Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-41048 State: PUBLISHED Published: 2025-09-04T11:12:24.522Z Last Updated: 2025-09-04T13:57:26.440Z Vendors: appRain Products: appRain CMF Problem Types: CWE-79 Description: A vulnerability has been discovered in appRain CMF version 4.0.5, consisting of a stored authenticated XSS due to a lack of proper validation of user input, through the 'data[Addon][layouts]' and 'data[Addon][layouts_except]' parameters in /apprain/developer/addons/update/admin. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-apprain-cmf
CVE ID: CVE-2025-41049 State: PUBLISHED Published: 2025-09-04T11:12:39.974Z Last Updated: 2025-09-04T13:08:24.773Z Vendors: appRain Products: appRain CMF Problem Types: CWE-79 Description: A vulnerability has been discovered in appRain CMF version 4.0.5, consisting of a stored authenticated XSS due to a lack of proper validation of user input, through the 'data[Addon][layouts]' and 'data[Addon][layouts_except]' parameters in /apprain/developer/addons/update/appform. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-apprain-cmf
CVE ID: CVE-2025-41050 State: PUBLISHED Published: 2025-09-04T11:12:50.842Z Last Updated: 2025-09-04T13:08:07.981Z Vendors: appRain Products: appRain CMF Problem Types: CWE-79 Description: A vulnerability has been discovered in appRain CMF version 4.0.5, consisting of a stored authenticated XSS due to a lack of proper validation of user input, through the 'data[Addon][layouts]' and 'data[Addon][layouts_except]' parameters in /apprain/developer/addons/update/base_libs. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-apprain-cmf
CVE ID: CVE-2025-41051 State: PUBLISHED Published: 2025-09-04T11:13:06.339Z Last Updated: 2025-09-04T13:07:50.954Z Vendors: appRain Products: appRain CMF Problem Types: CWE-79 Description: A vulnerability has been discovered in appRain CMF version 4.0.5, consisting of a stored authenticated XSS due to a lack of proper validation of user input, through the 'data[Addon][layouts]' and 'data[Addon][layouts_except]' parameters in /apprain/developer/addons/update/bootstrap. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-apprain-cmf
CVE ID: CVE-2025-41052 State: PUBLISHED Published: 2025-09-04T11:13:19.937Z Last Updated: 2025-09-04T13:07:37.361Z Vendors: appRain Products: appRain CMF Problem Types: CWE-79 Description: A vulnerability has been discovered in appRain CMF version 4.0.5, consisting of a stored authenticated XSS due to a lack of proper validation of user input, through the 'data[Addon][layouts]' and 'data[Addon][layouts_except]' parameters in /apprain/developer/addons/update/canvasjs. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-apprain-cmf
CVE ID: CVE-2025-41053 State: PUBLISHED Published: 2025-09-04T11:13:32.427Z Last Updated: 2025-09-04T13:07:15.165Z Vendors: appRain Products: appRain CMF Problem Types: CWE-79 Description: A vulnerability has been discovered in appRain CMF version 4.0.5, consisting of a stored authenticated XSS due to a lack of proper validation of user input, through the 'data[Addon][layouts]' and 'data[Addon][layouts_except]' parameters in /apprain/developer/addons/update/commonresource. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-apprain-cmf
CVE ID: CVE-2025-41054 State: PUBLISHED Published: 2025-09-04T11:13:42.278Z Last Updated: 2025-09-04T13:53:52.162Z Vendors: appRain Products: appRain CMF Problem Types: CWE-79 Description: A vulnerability has been discovered in appRain CMF version 4.0.5, consisting of a stored authenticated XSS due to a lack of proper validation of user input, through the 'data[Addon][layouts]' and 'data[Addon][layouts_except]' parameters in /apprain/developer/addons/update/cycle. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-apprain-cmf
CVE ID: CVE-2025-41055 State: PUBLISHED Published: 2025-09-04T11:13:54.903Z Last Updated: 2025-09-04T13:52:13.273Z Vendors: appRain Products: appRain CMF Problem Types: CWE-79 Description: A vulnerability has been discovered in appRain CMF version 4.0.5, consisting of a stored authenticated XSS due to a lack of proper validation of user input, through the 'data[Addon][layouts]' and 'data[Addon][layouts_except]' parameters in /apprain/developer/addons/update/dialogs. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-apprain-cmf
CVE ID: CVE-2025-41056 State: PUBLISHED Published: 2025-09-04T11:14:06.149Z Last Updated: 2025-09-04T13:50:07.736Z Vendors: appRain Products: appRain CMF Problem Types: CWE-79 Description: A vulnerability has been discovered in appRain CMF version 4.0.5, consisting of a stored authenticated XSS due to a lack of proper validation of user input, through the 'data[Addon][layouts]' and 'data[Addon][layouts_except]' parameters in /apprain/developer/addons/update/hysontable. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-apprain-cmf
CVE ID: CVE-2025-41057 State: PUBLISHED Published: 2025-09-04T11:14:15.980Z Last Updated: 2025-09-04T13:48:35.806Z Vendors: appRain Products: appRain CMF Problem Types: CWE-79 Description: A vulnerability has been discovered in appRain CMF version 4.0.5, consisting of a stored authenticated XSS due to a lack of proper validation of user input, through the 'data[Addon][layouts]' and 'data[Addon][layouts_except]' parameters in /apprain/developer/addons/update/rich_text_editor. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-apprain-cmf
CVE ID: CVE-2025-41058 State: PUBLISHED Published: 2025-09-04T11:14:30.127Z Last Updated: 2025-09-04T13:47:00.212Z Vendors: appRain Products: appRain CMF Problem Types: CWE-79 Description: A vulnerability has been discovered in appRain CMF version 4.0.5, consisting of a stored authenticated XSS due to a lack of proper validation of user input, through the 'data[Addon][layouts]' and 'data[Addon][layouts_except]' parameters in /apprain/developer/addons/update/row_manager. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-apprain-cmf
CVE ID: CVE-2025-41059 State: PUBLISHED Published: 2025-09-04T11:14:41.434Z Last Updated: 2025-09-04T13:45:58.595Z Vendors: appRain Products: appRain CMF Problem Types: CWE-79 Description: A vulnerability has been discovered in appRain CMF version 4.0.5, consisting of a stored authenticated XSS due to a lack of proper validation of user input, through the 'data[Addon][layouts]' and 'data[Addon][layouts_except]' parameters in /apprain/developer/addons/update/tablesorter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-apprain-cmf
CVE ID: CVE-2025-41060 State: PUBLISHED Published: 2025-09-04T11:14:53.885Z Last Updated: 2025-09-04T13:40:51.313Z Vendors: appRain Products: appRain CMF Problem Types: CWE-79 Description: A vulnerability has been discovered in appRain CMF version 4.0.5, consisting of a stored authenticated XSS due to a lack of proper validation of user input, through the 'data[Addon][layouts]' and 'data[Addon][layouts_except]' parameters in /apprain/developer/addons/update/tree. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-apprain-cmf
CVE ID: CVE-2025-41061 State: PUBLISHED Published: 2025-09-04T11:15:03.846Z Last Updated: 2025-09-04T13:35:37.464Z Vendors: appRain Products: appRain CMF Problem Types: CWE-79 Description: A vulnerability has been discovered in appRain CMF version 4.0.5, consisting of a stored authenticated XSS due to a lack of proper validation of user input, through the 'data[Addon][layouts]' and 'data[Addon][layouts_except]' parameters in /apprain/developer/addons/update/uploadify. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-apprain-cmf
CVE ID: CVE-2025-41062 State: PUBLISHED Published: 2025-09-04T11:16:03.297Z Last Updated: 2025-09-04T13:34:04.329Z Vendors: appRain Products: appRain CMF Problem Types: CWE-79 Description: A vulnerability has been discovered in version 4.0.5 of appRain CMF, consisting of an authenticated reflected XSS due to a lack of proper validation of user input, through the 'page' parameter in /apprain/developer/addons. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-apprain-cmf
CVE ID: CVE-2025-41063 State: PUBLISHED Published: 2025-09-04T11:16:15.444Z Last Updated: 2025-09-04T13:30:51.779Z Vendors: appRain Products: appRain CMF Problem Types: CWE-79 Description: A vulnerability has been discovered in version 4.0.5 of appRain CMF, consisting of an authenticated reflected XSS due to a lack of proper validation of user input, through the 's' parameter in /apprain/developer/debug-log/db. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-apprain-cmf
CVE ID: CVE-2025-41064 State: PUBLISHED Published: 2025-10-02T11:20:17.093Z Last Updated: 2025-10-02T15:52:53.228Z Vendors: GTT Products: OpenSIAC Problem Types: CWE-287 Description: Incorrect authentication vulnerability in OpenSIAC, which could allow an attacker to impersonate a person using Cl@ve as an authentication method. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/incorrect-authentication-gtts-group-opensiac
CVE ID: CVE-2025-41067 State: PUBLISHED Published: 2025-10-27T12:47:32.364Z Last Updated: 2025-10-29T10:27:42.252Z Vendors: NewPlane Products: Open5GS Problem Types: CWE-617 Description: Reachable Assertion vulnerability in Open5GS up to version 2.7.6 allows attackers with connectivity to the NRF to cause a denial of service. An SBI request that deletes the NRF's own registry causes a check that ends up crashing the NRF process and renders the discovery service unavailable. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-newplanes-open5gs - https://open5gs.org/open5gs/release/2025/07/19/release-v2.7.
/notices/aviso/multiple-vulnerabilities-newplanes-open5gs - https://open5gs.org/open5gs/release/2025/07/19/release-v2.7.6.html
CVE ID: CVE-2025-41068 State: PUBLISHED Published: 2025-10-27T12:47:57.984Z Last Updated: 2025-10-29T10:28:05.622Z Vendors: NewPlane Products: Open5GS Problem Types: CWE-617 Description: Reachable Assertion vulnerability in Open5GS up to version 2.7.6 allows attackers with connectivity to the NRF to cause a denial of service. This is achieved by sending the creation of an NF with an invalid type via SBI and then requesting its data. The NRF executes a check that crashes the process, leaving the discovery service unresponsive. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-newplanes-open5gs - https:/
t: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-newplanes-open5gs - https://open5gs.org/open5gs/release/2025/07/19/release-v2.7.6.html
CVE ID: CVE-2025-41069 State: PUBLISHED Published: 2025-11-13T13:23:18.794Z Last Updated: 2025-11-13T13:57:22.144Z Vendors: T-Innova DeporSite Products: DSuite 2025 Problem Types: CWE-639 Description: Insecure Direct Object Reference (IDOR) vulnerability in DeporSite of T-INNOVA. This vulnerability allows an attacker to access or modify unauthorized resources by manipulating requests using the 'idUsuario' parameter in ‘/ajax/TInnova_v2/Formulario_Consentimiento/llamadaAjax/obtenerDatosConsentimientos’, which could lead to the exposure or alteration os confidential data. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/insecur
itional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/insecure-direct-object-references-idor-deporsite-t-innova-deporsite
CVE ID: CVE-2025-41073 State: PUBLISHED Published: 2025-10-23T10:57:27.017Z Last Updated: 2025-10-23T14:40:49.039Z Vendors: TESI Products: Gandia Integra Total Problem Types: CWE-22 Description: Path Traversal vulnerability in version 4.4.2236.1 of TESI Gandia Integra Total. This issue allows an authenticated attacker to download a ZIP file containing files from the server, including those located in parent directories (e.g., ..\..\..), by exploiting the “direstudio” parameter in “/encuestas/integraweb[_v4]/integra/html/view/comprimir.php”. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/path-traversal-gandia-integra-total-t
ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/path-traversal-gandia-integra-total-tesi
CVE ID: CVE-2025-41074 State: PUBLISHED Published: 2025-11-20T12:47:05.559Z Last Updated: 2025-11-20T18:32:02.751Z Vendors: LimeSurvey Products: LimeSurvey Problem Types: CWE-835 Description: Vulnerability in LimeSurvey 6.13.0 in the endpoint /optout that causes infinite HTTP redirects when accessed directly. This behavior can be exploited to generate a Denegation of Service (DoS attack), by exhausting server or client resources. The system is unable to break the redirect loop, which can cause service degradation or browser instability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-limesurvey-0
CVE ID: CVE-2025-41075 State: PUBLISHED Published: 2025-11-20T12:49:29.997Z Last Updated: 2025-11-20T18:32:58.485Z Vendors: LimeSurvey Products: LimeSurvey Problem Types: CWE-835 Description: Vulnerability in LimeSurvey 6.13.0 in the endpoint /optin that causes infinite HTTP redirects when accessed directly. This behavior can be exploited to generate a Denegation of Service (DoS attack), by exhausting server or client resources. The system is unable to break the redirect loop, which can cause service degradation or browser instability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-limesurvey-0
CVE ID: CVE-2025-41076 State: PUBLISHED Published: 2025-11-20T12:52:25.797Z Last Updated: 2025-11-20T20:30:01.872Z Vendors: LimeSurvey Products: LimeSurvey Problem Types: CWE-209 Description: In version 6.13.0 of LimeSurvey, any external user can cause a 500 error in the survey system by sending a malformed session cookie. Instead of displaying a generic error message, the system exposes internal backend information, including the use of the Yii framework, the MySQL/MariaDB database engine, the table name 'lime_sessions', primary keys, and fragments of the content that caused the conflict. This information can simplify the collection of data about the internal architecture of the application
ed the conflict. This information can simplify the collection of data about the internal architecture of the application by an attacker. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-limesurvey-0
CVE ID: CVE-2025-41087 State: PUBLISHED Published: 2025-11-24T11:27:59.851Z Last Updated: 2025-11-24T13:01:54.233Z Vendors: Taclia Products: Taclia's web application Problem Types: CWE-79 Description: Cross-Site Scripting (XSS) vulnerability stored in tha Taclia web application, where the uploaded SVG images are not properly sanitized. This allows to the attackers to embed malicious scripts in SVG files such as image profiles, which are then stored on the server and executed in the context of any user who accesses the compromised resource. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/cross-site-scripting-xss-stored-taclia
DP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/cross-site-scripting-xss-stored-taclias-web-application
CVE ID: CVE-2025-41088 State: PUBLISHED Published: 2025-10-10T09:17:32.807Z Last Updated: 2025-10-10T13:37:54.494Z Vendors: Xibo Signage Products: Xibo CMS Problem Types: CWE-79 Description: Stored Cross-Site Scripting (XSS) in Xibo Signage's Xibo CMS v4.1.2, due to a lack of proper validation of user input. To exploit the vulnerability, the attacker must create a template in the 'Templates' section, then add a text element in the 'Global Elements' section, and finally modify the 'Text' field in the section with the malicious payload. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-xibo-cms
CVE ID: CVE-2025-41089 State: PUBLISHED Published: 2025-10-10T09:19:18.138Z Last Updated: 2025-10-10T13:37:04.706Z Vendors: Xibo Signage Products: Xibo CMS Problem Types: CWE-79 Description: Reflected Cross-Site Scripting (XSS) in Xibo CMS v4.1.2 from Xibo Signage, due to a lack of proper validation of user input. To exploit the vulnerability, the attacker must create a template in the 'Templates' section, then add an element that has the 'Configuration Name' field, such as the 'Clock' widget. Next, modify the 'Configuration Name' field in the left-hand section. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulner
Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-xibo-cms
CVE ID: CVE-2025-41090 State: PUBLISHED Published: 2025-10-28T09:17:08.128Z Last Updated: 2025-10-28T15:35:02.579Z Vendors: CCN-CERT Products: microCLAUDIA Problem Types: CWE-306 Description: microCLAUDIA in v3.2.0 and prior has an improper access control vulnerability. This flaw allows an authenticated user to perform unauthorized actions on other organizations' systems by sending direct API requests. To do so, the attacker can use organization identifiers obtained through a compromised endpoint or deduced manually. This vulnerability allows access between tenants, enabling an attacker to list and manage remote assets, uninstall agents, and even delete vaccines configurations. Additional An
g an attacker to list and manage remote assets, uninstall agents, and even delete vaccines configurations. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/improper-access-control-ccn-cert-microclaudia
CVE ID: CVE-2025-41091 State: PUBLISHED Published: 2025-09-30T11:10:49.088Z Last Updated: 2025-09-30T19:18:22.090Z Vendors: GLOBAL PLANNING SOLUTIONS S.L (GPS) Products: BOLD Workplanner Problem Types: CWE-639 Description: Insecure Direct Object Reference (IDOR) vulnerability in BOLD Workplanner in versions prior to 2.5.25 (4935b438f9b), consisting of a lack of adequate validation of user input, allowing an authenticated user to access to calendar details using unauthorised internal identifiers. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/insecure-direct-object-reference-gps-bold-workplanner
CVE ID: CVE-2025-41092 State: PUBLISHED Published: 2025-09-30T11:12:59.221Z Last Updated: 2025-09-30T19:21:12.468Z Vendors: GLOBAL PLANNING SOLUTIONS S.L (GPS) Products: BOLD Workplanner Problem Types: CWE-639 Description: Insecure Direct Object Reference (IDOR) vulnerability in BOLD Workplanner in versions prior to 2.5.25 (4935b438f9b), consisting of a lack of adequate validation of user input, allowing an authenticated user to access to time records details using unauthorised internal identifiers. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/insecure-direct-object-reference-gps-bold-workplanner
CVE ID: CVE-2025-41093 State: PUBLISHED Published: 2025-09-30T11:13:48.555Z Last Updated: 2025-09-30T19:22:52.080Z Vendors: GLOBAL PLANNING SOLUTIONS S.L (GPS) Products: BOLD Workplanner Problem Types: CWE-639 Description: Insecure Direct Object Reference (IDOR) vulnerability in BOLD Workplanner in versions prior to 2.5.25 (4935b438f9b), consisting of a lack of adequate validation of user input, allowing an authenticated user to access to basic contract details using unauthorised internal identifiers. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/insecure-direct-object-reference-gps-bold-workplanner
CVE ID: CVE-2025-41094 State: PUBLISHED Published: 2025-09-30T11:14:33.108Z Last Updated: 2025-09-30T19:24:40.970Z Vendors: GLOBAL PLANNING SOLUTIONS S.L (GPS) Products: BOLD Workplanner Problem Types: CWE-639 Description: Insecure Direct Object Reference (IDOR) vulnerability in BOLD Workplanner in versions prior to 2.5.25 (4935b438f9b), consisting of a lack of adequate validation of user input, allowing an authenticated user to access to functional contract details using unauthorised internal identifiers. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/insecure-direct-object-reference-gps-bold-workplanner
CVE ID: CVE-2025-41095 State: PUBLISHED Published: 2025-09-30T11:15:55.509Z Last Updated: 2025-09-30T19:25:16.750Z Vendors: GLOBAL PLANNING SOLUTIONS S.L (GPS) Products: BOLD Workplanner Problem Types: CWE-639 Description: Insecure Direct Object Reference (IDOR) vulnerability in BOLD Workplanner in versions prior to 2.5.25 (4935b438f9b), consisting of a lack of adequate validation of user input, allowing an authenticated user to access to planning counter details using unauthorised internal identifiers. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/insecure-direct-object-reference-gps-bold-workplanner
CVE ID: CVE-2025-41096 State: PUBLISHED Published: 2025-09-30T11:16:31.984Z Last Updated: 2025-09-30T19:24:49.948Z Vendors: GLOBAL PLANNING SOLUTIONS S.L (GPS) Products: BOLD Workplanner Problem Types: CWE-639 Description: Insecure Direct Object Reference (IDOR) vulnerability in BOLD Workplanner in versions prior to 2.5.25 (4935b438f9b), consisting of a lack of adequate validation of user input, allowing an authenticated user to access to the dates of the current contract details using unauthorised internal identifiers. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/insecure-direct-object-reference-gps-bold-workplanner
CVE ID: CVE-2025-41097 State: PUBLISHED Published: 2025-09-30T11:16:55.358Z Last Updated: 2025-09-30T19:24:28.801Z Vendors: GLOBAL PLANNING SOLUTIONS S.L (GPS) Products: BOLD Workplanner Problem Types: CWE-639 Description: Insecure Direct Object Reference (IDOR) vulnerability in BOLD Workplanner in versions prior to 2.5.25 (4935b438f9b), consisting of a lack of adequate validation of user input, allowing an authenticated user to access to basic employee details using unauthorised internal identifiers. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/insecure-direct-object-reference-gps-bold-workplanner