulnerability-Research-CVEs/tree/main/CVE-2024-89640 - https://github.com/VvV1per/Vulnerability-Research-CVEs/tree/main/CVE-2025-25953
CVE ID: CVE-2025-25957 State: PUBLISHED Published: 2025-02-20T00:00:00.000Z Last Updated: 2025-02-21T14:57:22.293Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting vulnerabilities in Xunruicms v.4.6.3 and before allows a remote attacker to escalate privileges via a crafted script. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/dayrui/xunruicms/issues/5
CVE ID: CVE-2025-25958 State: PUBLISHED Published: 2025-02-20T00:00:00.000Z Last Updated: 2025-02-21T16:04:29.958Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting vulnerabilities in phpcmsv9 v.9.6.3 allows a remote attacker to escalate privileges via a crafted script. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Abel-Lan/phpcms/issues/1
CVE ID: CVE-2025-25960 State: PUBLISHED Published: 2025-02-20T00:00:00.000Z Last Updated: 2025-02-21T21:29:19.724Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting vulnerability in phpcmsv9 v.9.6.3 allows a remote attacker to escalate privileges via the menu interface of the member center of the background administrator. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Abel-Lan/phpcms/issues/2